Establish Realistic IT Resource Management Practices

  • Buy Link or Shortcode: {j2store}435|cart{/j2store}
  • member rating overall impact: 9.5/10 Overall Impact
  • member rating average dollars saved: $36,337 Average $ Saved
  • member rating average days saved: 28 Average Days Saved
  • Parent Category Name: Portfolio Management
  • Parent Category Link: /portfolio-management
  • As CIO, you oversee a department that lacks the resource capacity to adequately meet organizational demand for new projects and services.
  • More projects are approved by the steering committee (or equivalent) than your department realistically has the capacity for, and you and your staff have little recourse to push back. If you have a PMO – and that PMO is one of the few that provides usable resource capacity projections – that information is rarely used to make strategic approval and prioritization decisions.
  • As a result, project quality and timelines suffer, and service delivery lags. Your staff are overallocated, but you lack statistical evidence because of incomplete estimates, allocations, and very little accurate data.

Our Advice

Critical Insight

  • IT’s capacity for new project work is largely overestimated. Much of IT’s time is lost to tasks that go unregulated and untracked (e.g. operations and support work, break-fixes and other reactive work) before project work is ever approved. When projects are approved, it is done so with little insight or concern for IT’s capacity to realistically complete that work.
  • The shift to matrix work structures has strained traditional methods of time tracking. Day-to-day demand is chaotic, and staff are pulled in multiple directions by numerous people. As fast-paced, rapidly changing, interruption-driven environments become the new normal, distractions and inefficiencies interfere with productive project work and usable capacity data.
  • The executive team approves too many projects, but it is not held to account for this malinvestment of time. Instead, it’s up to individual workers to sink or swim, as they attempt to reconcile, day after day, seemingly infinite organizational demand for new services and projects with their finite supply of working hours.

Impact and Result

  • Instill a culture of capacity awareness. For years, the project portfolio management (PPM) industry has helped IT departments report on demand and usage, but has largely failed to make capacity part of the conversation. This research helps inject capacity awareness into project and service portfolio planning, enabling IT to get proactive about constraints before overallocation spirals, and project and service delivery suffers.
  • Build a sustainable process. Efforts to improve resource management often falter when you try to get too granular too quickly. Info-Tech’s approach starts at a high level, ensuring that capacity data is accurate and usable, and that IT’s process discipline is mature enough to maintain the data, before drilling down into greater levels of precision.
  • Establish a capacity book of record. You will ultimately need a tool to help provide ongoing resource visibility. Follow the advice in this blueprint to help with your tool selection, and ensure you meet the reporting needs of both your team and executives.

Establish Realistic IT Resource Management Practices Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should develop a resource management strategy, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Take stock of organizational supply and demand

Set the right resource management approach for your team and create a realistic estimate of your resource supply and organizational demand.

  • Balance Supply and Demand with Realistic Resource Management Practices – Phase 1: Take Stock of Organizational Supply and Demand
  • Resource Management Supply-Demand Calculator
  • Time Audit Workbook
  • Time-Tracking Survey Email Template

2. Design a realistic resource management process

Build a resource management process to ensure data accuracy and sustainability, and make the best tool selection to support your processes.

  • Balance Supply and Demand with Realistic Resource Management Practices – Phase 2: Design a Realistic Resource Management Process
  • Resource Management Playbook
  • PPM Solution Vendor Demo Script
  • Portfolio Manager Lite 2017

3. Implement sustainable resource management practices

Develop a plan to pilot your resource management processes to achieve maximum adoption, and anticipate challenges that could inhibit you from keeping supply and demand continually balanced.

  • Balance Supply and Demand with Realistic Resource Management Practices – Phase 3: Implement Sustainable Resource Management Practices
  • Process Pilot Plan Template
  • Project Portfolio Analyst / PMO Analyst
  • Resource Management Communications Template
[infographic]

Workshop: Establish Realistic IT Resource Management Practices

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Take Stock of Organizational Supply and Demand

The Purpose

Obtain a high-level view of current resource management practices.

Identify current and target states of resource management maturity.

Perform an in-depth time-tracking audit and gain insight into how time is spent on project versus non-project work to calculate realized capacity.

Key Benefits Achieved

Assess current distribution of accountabilities in resource management.

Delve into your current problems to uncover root causes.

Validate capacity and demand estimations with a time-tracking survey.

Activities

1.1 Perform a root-cause analysis of resourcing challenges facing the organization.

1.2 Create a realistic estimate of project capacity.

1.3 Map all sources of demand on resources at a high level.

1.4 Validate your supply and demand assumptions by directly surveying your resources.

Outputs

Root-cause analysis

Tab 2 of the Resource Management Supply-Demand Calculator, the Time Audit Workbook, and survey templates

Tabs 3 and 4 of the Resource Management Supply-Demand Calculator

Complete the Time Audit Workbook

2 Design a Realistic Resource Management Process

The Purpose

Construct a resource management strategy that aligns with your team’s process maturity levels.

Determine the resource management tool that will best support your processes.

Key Benefits Achieved

Activities

2.1 Action the decision points in Info-Tech’s seven dimensions of resource management.

2.2 Review resource management tool options, and depending on your selection, prepare a vendor demo script or review and set up Info-Tech’s Portfolio Manager Lite.

2.3 Customize a workflow and process steps within the bounds of your seven dimensions and informed by your tool selection.

Outputs

A wireframe for a right-sized resource management strategy

A vendor demo script or Info-Tech’s Portfolio Manager Lite.

A customized resource management process and Resource Management Playbook.

3 Implement Sustainable Resource Management Practices

The Purpose

Develop a plan to pilot your new processes to test whether you have chosen the right dimensions for maintaining resource data.

Develop a communication plan to guide you through the implementation of the strategy and manage any resistance you may encounter.

Key Benefits Achieved

Identify and address improvements before officially instituting the new resource management strategy.

Identify the other factors that affect resource productivity.

Implement a completed resource management solution.

Activities

3.1 Develop a pilot plan.

3.2 Perform a resource management start/stop/continue exercise.

3.3 Develop plans to mitigate executive stakeholder, team, and structural factors that could inhibit your implementation.

3.4 Finalize the playbook and customize a presentation to help explain your new processes to the organization.

Outputs

Process Pilot Plan Template

A refined resource management process informed by feedback and lessons learned

Stakeholder management plan

Resource Management Communications Template

Further reading

Establish Realistic IT Resource Management Practices

Holistically balance IT supply and demand to avoid overallocation.

Analyst perspective

Restore the right accountabilities for reconciling supply and demand.

"Who gets in trouble at the organization when too many projects are approved?

We’ve just exited a period of about 20-25 years where the answer to the above question was usually “nobody.” The officers of the corporation held nobody to account for the malinvestment of resources that comes from approving too many projects or having systemically unrealistic project due dates. Boards of directors failed to hold the officers accountable for that. And shareholders failed to hold boards of directors accountable for that.

But this is shifting right under our feet. Increasingly, PMOs are being managed with the mentality previously reserved for those in the finance department. In many cases, the PMOs are now reporting to the CFO! This represents a very simple and basic reversion to the concept of fiduciary duty: somebody will be held to account for the consumption of all those hours, and somebody should be the approver of projects who created the excess demand." – Barry Cousins Senior Director of Research, PMO Practice Info-Tech Research Group

Our understanding of the problem

This Research Is Designed For:

  • IT leaders who lack actionable evidence of a resource-supply, work-demand imbalance.
  • CIOs whose departments struggle to meet service and project delivery expectations with given resources.
  • Portfolio managers, PMO directors, and project managers whose portfolio and project plans suffer due to unstable resource availability.

This Research Will Help You:

  • Build trustworthy resource capacity data to support service and project portfolio management.
  • Develop sustainable resource management practices to help you estimate, and continually validate, your true resource capacity for services and projects.
  • Identify the demands that deplete your resource capacity without creating value for IT.

This Research Will Also Assist:

  • Steering committee and C-suite management who want to improve IT’s delivery of projects.
  • Project sponsors that want to ensure their projects get the promised resource time by their project managers.

This Research Will Help Them:

  • Ensure sufficient supply of time for projects to be successfully completed with high quality.
  • Communicate the new resource management practice and get stakeholder buy-in.

Executive summary

Situation

  • As CIO, you oversee a department that lacks the resource capacity to adequately meet organizational demand for new projects and services. As a result, project quality and timelines suffer, and service delivery lags.
  • You need a resource management strategy to help bring balance to supply and demand in order to improve IT’s ability to deliver.

Complication

  • The shift to matrix work structures has strained traditional methods of time tracking. Day-to-day demand is chaotic; staff are pulled in multiple directions by numerous people, making usable capacity data elusive.
  • The executive team approves too many projects, but is not held to account for the overspend on time. Instead, the IT worker is made liable, expected to simply get things done under excessive demands.

Resolution

  • Instill a culture of capacity awareness. For years, the project portfolio management (PPM) industry has helped IT departments report on demand and usage, but it has largely failed to make capacity part of the conversation. This research helps inject capacity awareness into project and service portfolio planning, enabling IT to get proactive about constraints before overallocation spirals, and project and service delivery suffers.
  • Build a sustainable process. Efforts to get better at resource management often falter when you try to get too granular too quickly. Info-Tech’s approach starts at a high level, ensuring that capacity data is accurate and usable, and that IT’s process discipline is mature enough to maintain the data, before drilling down into greater levels of precision.
  • Establish a capacity hub. You will ultimately need a tool to help provide ongoing resource visibility. Follow the advice in this blueprint to help with your tool selection and ensure the reporting needs of both your team and executives are met.

Info-Tech Insight

  1. Take a realistic approach to resource management. New organizational realities have made traditional, rigorous resource projections impossible to maintain. Accept reality and get realistic about where IT’s time goes.
  2. Make IT’s capacity perpetually transparent. The best way to ensure projects are approved and scheduled based upon the availability of the right teams and skills is to shine a light into IT’s capacity and hold decision makers to account with usable capacity reports.

The availability of staff time is rarely factored into IT project and service delivery commitments

As a result, a lot gets promised and worked on, and staff are always busy, but very little actually gets done – at least not within given timelines or to expected levels of quality.

Organizations tend to bite off more than they can chew when it comes to project and service delivery commitments involving IT resources.

While the need for businesses to make an excess of IT commitments is understandable, the impacts of systemically overallocating IT are clearly negative:

  • Stakeholder relations suffer. Promises are made to the business that can’t be met by IT.
  • IT delivery suffers. Project timelines and quality frequently suffer, and service support regularly lags.
  • Employee engagement suffers. Anxiety and stress levels are consistently high among IT staff, while morale and engagement levels are low.

76% of organizations say they have too many projects on the go and an unmanageable and ever-growing backlog of things to get to. (Cooper, 2014)

Almost 70% of workers feel as though they have too much work on their plates and not enough time to do it. (Reynolds, 2016)

Resource management can help to improve workloads and project results, but traditional approaches commonly fall short

Traditional approaches to resource management suffer from a fundamental misconception about the availability of time in 2017.

The concept of resource management comes from a pre-World Wide Web era, when resource and project plans could be based on a relatively stable set of assumptions.

In the old paradigm, the availability of time was fairly predictable, as was the demand for IT services, so there was value to investing time into rigorous demand forecasts and planning.

Resource projections could be based in a secure set of assumptions – i.e. 8 hour days, 40 hour weeks – and staff had the time to support detailed resource management processes that provided accurate usage data.

Old Realities

  • Predictability. Change tended to be slow and deliberate, providing more stability for advanced, rigorous demand forecasts and planning.
  • Fixed hierarchy. Tasks, priorities, and decisions were communicated through a fixed chain of command.
  • Single-task focus. The old reality was more accommodating to sustained focus on one task at a time.

96% of organizations report problems with the accuracy of information on employee timesheets. (Dimensional, 2013)

Old reality resource forecasting inevitably falters under the weight of unpredictable demands and constant distractions

New realities are causing demands on workers’ time to be unpredictable and unrelenting, making a sustained focus on a specific task for any length of time elusive.

Part of the old resource management mythology is the idea that a person can do (for example) eight different one-hour tasks in eight hours of continuous work. This idea has gone from harmlessly mistaken to grossly unrealistic.

The predictability and focus have given way to more chaotic workplace realities. Technology is ubiquitous, and the demand for IT services is constant.

A day in IT is characterized by frequent task-switching, regular interruptions, and an influx of technology-enabled distractions.

Every 3 minutes and 5 seconds: How often the typical office worker switches tasks, either through self-directed or other-directed interruptions. (Schulte, 2015)

12 minutes, 40 seconds: The average amount of time in-between face-to-face interruptions in matrix organizations. (Anderson, 2015)

23 minutes, 15 seconds: The average amount of time it takes to become on task, productive, and focused again after an interruption. (Schulte, 2015)

759 hours: The average number of hours lost per employee annually due to distractions and interruptions. (Huth, 2015)

The validity of traditional, rigorous resource planning has long been an illusion. New realities are making the sustained focus and stable assumptions that old reality projections relied on all but impossible to maintain.

For resource management practices to be effective, they need to evolve to meet new realities

New organizational realities have exacerbated traditional approaches to time tracking, making accurate and usable resource data elusive.

The technology revolution that began in the 1990s ushered in a new paradigm in organizational structures. Matrix reporting structures, diminished supervision of knowledge workers, massive multi-tasking, and a continuous stream of information and communications from the outside world have smashed the predictability and stability of the old paradigm.

The resource management industry has largely failed to evolve. It remains stubbornly rooted in old realities, relying on calculations and rollups that become increasingly unsustainable and irrelevant in our high-autonomy staff cultures and interruption-driven work days.

New Realities

  • Unpredictable. Technologies and organizational strategies change before traditional IT demand forecasts and project plans can be realized.
  • Matrix management. Staff can be accountable to multiple project managers and functional managers at any given time.
  • Multi-task focus. In the new reality, workers’ attentions are scattered across multiple tasks and projects at any given time.

87% of organizations report challenges with traditional methods of time tracking and reporting. (Dimensional, 2013)

40% of working time is not tracked or tracked inaccurately by staff. (actiTIME, 2016)

Poor resource management practices cost organizations dearly

While time is money, the statistics around resource visibility and utilization suggest that the vast majority of organizations don’t spend their available time all that wisely.

Research shows that ineffective resource management directly impacts an organization’s bottom line, contributing to such cost drains as the systemic late delivery of projects and increased project costs.

Despite this, the majority of organizations fail to treat staff time like the precious commodity it is.

As the results of a 2016 survey show, the top three pain points for IT and PMO leaders all revolve around a wider cultural negligence concerning staff time (Alexander, TechRepublic, 2016):

  • Overcommitted resources
  • Constant change that affects staff assignments
  • An inability to prioritize shared resources

Top risks associated with poor resource management

Inability to complete projects on time – 52%

Inability to innovate fast enough – 39%

Increased project costs – 38%

Missed business opportunities – 34%

Dissatisfied customers or clients – 32%

12 times more waste – Organizations with poor resource management practices waste nearly 12 times more resource hours than high-performing organizations. (PMI, 2014)

The concept of fiduciary duty represents the best way to bring balance to supply and demand, and improve project outcomes

Unless someone is accountable for controlling the consumption of staff hours, too much work will get approved and committed to without evidence of sufficient resourcing.

Who is accountable for controlling the consumption of staff hours?

In many ways, no question is more important to the organization’s bottom line – and certainly, to the effectiveness of a resource management strategy.

Historically, the answer would have been the executive layer of the organization. However, in the 1990s management largely abdicated its obligation to control resources and expenditures via “employee empowerment.”

Controls on approvals became less rigid, and accountability for choosing what to do (and not do) shifted onto the shoulders of the individual worker. This creates a current paradigm where no one is accountable for the malinvestment…

…of resources that comes from approving too many projects. Instead, it’s up to individual workers to sink-or-swim, as they attempt to reconcile, day after day, seemingly infinite organizational demand with their finite supply of working hours.

If your organization has higher demand (i.e. approved project work) than supply (i.e. people’s time), your staff will be the final decision makers on what does and does NOT get worked on.

Effective time leadership distinguishes top performing senior executives

"Everything requires time… It is the one truly universal condition. All work takes place in time and uses up time. Yet most people take for granted this unique, irreplaceable and necessary resource. Nothing else, perhaps, distinguishes effective executives as much as their tender loving care of time." – Peter Drucker (quoted in Frank)

67% of employees surveyed believe their CEOs focus too much on decisions based in short-term financial results and not enough time on decisions that create a stable, positive workplace for staff. (2016 Edelman Trust Barometer)

Bring balance to supply and demand with realistic resource management practices

Use Info-Tech’s approach to resource management to capture an accurate view of where your time goes and achieve sustained visibility into your capacity for new projects.

Realistic project resource management starts by aligning demand with capacity, and then developing tactics to sustain alignment, even in the chaos of our fast-paced, rapidly changing, interruption-driven project environments.

This blueprint will help you develop practices to promote and maintain accurate resourcing data, while developing tactics to continually inform decision makers’ assumptions about how much capacity is realistically available for project work.

This research follows a three-phase approach to sustainable practices:

  1. Take Stock of Organizational Supply and Demand
  2. Design a Realistic Resource Management Process
  3. Implement Sustainable Resource Management Practices

Info-Tech’s three-phase framework is structured around a practical, tactical approach to resource management. It’s not about what you put together as a one-time snapshot. It’s about what you can and will maintain every week, even during a crisis. When you stop maintaining resource management data, it’s nearly impossible to catch up and you’re usually forced to start fresh.

Info-Tech’s approach is rooted in our seven dimensions of resource management

Action the decision points across Info-Tech’s seven dimensions to ensure your resource management process is guided by realistic data and process goals.

Default project vs. non-project ratio

How much time is available for projects once non-project demands are factored in?

Reporting frequency

How often is the allocation data verified, reconciled, and reported for use?

Forecast horizon

How far into the future can you realistically predict resource supply?

Scope of allocation

To whom is time allocated?

Allocation cadence

How long is each allocation period?

Granularity of time allocation

What’s the smallest unit of time to allocate?

Granularity of work assignment

What is time allocated to?

This blueprint will help you make the right decisions for your organization across each of these dimensions to ensure your resource management practices match your current process maturity levels.

Once your framework is defined, we’ll equip you with a tactical plan to help keep supply and demand continually balanced

This blueprint will help you customize a playbook to ensure your allocations are perpetually balanced week after week, month after month.

Developing a process is one thing, sustaining it is another.

The goal of this research isn’t just to achieve a one-time balancing of workloads and expect that this will stand the test of time.

The true test of a resource management process is how well it facilitates the flow of accurate and usable data as workloads become chaotic, and fires and crises erupt.

  • Info-Tech’s approach will help you develop a playbook and a “rebalancing routine” that will help ensure your allocations remain perpetually current and balanced.
  • The sample routine to the right shows you an example of what this rebalancing process will look like (customizing this process is covered in Phase 3 of the blueprint).

Sample “rebalancing” routine

  • Maintain a comprehensive list of the sources of demand (i.e. document the matrix).
  • Catalog the demand.
  • Allocate the supply.
  • Forecast the capacity to your forecast horizon.
  • Identify and prepare work packages or tasks for unsatisfied demand to ensure that supply can be utilized if it becomes free.
  • Reconcile any imbalance by repeating steps 1-5 on update frequency, say, weekly or monthly.

Info-Tech’s method is complemented by a suite of resource management tools and templates

Each phase of this blueprint is accompanied by supporting deliverables to help plan your resource management strategy and sustain your process implementation.

Resource management depends on the flow of information and data from the project level up to functional managers, project managers, and beyond – CIOs, steering committees, and senior executives.

Tools are required to help plan, organize, and facilitate this flow, and each phase of this blueprint is centered around tools and templates to help you successfully support your process implementation.

Take Stock of Organizational Supply and Demand

Tools and Templates:

Design a Realistic Resource Management Process

Tools and Templates:

Implement Sustainable Resource Management Practices

Tools and Templates:

Use Info-Tech’s Portfolio Manager Lite to support your new process without a heavy upfront investment in tools

Spreadsheets can provide a viable alternative for organizations not ready to invest in an expensive tool, or for those not getting what they need from their commercial selections.

While homegrown solutions like spreadsheets and intranet sites lack the robust functionality of commercial offerings, they have dramatically lower complexity and cost-in-use.

Info-Tech’s Portfolio Manager Lite is a sophisticated, scalable, and highly customizable spreadsheet-based solution that will get your new resource management process up and running, without a heavy upfront cost.

Kinds of PPM solutions used by Info-Tech clients

Homemade – 46%

Commercial – 33%

No Solution – 21%

(Info-Tech Research Group (2016), N=433)

The image shows 3 sheets with charts and graphs.

Samples of Portfolio Manager Lite's output and reporting tabs

Info-Tech’s approach to resource management is part of our larger project portfolio management framework

This blueprint will help you master the art of resource management and set you up for greater success in other project portfolio management capabilities.

Resource management is one capability within Info-Tech’s larger project portfolio management (PPM) framework.

Resource visibility and capacity awareness permeates the whole of PPM, helping to ensure the right intake decisions get made, and projects are scheduled according to resource and skill availability.

Whether you have an existing PPM strategy that you are looking to optimize or you are just starting on your PPM journey, this blueprint will help you situate your resource management processes within a larger project and portfolio framework.

Info-Tech’ s PPM framework is based on extensive research and practical application, and complements industry standards such as those offered by PMI and ISACA.

Project Portfolio Management
Status & Progress Reporting
Intake, Approval, & Prioritization Resource Management Project Management Project Closure Benefits Tracking
Organizational Change Management
Intake → Execution→ Closure

Realize the value that improved resource management practices could bring to your organization

Spend your company’s HR dollars more efficiently.

Improved resource management and capacity awareness will allow your organization to improve resource utilization and increase project throughput.

CIOs, PMOs, and portfolio managers can use this blueprint to improve the alignment between supply and demand. You should be able to gauge the value through the following metrics:

Near-Term Success Metrics (6 to 12 months)

  • Increased frequency of currency (i.e. more accurate and usable resource data and reports).
  • Improved job satisfaction from project resources due to more even workloads.
  • Better ability to schedule project start dates and estimate end dates due to recourse visibility.

Long-Term Success Metrics (12 to 24 months)

  • More projects completed on time.
  • Reclaimed capacity for project work.
  • A reduction in resource waste and increased resource utilization on productive project work.
  • Ability to track estimated vs. actual budget and work effort on projects.

In the past 12 months, Info-Tech clients have reported an average measured value rating of $550,000 from the purchase of workshops based on this research.

Info-Tech client masters resource management by shifting the focus to capacity forecasting

CASE STUDY

Industry Education

Source Info-Tech Client

Situation

  • There are more than 200 people in the IT organization.
  • IT is essentially a shared services environment with clients spanning multiple institutions across a wide geography.
  • The PMO identified dedicated resources for resource management.

Complication

  • The definition of “resource management” was constantly shifting between accounting the past (i.e. time records), the present (i.e. work assignments), and the future (i.e. long term project allocations).
  • The task data set (i.e. for current work assignments) was not aligned to the historic time records or future capacity.
  • It was difficult to predict or account for the spend, which exceeded 30,000 hours per month.

“We’re told we can’t say NO to projects. But this new tool set and approach allows us to give an informed WHEN.” – Senior PMO Director, Education

Resolution

  • The leadership decided to forecast and communicate their resource capacity on a 3-4 month forecast horizon using Info-Tech’s Portfolio Manager 2017.
  • Unallocated resource capacity was identified within certain skill sets that had previously been assessed as fully allocated. While some of the more high-visibility staff were indeed overallocated, other more junior personnel had been systemically underutilized on projects.
  • The high demand for IT project resourcing was immediately placed in the context of a believable, credible expression of supply.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostics and consistent frameworks used throughout all four options

Establish Realistic IT Resource Management Practices – project overview

1. Take Stock of Organizational Supply and Demand 2. Design a Realistic Resource Management Process 3. Implement Sustainable Resource Management Practices
Best-Practice Toolkit

1.1 Set a resource management course of action

1.2 Create realistic estimates of supply and demand

2.1 Customize the seven dimensions of resource management

2.2 Determine the resource management tool that will best support your process

2.3 Build process steps to ensure data accuracy and sustainability

3.1 Pilot your resource management process to assess viability

3.2 Plan to engage your stakeholders with your playbook

Guided Implementations
  • Scoping call
  • Assess how accountability for resource management is currently distributed
  • Create a realistic estimate of project capacity
  • Map all sources of demand on resources at a high level
  • Set your seven dimensions of resource management
  • Jump-start spreadsheet-based resource management with Portfolio Manager Lite
  • Build on the workflow to determine how data will be collected and who will support the process
  • Define the scope of a pilot and determine logistics
  • Finalize resource management roles and responsibilities
  • Brainstorm and plan for potential resistance to change, objections, and fatigue from stakeholders
Onsite Workshop

Module 1:

  • Take Stock of Organizational Supply and Demand

Module 2:

  • Design a Realistic Resource Management Process

Module 3:

  • Implement Sustainable Resource Management Practices

Phase 1 Outcome:

  • Resource Management Supply-Demand Calculator

Phase 2 Outcome:

  • Resource Management Playbook

Phase 3 Outcome:

  • Resource Management Communications Template

Workshop overview

Contact your account representative or email Workshops@InfoTech.com for more information.

Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4 Workshop Day 5
Activities

Introduction to PPM and resource management

1.1 Complete and review PPM Current State Scorecard Assessment

1.2 Perform root cause analysis of resource management challenges

1.3 Initiate time audit survey of management and staff

Take stock of supply and demand

2.1 Review the outputs of the time audit survey and analyze the data

2.2 Analyze project and non-project demands, including the sources of those demands

2.3 Set the seven dimensions of resource management

Design a resource management process

3.1 Review resource management tool options

3.2 Prepare a vendor demo script or review Portfolio Manager Lite

3.3 Build process steps to ensure data accuracy and sustainability

Pilot and refine the process

4.1 Define methods for piloting the strategy (after the workshop)

4.2 Complete the Process Pilot Plan Template

4.3 Conduct a mock resource management meeting

4.4 Perform a RACI exercise

Communicate and implement the process

5.1 Brainstorm potential implications of the new strategy and develop a plan to manage stakeholder and staff resistance to the strategy

5.2 Customize the Resource Management Communications Template

5.3 Finalize the playbook

Deliverables
  1. PPM Current State Scorecard Assessment
  2. Root cause analysis
  3. Time Audit Workbook and survey templates
  1. Resource Management Supply-Demand Calculator
  1. Portfolio Manager Lite
  2. PPM Solution Vendor Demo Script
  3. Tentative Resource Management Playbook
  1. Process Pilot Plan Template
  2. RACI chart
  1. Resource Management Communications Template
  2. Finalized Resource Management Playbook

Phase 1

Take Stock of Organizational Resource Supply and Demand

Phase 1 Outline

Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

Guided Implementation 1: Take Stock of Organizational Resource Supply and Demand

Proposed Time to Completion (in weeks): 1-2 weeks

Step 1.1: Analyze the current state

Start with an analyst kick-off call:

  • Discuss the goals, aims, benefits, and challenges of resource management
  • Identify who is currently accountable for balancing resource supply and demand

Then complete these activities…

  • Assess the current distribution of accountabilities in resource management
  • Delve into your current problems to uncover root causes
  • Make a go/no-go decision on developing a new resource management practice
Step 1.2: Estimate your supply and demand

Review findings with analyst:

  • Root causes of resource management
  • Your current impression about the resource supply-demand imbalance

Then complete these activities…

  • Estimate your resource capacity for each role
  • Estimate your project/non-project demand on resources
  • Validate the findings with a time-tracking survey

With these tools & templates:

  • Resource Management Supply-Demand Calculator
  • Time-Tracking Survey Email Template

Phase 1 Results & Insights:

A matrix organization creates many small, untraceable demands that are often overlooked in resource management efforts, which leads to underestimating total demand and overcommitting resources. To capture them and enhance the success of your resource management effort, focus on completeness rather than precision. Precision of data will improve over time as your process maturity grows.

Step 1.1: Set a resource management course of action

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:
  • Determine your resource management process capability level
  • Assess how accountability for resource management is currently distributed
This step involves the following participants:
  • CIO / IT Director
  • PMO Director/ Portfolio Manager
  • Functional / Resource Managers
  • Project Managers
Outcomes of this step
  • Current distribution of accountability for resource management practice
  • Root-cause analysis of resourcing challenges facing the organization
  • Commitment to implementing a right-sized resource management practice

“Too many projects, not enough resources” is the reality of most IT environments

A profound imbalance between demand (i.e. approved project work and service delivery commitments) and supply (i.e. people’s time) is the top challenge IT departments face today..

In today’s organizations, the desires of business units for new products and enhancements, and the appetites of senior leadership to approve more and more projects for those products and services, far outstrip IT’s ability to realistically deliver on everything.

The vast majority of IT departments lack the resourcing to meet project demand – especially given the fact that day-to-day operational demands frequently trump project work.

As a result, project throughput suffers – and with it, IT’s reputation within the organization.

Info-Tech Insight

Where does the time go? The portfolio manager (or equivalent) should function as the accounting department for time, showing what’s available in IT’s human resources budget for projects and providing ongoing visibility into how that budget of time is being spent.

Resource management can help to even out staff workloads and improve project and service delivery results

As the results of a recent survey* show, the top three pain points for IT and PMO leaders all revolve around a wider cultural negligence concerning staff time:

  • Overcommitted resources
  • Constant change that affects staff assignments
  • An inability to prioritize shared resources

A resource management strategy can help to alleviate these pain points and reconcile the imbalance between supply and demand by achieving the following outcomes:

  • Improving resource visibility
  • Reducing overallocation, and accordingly, resource stress
  • Reducing project delay
  • Improving resource efficiency and productivity

Top risks associated with poor resource management

Inability to complete projects on time – 52%

Inability to innovate fast enough – 39%

Increased project costs – 38%

Missed business opportunities – 34%

Dissatisfied customers or clients – 32%

12 times more waste – Organizations with poor resource management practices waste nearly 12 times more resource hours than high-performing organizations. (PMI, 2014)

Resource management is a core process in Info-Tech’s project portfolio management framework

Project portfolio management (PPM) creates a stable and secure infrastructure around projects.

PPM’s goal is to maximize the throughput of projects that provide strategic and operational value to the organization. To do this, a PPM strategy must help to:

Info-Tech's Project Portfolio Management Process Model
3. Status & Progress Reporting [make sure the projects are okay]
1. Intake, Approval, & Prioritization [select the right projects] 2. Resource Management [Pick the right time and people to execute the projects Project Management

4. Project Closure

[make sure the projects get done]

5. Benefits Tracking

[make sure they were worth doing]

Organizational Change Management
Intake → Execution→ Closure

If you don’t yet have a PPM strategy in place, or would like to revisit your existing PPM strategy before implementing resource management practices, see Info-Tech’s blueprint, Develop a Project Portfolio Management Strategy.

Effective resource management is rooted in a relatively simple set of questions

However, while the questions are rather simple, the answers become complicated by challenges unique to matrix organizations and other workplace realities in 2017.

To support the goals of PPM more generally, resource management must (1) supply quality work-hours to approved and ongoing projects, and (2) supply reliable data with which to steer the project portfolio.

To do this, a resource management strategy must address a relatively straightforward set of questions.

Key Questions

  • Who assigns the resources?
  • Who feeds the data on resources?
  • How do we make sure it’s valid?
  • How do we handle contingencies when projects are late or when availability changes?

Challenges

  • Matrix organizations require project workers to answer to many masters and balance project work with “keep the lights on” activities and other administrative work.
  • Interruptions, distractions, and divided attention create consistent challenges for workplace productivity.

"In matrix organizations, complicated processes and tools get implemented to answer the deceptively simple question “what’s Bob going to work on over the next few months?” Inevitably, the data captured becomes the focus of scrutiny as functional and project managers complain about data inaccuracy while simultaneously remaining reluctant to invest the effort necessary to improve quality." – Kiron Bondale

Determine your organization’s resource management capability level with a maturity assessment

1.1.1
10 minutes

Input

  • Organizational strategy and culture

Output

  • Resource management capability level

Materials

  • N/A

Participants

  • PMO Director/ Portfolio Manager
  • Project Managers
  • Resource Managers

Kick-off the discussion on the resource management process by deciding which capability level most accurately describes your organization’s current state.

Capability Level Descriptions
Capability Level 5: Optimized Our organization has an accurate picture of project versus non-project workloads and allocates resources accordingly. We periodically reclaim lost capacity through organizational and behavioral change.
Capability Level 4: Aligned We have an accurate picture of how much time is spent on project versus non-project work. We allocate resources to these projects accordingly. We are checking in on project progress bi-weekly.
Capability Level 3: Pixelated We are allocating resources to projects and tracking progress monthly. We have a rough estimate of how much time is spent on project versus non-project work.
Capability Level 2: Opaque We match resource teams to projects and check in annually, but we do not forecast future resource needs or track project versus non-project work.
Capability Level 1: Unmanaged Our organization expects projects to be finished, but there is no process in place for allocating resources or tracking project progress.

If resources are poorly managed, they prioritize work based on consequences rather than on meeting demand

As a result, matrix organizations are collectively steered by each resource and its individual motives, not by managers, executives, or organizational strategy.

In a matrix organization, demands on a resource’s time come from many directions, each demand unaware of the others. Resources are expected to prioritize their work, but they typically lack the authority to formally reject demand, so demand frequently outstrips the supply of work-hours the resource can deliver.

When this happens, the resource has three options:

  1. Work more hours, typically without compensation.
  2. Choose tasks not to do in a way that minimizes personal consequences.
  3. Diminish work quality to meet quantity demands.

The result is an unsustainable system for those involved:

  1. Resources cannot meet expectations, leading to frustration and disengagement.
  2. Managers cannot deliver on the projects or services they manage and struggle to retain skilled resources who are looking elsewhere for “greener pastures.”
  3. Executives cannot execute strategic plans as they lose decision-making power over their resources.

Scope your resource management practices within a matrix organization by asking “who?”

Resource management boils down to a seemingly simple question: how do we balance supply and demand? Balancing requires a decision maker to make choices; however, in a matrix organization, identifying this decision maker is not straightforward:

Balance

  • Who decides how much capacity should be dedicated to project work versus administrative or operational work?
  • Who decides how to respond to unexpected changes in supply or demand?

Supply

  • Who decides how much total capacity we have for each necessary skill set?
  • Who manages the contingency, or redundancy, of capacity?
  • Who validates the capacity supply as a whole?
  • Who decides what to report as unexpected changes in supply (and to whom)?

Demand

  • Who generates demand on the resource that can be controlled by their manager?
  • Who generates demand on the capacity that cannot be controlled by their manager?
  • Who validates the demand on capacity as a whole?
  • Who decides what to report as unexpected changes in demand (and to whom)?

The individual who has the authority to make choices, and who is ultimately liable for those decisions, is an accountable person. In a matrix organization, accountability is dispersed, sometimes spilling over to those without the necessary authority.

To effectively balance supply and demand, senior management must be held accountable

Differentiate between responsibility and accountability to manage the organization’s project portfolio effectively.

Responsibility

The responsible party is the individual (or group) who actually completes the task.

Responsibility can be shared.

VS.

Accountability

The accountable person is the individual who has the authority to make choices, and is ultimately answerable for the decision.

Accountability cannot be shared.

Resources often do not have the necessary scope of authority to make resource management choices, so they can never be truly accountable for the project portfolio. Instead, resources are accountable for making available trustworthy data, so the right people can make choices driven by organizational strategy.

The next activity will assess how accountability for resource management is currently distributed in your organization.

Assess the current distribution of accountability for resource management practice

1.1.2
15 minutes

Input

  • Organizational strategy and culture

Output

  • Current distribution of accountabilities for resource management

Materials

  • Whiteboard/flip chart
  • Markers

Participants

  • CIO
  • PMO Director/ Portfolio Manager

Below is a list of tasks in resource management that require choices. Discuss who is currently accountable and whether they have the right authority and ability to deliver on that accountability.

Resource management tasks that require choices Accountability
Current Effective?
Identify all demands on resources
Prioritize identified project demands
Prioritize identified operational demands
Prioritize identified administrative demands
Prioritize all of the above demands
Enumerate resource supply
Validate resource supply
Collect and validate supply and demand data
Defer or reject work beyond available supply
Adjust resource supply to meet demand

Develop coordination between project and functional managers to optimize resource management

Because resources are invariably responsible for both project and non-project work, efforts to procure capacity for projects cannot exist in isolation.

IT departments need many different technical skill sets at their disposal for their day-to-day operations and services, as well as for projects. A limited hiring budget for IT restricts the number of hires with any given skill, forcing IT to share resources between service and project portfolios.

This resource sharing produces a matrix organization divided along the lines of service and projects. Functional and project managers provide respective oversight for services and projects. Resources split their available work-hours toward service and project tasks according to priority – in theory.

However, in practice, two major challenges exist:

  1. Poor coordination between functional and project managers causes commitments beyond resource capacity, disputes about resource oversight, and animosity among management, all while resources struggle to balance unclear priorities.
  2. Resources have a “third boss,” namely uncontrolled demands from the rest of the business, which lack both visibility and accountability.

The image shows a board balanced on a ball (labelled Resource Management), with two balls on either end of it (Capacity Supply on the left, and Demand on the right), and another board balanced on top of the right ball, with two more balls balanced on either side of it (Projects on the left and Operational, Administrative, Etc. on the right).

Resource management processes must account for the numerous small demands generated in a matrix organization

Avoid going bankrupt $20 at a time: small demands add up to a significant chunk of work-hours.

Because resource managers must cover both projects and services within IT, the typical solution to allocation problems in matrix organizations is to escalate the urgency and severity of demands by involving the executive steering committee. Unfortunately, the steering committee cannot expend time and resources on all demands. Instead, they often set a minimum threshold for cases – 100-1,000 work-hours depending on the organization.

Under this resource management practice, small demands – especially the quick-fixes and little projects from “the third boss” – continue to erode project capacity. Eventually, projects fail to get resources because pesky small demands have no restrictions on the resources they consumed.

Realistic resource management needs to account for demand from all three bosses; however…

Info-Tech Insight

Excess project or service request intake channels lead to the proliferation of “off-the-grid” projects and tasks that lack visibility from the IT leadership. This can indicate that there may be too much red tape: that is, the request process is made too complex or cumbersome. Consider simplifying the request process and bring IT’s visibility into those requests.

Interrogate your resource management problems to uncover root causes

1.1.3
30 minutes to 1 hour

Input

  • Organizational strategy and culture

Output

  • Root causes of resource management failures

Materials

  • Whiteboard/flip chart
  • Sticky notes
  • Markers

Participants

  • CIO
  • PMO Director/ Portfolio Manager
  • Functional Managers
  • Project Managers
  1. Pick a starting problem statement in resource management. e.g. projects can’t get resource work-hours.
  2. Ask the participants “why”? Use three generic headings – people, processes, and technology – to keep participants focused. Keep the responses solution-agnostic: do not jump to solutions. If you have a large group, divide into smaller groups and use sticky notes to encourage more participation in this brainstorming step.
People Processes Technology
  • We don’t have enough people/skills.
  • People are tied up on projects that run late.
  • Functional and project managers appear to hoard resources.
  • Resources cannot prioritize work.
  • Resources are too busy responding to 911s from the business.
  • Resources cannot prioritize projects vs. operational tasks.
  • “Soft-closed” projects do not release resources for other work.
  • We don’t have tools that show resource availability.
  • Tools we have for showing resource availability are not being used.
  • Data is inaccurate and unreliable.
  1. Determine the root cause by iteratively asking “why?” up to five times, or until the chain of whys comes full circle. (i.e. Why A? B. Why B? C. Why C? A.) See below for an example.

1.1.2 Example of a root-cause analysis: people

The following is a non-exhaustive example:

The image shows an example of a root-cause analysis. It begins on the left with the header People, and then lists a series of challenges below. Moving toward the right, there are a series of headers that read Why? at the top of the chart, and listing reasons for the challenges below each one. As you read through the chart from left to right, the reasons for challenges become increasingly specific.

Right-size your resource management strategy with Info-Tech’s realistic resource management practice

If precise, accurate, and complete data on resource supply and demand was consistently available, reporting on project capacity would be easy. Such data would provide managers complete control over a resource’s time, like a foreman at a construction site. However, this theoretical scenario is incompatible with today’s matrixed workplace:

  • Sources of demand can lie outside IT’s control.
  • Demand is generated chaotically, with little predictability.
  • Resources work with minimal supervision.

Collecting and maintaining resource data is therefore nearly impossible:

  • Achieving perfect data accuracy creates unnecessary overhead.
  • Non-compliance by one project or resource makes your entire data set unusable for resource management.

This blueprint will guide you through right-sizing your resource management efforts to achieve maximum value-to-effort ratio and sustainability.


The image shows a graph with Quality, Value on the Y axis, and Required Effort on the X-Axis. The graph is divided into 3 categories, based on the criteria: Value-to-effort Ratio and Sustainability. The three sections are labelled at the top of the graph as: Reactive, “gut feel”-driven; Right-sized resource management; Full control, complete data. The 2nd section is bolded. The line in the graph starts low, rising through the 2nd section, and is stable at the top of the chart in the final section.

Choose your resource management course of action

Portfolio managers looking for a resource management solution have three mutually exclusive options:

Option A: Do Nothing

  • Rely on expert judgment and intuition to make portfolio choices.
  • Allow the third boss to dictate the demands of your resources.

Option B: Get Precise

  • Aim for granularity and precision of data with a solution that may demand more capacity than is realistically available by hiring, outsourcing, or over-allocating people’s time.
  • Require detailed, accurate time sheets for all project tasks.
  • For those choosing this option, proceed to Info-Tech’s Select and Implement a PPM Solution.

Option C: Get Realistic

  • Balance capacity supply and demand using abstraction.
  • Implement right-sized resource management practices that rely on realistic, high-level capacity estimates.
  • Reduce instability in data by focusing on resource capacity, rather than granular project demands and task level details.

This blueprint takes you through the steps necessary to accomplish Option C, using Info-Tech’s tools and templates for managing your resources.

Step 1.2: Create realistic estimates of supply and demand

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:
  • Create a realistic estimate of project capacity
  • Map all sources of demand on resources at a high level
  • Validate your supply and demand assumptions by directly surveying your resources
This step involves the following participants:
  • PMO Director / Portfolio Manager
  • Project Managers (optional)
  • Functional / Resource Managers (optional)
  • Project Resources (optional)
Outcomes of this step
  • A realistic estimate of your total and project capacity, as well as project and non-project demand on their time
  • Quantitative insight into the resourcing challenges facing the organization
  • Results from a time-tracking survey, which are used to validate the assumptions made for estimating resource supply and demand

Create a realistic estimate of your project capacity with Info-Tech’s Resource Management Supply-Demand Calculator

Take an iterative approach to capacity estimates: use your assumptions to create a meaningful estimate, and then validate with your staff to improve its accuracy.

Use Info-Tech’s Resource Management Supply-Demand Calculator to create a realistic estimate of your project capacity.

The calculator tool requires minimal upfront staff participation: you can obtain meaningful results with participation from even a single person, with insight on the distribution of your resources and their average work week or month. As the number of participants increases, the quality of analysis will improve.

The first half of this step guides you through how to use the calculator. The second half provides tactical advice on how to gather additional data and validate your resourcing data with your staff.

Download Info-Tech’s Resource Management Supply-Demand Calculator

Info-Tech Insight

What’s first, process or tools? Remember that process determines the quality of your data while data quality limits the tool’s utility. Without quality data, you cannot evaluate the success of the tool, so nail down your collection process first.

Break down your resource capacity into high-level buckets of time for each role

1.2.1
30 minutes - 1 hour

Input

  • Staff resource types
  • Average work week
  • Estimated allocations

Output

A realistic estimate of project capacity

Materials

Resource Management Supply-Demand Calculator

Participants

  • PMO Director
  • Resource/Functional Managers (optional)

We define four high-level buckets of resource time:

  • Absence: on average, a resource spends 14% of the year on vacation, statutory holidays, business holidays and other forms of absenteeism.
  • Administrative: time spent on meetings, recordkeeping, etc.
  • Operational: keeping the lights on; reactive work.
  • Projects: time to work on projects; typically, this bucket of time is whatever’s left from the above.

The image shows a pie chart with four sections: Absence - 6,698 14%; Admin - 10,286 22%; Keep the Lights On - 15, 026 31%; Project Capacity 15, 831 33%.

Instructions for working through Tab 2 of the Resource Management Supply-Demand Calculator are provided in the next two sections. Follow along to obtain your breakdown of annual resource capacity in a pie chart.

Break down your resource capacity into high-level buckets of time for each role

1.2.1
Resource Management Supply-Demand Calculator, Tab 2: Capacity Supply

Discover how many work-hours are at your disposal by first accounting for absences.

The image shows a section of the Resource Management Supply-Demand Calculator, for calculating absences, with sample information filled in.

  1. Compile a list of each of the roles within your department.
  2. Enter the number of staff currently performing each role.
  3. Enter the number of hours in a typical work week for each role.
  4. Enter the foreseeable out-of-office time (vacation, sick time, etc.) Typically, this value is 12-16% depending on the region.

Hours per Year represents your total resource capacity for each role, as well as the entire department. This column is automatically calculated.

Working Time per Year represents your total resource capacity minus time employees are expected to spend out of office. This column is automatically calculated.

Info-Tech Insight

Example for a five-day work week:

  • 2 weeks (10 days) of statutory holidays
  • 3 weeks of vacation
  • 1.4 weeks (7 days) of sick days on average
  • 1 week (5 days) for company holidays

Result: 7.4/52 weeks’ absence = 14.2%

Break down your resource capacity into high-level buckets of time for each role (continued)

1.2.1
Resource Management Supply-Demand Calculator, Tab 2: Capacity Supply

Determine the current distribution of your resources’ time and your confidence in whether the resources indeed supply those times.

The image is a screen capture of the Working Time section of the calculator, with sample information filled in.

5. Enter the percentage of working time across each role that, on an annual basis, goes toward administrative duties (non-project meetings, training, time spent checking email, etc.) and keep-the-lights-on work (e.g. support and maintenance work).

While these percentages will vary by individual, a high-level estimate across each role will suffice for the purposes of this activity.

6. Express how confident you are in each resource being able to deliver the calculated project work hours in percentages.

Another interpretation for supply confidence is “supply control”: estimate your current ability to control this distribution of working time to meet the changing needs in percentages.

Percentage of your working time that goes toward project work is calculated based upon what’s left after your non-project working time allocations have been subtracted.

Create a realistic estimate of the demand from your project portfolio with the T-shirt sizing technique

1.2.2
15 minutes - 30 minutes

Input

  • Average work-hours for a project
  • List of projects
  • PPM Current State Scorecard

Output

A realistic estimate of resource demand from your project portfolio

Materials

Resource Management Supply-Demand Calculator

Participants

  • PMO Director
  • Project Managers (optional)

Quickly re-express the size of your project portfolio in resource hours required.

Estimating the resources required for a project in a project backlog can take a lot of effort. Rather than trying to create an accurate estimate for each project, a set of standard project sizes (often referred to as the “T-shirt sizing” technique) will be sufficiently accurate for estimating your project backlog’s overall demand.

Instructions for working through Tab 3 of the tool are provided here and in the next section.

1. For each type of project, enter the average number for work-hours.

Project Types Average Number of Work Hours for a Project
Small 80
Medium 200
Large 500
Extra-Large 1000

Improve your estimate of demand from your project portfolio by accounting for unproductive capacity spending

1.2.2
Resource Management Supply-Demand Calculator, Tab 3: Project Demand

2. Using your list of projects, enter the number of projects for each appropriate field.

The image shows a screen capture of the number of projects section of the Resource Management Supply-Demand Calculator, with sample information filled in.

3. Enter your resource waste data from the PPM Current State Scorecard (see next section). Alternatively, enter your best guess on how much project capacity is spent wastefully per category.

The image shows a screen capture of the Waste Assessment section of the Resource Management Supply-Demand Calculator, with sample information filled in, and a pie chart on the right based on the sample data.

Info-Tech Insight

The calculator estimates the project demand by T-shirt-sizing the work-hours required by projects to be delivered within the next 12 months and then adding the corresponding wasted capacity. This may be a pessimistic estimate, but it is more realistic because projects tend to be delivered late more than early.

Estimate how much project capacity is wasted with Info-Tech’s PPM Current State Scorecard

Call 1-888-670-8889 or contact your Account Manager for more information.

This step is highly recommended but not required.

Info-Tech’s PPM Current State Scorecard diagnostic provides a comprehensive view of your portfolio management strengths and weaknesses, including project portfolio management, project management, customer management, and resource utilization.

Use the wisdom-of-the-crowd to estimate resource waste in:

  • Cancelled projects
  • Inefficiency
  • Suboptimal assignment of resources
  • Unassigned resources
  • Analyzing, fixing, and redeploying

50% of PPM resource is wasted on average, effectively halving your available project capacity.

Estimate non-project demand on your resources by role

1.2.3
45 minutes - 1 hour

Input

  • Organizational chart
  • Knowledge of staff non-project demand

Output

Documented non-project demands and their estimated degree of fluctuation

Materials

Resource Management Supply-Demand Calculator

Participants

  • PMO Director
  • Functional Managers (optional)
Document non-project demand that could eat into your project capacity.

When discussing project demands, non-project demands (administrative and operational) are often underestimated and downplayed – even though, in reality, they take a de facto higher priority to project work. Use Tab 4 of the tool to document these non-project demands, as well as their sources.

The image shows a screen capture from Tab 4 of the tool, with sample information filled in.

1. Choose a role using a drop-down list.

2. Enter the type and the source of the demand.

3. Enter the size and the frequency of the demand in hours.

4. Estimate how stable the non-project demands are for each role.

Examine and discuss your supply-demand analysis report

1.2.4
30 minutes - 1 hour

Input

Completed Resource Management Supply-Demand Calculator

Output

Supply-Demand Analysis Report

Materials

Resource Management Supply-Demand Calculator

Participants

  • PMO Director
  • Functional Managers
  • Project Managers

Start a data-driven discussion on resource management using the capacity supply-demand analysis report.

Tab 5 of the calculator is a report that contains the following analysis:

  1. Overall resource capacity supply and demand gap
  2. Project capacity supply vs. demand gap
  3. Non-project capacity supply vs. demand balance
  4. Resource capacity confidence

Each analysis is described and explained in the following four sections. Examine the report and discuss the following among the activity participants:

  1. How is your perception of the current resource capacity supply-demand balance affected by this analysis? How is it confirmed? Is it changed?
  2. Perform a root-cause analysis of problems revealed by the report. For each observation, ask “why?” repeatedly – generally, you can arrive at the root cause in four iterations.
  3. Refer back to Activity 1.1.2: current distribution of accountability for resource management. In your situation, how would you prioritize which resource management tasks to improve? Who are the involved stakeholders?

Examine your supply-demand analysis report: overall resource capacity gap

1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis

1. Examine your resource capacity supply and demand gap.

The top of the report on Tab 5 shows a breakdown of your annual resource supply and demand, with resource capacity shown in both total hours and percentage of the total. For the purposes of the analysis, absence is averaged. If total demand is less than available resource supply, the surplus capacity will be displayed as “Free Capacity” on the demand side.

The Supply & Demand Analysis table displays the realistic project capacity, which is calculated by subtracting non-project supply deficit from the project capacity. This is based on the assumption that all non-project work must get done. The difference between the project demand and the realistic project capacity is your supply-demand gap, in work-hours.

If your supply-demand gap is zero, recognize that the project demand does not take into account the project backlog: it only takes into account the projects that are expected to be delivered within the next 12 months.

Examine your supply-demand analysis report: project capacity gap

1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis

2. Examine your project capacity supply vs. demand gap.

The project capacity supply and demand analysis compares your available annual project capacity with the size of your project portfolio, expressed in work-hours.

The supply side is further broken down to productive vs. wasted project capacity. The demand side is broken down to three buckets of projects: those that are active, those that sit in the backlog, and those that are expected to be added within 12 months. Percentage values are expressed in terms of total project capacity.

A key observation here is the limitation to which reducing wasteful spending of resources can get to the project portfolio backlog. In this example, even a theoretical scenario of 100% productive project capacity will not likely result in net shrinkage of the project portfolio backlog. To achieve that, either the total project capacity must be increased, or less projects must be approved.

Note: the work-hours necessary for delivering projects that are expected to be completed within 12 months is not shown in this visualization, as they should be represented within the other three categories of projects.

Examine your supply-demand analysis report: non-project capacity gap

1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis

3. Drill down on the non-project capacity supply-demand balance by each role.

The non-project capacity supply and demand analysis compares your available non-project capacity and their demands in a year, for each role, in work-hours.

With this chart, you can:

  1. Observe which roles are “running hot,” (i.e. they have more demand than available supply).
  2. Verify your non-project/project supply ratio assumptions in Tab 2 of the tool / Activity 1.2.1.

Tab 5 also provides similar breakdowns for administrative and keep-the-lights-on capacity supply and demand by each role.

Examine your supply-demand analysis report: resource capacity confidence (RCC)

1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis

4. Examine your resource capacity confidence.

In our approach, we introduce a metric called Resource Capacity Confidence (RCC). Conceptually, RCC is defined as follows:

Resource Capacity Confidence = SC × DS × SDR

Term Name Description
SC Supply Control How confident are you that the supply of your resources’ project capacity will be delivered?
DS Demand Stability How wildly does demand fluctuate? If it cannot be controlled, can it be predicted?
SDR Supply-Demand Ratio How severely does demand outstrip supply?

In this context, RCC can be defined as follows:

"Given the uncertainty that our resources can supply hours according to the assumed project/non-project ratio, the fluctuations in non-project demand, and the overall deficit in project capacity, there is about 50% chance that we will be able to deliver the projects we are expected to deliver within the next 12 months."

Case study: Non-project work is probably taking far more time than you might like

CASE STUDY

Industry Government

Source Info-Tech Client

"When our customers get a budget for a project, it’s all in capital. It never occurs to them that IT has a limited number of hours. "

Challenge

  • A small municipal government was servicing a wide geographic area for information technology and infrastructure services.
  • There was no meaningful division of IT resources between support and project work.
  • Previous IT leadership tried a commercial PPM tool and stopped paying maintenance fees for it because of lack of adoption.
  • Projects were tracked inconsistently in multiple places.

Solution

  • New project requests were approved with IT involvement.
  • Project approvals were entirely associated with the capital budget required and resourcing was never considered to be a constraint.
  • The broad assumption was that IT time was generally available for project work.
  • In reality, the IT personnel had almost no time for project work.

Results

  • The organization introduced Info-Tech’s Grow Your Own PPM Solution template with minor modifications.
  • They established delivery dates for projects based on available time.
  • Time was allocated for projects based on person, project, percentage of time, and month.
  • They prioritized project allocations above reactive support work.

Validate your resourcing assumptions with your staff by surveying their use of time

Embrace the reality of imperfect IT labor efficiency to improve your understanding of resource time spend.

Use Info-Tech’s time-tracking survey to validate your resourcing assumptions and get additional information to improve your understanding of resource time spent: imperfect labor efficiency and continuous partial attention.

Causes of imperfect IT labor inefficiency
  • Most IT tasks are unique to their respective projects and contexts. A component that took 30 minutes to install last year might take two hours to install this year due to system changes that occurred since then.
  • Many IT tasks come up unexpectedly due to the need to maintain and support systems implemented on past projects. This work is unpredictable in terms of specifics (what will break where, when, or how).
  • Task switching slows people down and consumes time.
  • Problem solving and solution design often requires unstructured time to think more openly. Some of the most valuable solutions are conceived or discovered when people aren’t regimented and focused on getting things done.

Info-Tech Insight

Part of the old resource management mythology is the idea that a person can do (for example) eight different one-hour tasks in eight hours of continuous work. This idea has gone from harmlessly mistaken to grossly unrealistic.

Constant interruptions lead to continuous partial attention that threatens real productivity

There’s a difference between being busy and getting things done.

“Working” on multiple tasks at once can often feel extremely gratifying in the short term because it distracts people from thinking about work that isn’t being done.

The bottom line is that continuous partial attention impedes the progress of project work.

Research on continuous partial attention
  • A study that analyzed interruptions and their effects on individuals in the workplace found that that “41% of the time an interrupted task was not resumed right away” (Mark, 2015).
  • Research has also shown that it can take people an average of 23 minutes to return to a task after being interrupted (Schulte, 2015).
  • Delays following interruptions are typically due to switching between multiple other activities before returning to the original task. In many cases, those tasks are much lower priorities – and in some cases not even work-related.

Info-Tech Insight

It may not be possible to minimize interruptions in the workplace, as many of these are considered to be urgent at the time. However, setting guidelines for how and when individuals can be interrupted may help to limit the amount of lost project time.

"Like so many things, in small doses, continuous partial attention can be a very functional behavior. However, in large doses, it contributes to a stressful lifestyle, to operating in crisis management mode, and to a compromised ability to reflect, to make decisions, and to think creatively."

– Linda Stone, Continuous Partial Attention

Define the goals and the scope of the time-tracking survey

1.2.5
30 minutes

Input

Completed Resource Management Supply-Demand Calculator

Output

Survey design for the time-tracking survey

Materials

N/A

Participants

  • PMO Director
  • Functional Managers
  • Project Managers

Discuss the following with the activity participants:

  1. Define the scope of the survey
    • Respondents: Comprehensive survey of individuals vs. a representative sample using roles.
    • Granularity: decide how in-depth the questions will be and how often the survey will be delivered.
    • Data Collection: what information do you want to collect?
      • Proportion of project vs. non-project work.
      • Time spent on administrative tasks.
      • Prevalence and impact of distractions.
      • Worker satisfaction.
  2. Determine the sample time period covered by the survey
    • Info-Tech recommends 2-4 weeks. Less than 2 weeks might not be a representative sample, especially during vacation seasons.
    • More than 4 weeks will impose unreasonable time and effort for diminishing returns; data quality will begin to deteriorate as participation declines.
  3. Determine the survey method
    • Use your organization’s preferred survey distributor/online survey tool, or conduct one-on-one interviews to capture data.

1.2.5 continued - Refine the questionnaire to improve the relevance and quality of insights produced by the survey

Start with Info-Tech’s recommended weekly survey questions:

  1. Estimate your daily average for number of hours spent on:
    1. Total work
    2. Project work
    3. Non-project work
  2. How many times are you interrupted with “urgent” requests requiring immediate response in a given day?
  3. How many people or projects did you complete tasks for this week?
  4. Rate your overall satisfaction with work this week.
  5. Describe any special tasks, interruptions, or requests that took your time and attention away from project work this week.

Customize these questions to suit your needs.

Info-Tech Insight

Maximize the number of survey responses you get by limiting the number of questions you ask. Info-Tech finds that participation drops off rapidly after five questions.

1.2.5 continued - Communicate the survey goals and steps, and conduct the survey

  1. Communicate the purpose and goals of the survey to maximize participation and satisfaction.
    • Provide background for why the survey is taking place. Clarify that the intention is to improve working conditions and management capabilities, not to play “gotcha” or hold workers accountable.
  2. Provide a timeline so expectations are clear about when possible next steps will occur, such as
    • Sharing and analyzing results
    • Making decisions
    • Taking action
  3. Reiterate what people are required or expected to do and how much effort is required. Provide reasonable and realistic estimates of how much time and effort people should spend on audit participation.
  4. Distribute the survey; collect and analyze the data.

Info-Tech Insight

Make sure that employees understand the purpose of the survey. It is important that they give honest responses that reflect the struggles they are encountering with balancing project and non-project work, not simply telling management what they want to hear.

Ensuring that employees know this survey is being used to help them, rather than scolding them for not completing work, will give you useful, insightful data on employee time.

Use Info-Tech’s Time-Tracking Survey Email Template for facilitating your communications.

Info-Tech Best Practice

Provide guidance to your resources with examples on how to differentiate project work vs. non-project work, administrative vs. keep-the-lights-on work, what counts as interruptions, etc.

Optimize your project portfolio to maintain continuous visibility into capacity

Now that you have a realistic picture of your realized project capacity and demand amounts, it’s time to use these values to tailor and optimize your resource management practices.

Based on desired outcomes for this phase, we have

  1. Determined the correct course of action to resolve your supply/demand imbalances.
  2. Assessed the overall project capacity of your portfolio.
  3. Cataloged sources of project and non-project demands.
  4. Performed a time audit to create an accurate and realistic picture of the time spent on different types of work.

In the next phase, we will:

  1. Wireframe a resource management process.
  2. Choose a resource management tool.
  3. Define data collection, analysis, and reporting steps within a sustainable resource management process.

The image is a screenshot from tab 6 of the Time Audit Workbook. The image shows two pie charts.

The image is a screenshot from tab 6 of the Time Audit Workbook. The image shows a pie chart.

Screenshots from tab 6 of the Time Audit Workbook.

Info-Tech Insight

The validity of traditional, rigorous resource planning has long been an illusion because the resource projections were typically not maintained. New realities such as faster project cycles, matrix organizations, and high-autonomy staff cultures have made the illusion impossible to maintain.

If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

Book a workshop with our Info-Tech analysts:

  • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
  • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
  • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

The following are sample activities that will be conducted by Info-Tech analysts with your team:

1.1.2 Assess the current distribution of accountability for resource management practice

Discuss who is currently accountable for various facets of resource management, and whether they have the right authority and ability to deliver on that accountability.

1.2.1 Create realistic estimates of supply and demand using Info-Tech’s Supply-Demand Calculator

Derive actionable, quantitative insight into the resourcing challenges facing the organization by using Info-Tech’s methodology that prioritizes completeness over precision.

Phase 2

Design a Realistic Resource Management Process

Phase 2 Outline

Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

Guided Implementation 2: Draft a Resource Management Process

Proposed Time to Completion (in weeks): 3-6 weeks

Step 2.1: Determine the dimensions of resource management

Start with an analyst kick-off call:

  • Introduce the seven dimensions of resource management
  • Trade-off between granularity and utility of data

Then complete these activities…

  • Decide on the seven dimensions
  • Examine the strategy’s cost-of-use

With these tools & templates:

Resource Management Playbook

Step 2.2: Support your process with a resource management tool

Discuss with the analyst:

  • Inventory of available PPM tools
  • Overview of Portfolio Manager Lite 2017

Then complete these activities…

  • Populate the tool with data
  • Explore portfolio data with the workbook’s output tabs

With these tools & templates:

  • Portfolio Manager Lite
  • PPM Solution Vendor Demo Script
Step 2.3: Build process steps

Discuss with the analyst:

  • Common challenges of resource management practice
  • Recommendations for a pilot initiative

Then complete these activities…

  • Review and customize contents of the Resource Management Playbook

With these tools & templates:

  • Resource Management Playbook

Phase 2 Results & Insights:

Draft the resource management practice with sustainability in mind. It is about what you can and will maintain every week, even during a crisis: it is not about what you put together as a one-time snapshot. Once you stop maintaining resource data, it's nearly impossible to catch up.

Step 2.1: Customize the seven dimensions of resource management

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:
  • Establish a default project vs. non-project work ratio
  • Decide the scope of allocation for your strategy
  • Set your allocation cadence
  • Limit the granularity of time allocation
  • Define the granularity of work assignment
  • Apply a forecast horizon
  • Determine the update frequency
This step involves the following participants:
  • CIO / IT Director
  • PMO Director / Portfolio Manager
  • Functional / Resource Managers
  • Project Managers
Outcomes of this step
  • Seven dimensions of resource management, chosen to fit the current needs and culture of the organization
  • Parameters for creating a resource management process (downstream)

There is no one-size-fits-all resource management strategy

Don’t get boxed into a canned solution that doesn’t make sense for your department’s maturity level and culture.

Resource management strategies are commonly implemented “out-of-the-box,” via a commercial PPM or time-tracking tool, or an external third-party consultant in partnership with those types of tools.

While these solutions and best practices have insights to offer – and provide admirable maturity targets – they often outstrip the near-term abilities of IT teams to successfully implement, adopt, and support them.

Tailor an approach that makes sense for your department and organization. You don’t need complex and granular processes to get usable resourcing data; you just need to make sure that you’ve carved out a process that works in terms of providing data you can use.

  • In this step, we will walk you through Info-Tech’s seven dimensions of resource management to help wireframe your resource management process.
  • In the subsequent steps in this phase, we will develop these dimensions from a wireframe into a functioning process.

Info-Tech Insight

Put processes before tools. Most commercial PPM tools include a resource management function that was designed for hourly granularity. This is part of the fallacy of an old reality that was never real. Determine which goals are realistic and fit your solution to your problem.

Wireframe a strategy that will work for your department using Info-Tech’s seven dimensions of resource management

Action the decision points across Info-Tech’s seven dimensions to ensure your resource management process is guided by realistic data and process goals.

In this step, we will walk you through the decision points in each dimension to determine the departmental specificities of your resource management strategy

Default project vs. non-project ratio

How much time is available for projects once non-project demands are factored in?

Reporting frequency

How often is the allocation data verified, reconciled, and reported for use?

Forecast horizon

How far into the future can you realistically predict resource supply?

Scope of allocation

To whom is time allocated?

Allocation cadence

How long is each allocation period?

Granularity of time allocation

What’s the smallest unit of time to allocate?

Granularity of work assignment

What is time allocated to?

Info-Tech Best Practice

Ensure that both the functional managers and the project managers participate in the following discussions. Without buy-in from both dimensions of the matrix organization, you will have difficulty making meaningful resource management data and process decisions.

Establish your default project versus non-project work ratio

2.1.1
30 minutes

Input

  • Completed Resource Management Supply-Demand Calculator

Output

  • Default organizational P-NP ratio and role-specific P-NP ratios

Materials

  • Resource Management Supply-Demand Calculator
  • Time Audit Workbook
  • Resource Management Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

How much time is available for projects once non-project demands are factored in?

The default project vs. non-project work ratio (P-NP Ratio) is a starting point for functional and project managers to budget the work-hours at their disposal as well as for resources to split their time – if not directed otherwise by their managers.

How to set this dimension. The Resource Management Supply-Demand Calculator from step 1.2 shows the current P-NP ratio for the department, and how the percentages translate into work-hours. The Time Audit Workbook from step 1.2 shows the ratio for specific roles.

For the work of setting this dimension, you can choose to keep the current ratio from step 1.2 as your default, or choose a new ratio based on the advice below.

  • Discuss and decide how the supply-demand gap should be reconciled from the project side vs. the functional side.
    • Use the current organizational priority as a guide, and keep in mind that the default P-NP ratio is to be adjusted over time to respond to changing needs and priorities of the organization.
    • Once the organizational default P-NP ratio is chosen, defining role-specific ratios may be helpful. A help desk employee may spend only 10% of their time on project work, while an analyst may spend 80% of their time on project work.

Decide the scope of allocation for your strategy

2.1.2
15-30 minutes

Input

  • Current practices for assigning work and allocating time
  • Distribution of RM accountability (Activity 1.1.2)

Output

  • Resource management scope of allocation

Materials

  • RM Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

To whom is time allocated?

Scope of allocation is the “who” of the equation. At the lowest and most detailed level, allocations are made to individual resources. At the highest and most abstract level, though, allocations can be made to a department. Other “whos” in scope of allocation can include teams, roles, or skills.

How to set this dimension. Consider how much granularity is required for your overall project capacity visibility, and the process overhead you’re willing to commit to support this visibility. The more low-level and detailed the scope of allocation (e.g. skills or individuals) the more data maintenance required to keep it current.

  • Discuss and decide to whom time will be allocated for the purposes of resource management.
    • Recall your prior discussion from activity 1.1.2 on how accountabilities for resource management are distributed within your organization.
    • The benefit of allocating teams to projects is that it is much easier to avoid overallocation. When a team is overallocated, it is visible. Individual overallocations can go unnoticed.
    • Once you have mastered the art of keeping resource data current and accurate at a higher level (e.g. team), it can be easier move lower level and assign and track allocations in a per-role or per-person basis.

Set your allocation cadence

2.1.3
15-30 minutes

Input

  • Current practices for assigning work and allocating time
  • Scope of allocation (Activity 2.1.2)

Output

  • Determination of temporal frames over which time will be allotted

Materials

  • RM Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

How long is each allocation period?

How long is each individual allocation period? In what “buckets of time” do you plan to spend time – week by week, month by month, or quarter by quarter? The typical allocation cadence is monthly; however, depending on the scope of allocation and the nature of work assigned, this cadence can differ.

How to set this dimension. Allocation cadence can depend on a number of factors. For instance, if you’re allocating time to agile teams, the cadence would most naturally be bi-weekly; if work is assigned via programs, you might allocate time by quarters.

  • Discuss and decide the appropriate allocation cadence for the purposes of resource management. You could even be an environment that currently has different cadences for different teams. If so, it will be helpful to standardize a cadence for the purposes of centralized project portfolio resource management.
    • If the cadence is too short (e.g. days or weeks), it will require a dedicated effort to maintain the data.
    • If the cadence is too long (e.g. quarters or bi-annual), your resource management strategy could fail to produce actionable insight and lack the appropriate agility in being responsive to changes in direction.
    • Ultimately, your allocation cadence may be contingent upon the limitations of your resource management solution (see step 2.2).

Limit the granularity of time allocation

2.1.3
15-30 minutes

Input

  • Requirements for granularity of data
  • Resource management scope of allocation (Activity 2.1.2)

Output

  • Determination of lowest level of granularity for time allocation

Materials

  • RM Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

What’s the smallest unit of time that will be allocated?

Granularity of time allocation refers to the smallest unit of time that can be allocated. You may not need to set firm limits on this, given that it could differ from PM to PM, and resource manager to resource manager. Nevertheless, it can be helpful to articulate an “as-low-as-you’ll-go” limit to help avoid getting too granular too soon in your data aspirations.

How to set this dimension. At a high level, the granularity of allocation could be as high as a week. At its lowest level, it could be an hour. Other options include a full day (e.g. 8 hours), a half day (4 hours), or 2-hour increments.

  • Discuss and decide the appropriate granularity for all allocations in the new resource management practice.
    • As a guideline, granularity of allocation should be one order of magnitude smaller than the allocation cadence to provide enough precision for meaningfully dividing up each allocation cadence, without imposing an unreasonably rigorous expectation for resources to manage their time.
    • The purpose of codifying this dimension is to help provide a guideline for how granular allocations should be. Hourly granularity can be difficult to maintain, so (for instance) by setting a half-day granularity you can help avoid project managers and resource managers getting too granular.

Define the granularity of work assignments

2.1.4
15-30 minutes

Input

  • Requirements for granularity of work assignment
  • Resource management scope of allocation (Activity 2.1.2)

Output

  • Determination of work assignment

Materials

  • RM Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

To what is time allocated?

Determine a realistic granularity for your allocation. This is the “what” of the equation: what your resources are working on or the size of work for which allocations are managed.

How to set this dimension. A high level granularity of work assignment would assign an entire program, a mid-level scope would involve allocating a project or a phase of a project, and a low level, rigorous scope would involve allocating an individual task.

  • Discuss and decide the appropriate granularity for all work assignments in the new resource management strategy.
    • The higher granularity that is assigned, the more difficult it becomes to maintain the data. However, assigning at program level might not lead to useful, practical data.
    • Begin by allocating to projects to help you mature your organization, and once you have mastered data maintenance at this level, you can move on to a more granular work assignment.
      • If you are at a maturity level of 1 or 2, Info-Tech recommends beginning by assigning by project. If you are at a maturity level 3-4, it may be time to start allocating by phase or task.

Apply a forecast horizon

2.1.5
15-30 minutes

Input

  • Current practices for work planning, capacity forecasting
  • Allocation scope, cadence, and granularity (Activities 2.1.2-4)

Output

  • Resource management forecast horizon

Materials

  • RM Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

How far into the future can you realistically predict resource supply?

Determine a realistic forecasting horizon for your allocation. At this point you have decided “what” “who” is working on and how frequently this will be updated. Now it is time to decide how far resource needs will be forecasted, e.g. “what will this person be working on in 3 months?”

How to set this dimension. A high-level forecast horizon would only look forward week-to-week, with little consideration of the long-term future. A mid-level forecast would involve predicting one quarter in advance and a low-level, rigorous scope would involve forecasting one or more years in advance.

  • Discuss and decide the appropriate forecast horizon that will apply to all allocations in the new resource management practice. It’s important that your forecast horizon helps to foster accurate data. If you can’t ensure data accuracy for a set period, make your forecast horizon shorter.
    • If you are at a maturity level of 1 or 2, Info-Tech recommends forecasting one month in advance.
    • If you are already at level 3-4 on the resource management maturity model, Info-Tech recommends forecasting one quarter to one year in advance.

See the diagram below for further explanation

2.1.5 Forecast horizon diagram

Between today and the forecast horizon (“forecast window”), all stakeholders in resource management commit to reasonable accuracy of data. The aim is to create a reliable data set that can be used to determine true resource capacity, as well as the available resource capacity to meet unplanned, urgent demands.

The image shows a Forecast horizon diagram, with Time on the x-axis and Data completeness on the Y-axis. The time between today and the forecast horizon is labelled as the forecast window. there is a line which descends in small degrees until the Forecast Horizon point, where the line is labelled Reasonable level of completeness.

The image shows a chart that lines up with the sections before and after the Forecast Horizon. In the accuracy row, Data is accurate before the forecast horizon and a rough estimate after. In the planning row, before the horizon is reliable for planning, and can inform high-level planning after the horizon. In the free capacity row, before the horizon, it can be committed to urgent demands, and after the horizon, negotiate for capacity.

Info-Tech Insight

Ensure data accuracy. It is important to note that forecasting a year in advance does not necessarily make your organization more mature, unless you can actually rely on these estimates and use them. It is important to only forecast as far in advance as you can accurately predict.

Determine the update frequency

2.1.6
30 minutes

Input

  • Current practices for work planning, capacity reporting
  • Current practices for project intake, prioritization, and approval
  • RM core dimensions (Activities 2.1.1)

Output

  • Resource management update frequency

Materials

  • RM Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

How often is the allocation data verified, reconciled, and reported for use?

How often will you reconcile and rebalance your allocations? Your update frequency will determine this. It is very much the heartbeat of resource management, dictating how often reports on allocations will be updated and published for stakeholders’ consumption.

How to set this dimension. Determine a realistic frequency with which to update project reports. This will be how you determine who is working on what during each measurement period.

  • Discuss and decide how often the supply-demand gap should be reconciled from the project side vs. the functional side.
    • Keep in mind that the more frequent the reporting period, the more time must go into data maintenance. A monthly frequency requires maintenance at the end of the month, while weekly requires it at the end of each week.
    • Also think about how accurately you can maintain the data. Having a quarterly update frequency may require less maintenance time than monthly, but this information may not stay up to date in between these long stretches.
    • Reports generated at each update frequency should both inform resources on what to work on, what not to work on, and how to prioritize tasks if something unexpected comes up, as well as the steering committee, to help inform project approval decisions.

Finalize the dimensions for your provisional resource management process

2.1.7
10 minutes

Input

  • 7 core dimensions of resource management (Activities 2.1.1-6)

Output

  • Provisional resource management strategy

Materials

  • Resource Management Playbook

Participants

  • CIO
  • PMO Director
  • Project Managers
  • Resource Managers

Document the outputs from the preceding seven activities. These determinations will form the foundation of your resource management strategy, which we will go on to define in more detail in the subsequent steps of this phase.

  • Keep in mind, at this stage your dimensions are provisional and subject to change, pending the outcomes of steps 2.2 and 2.3.
RM Core Dimensions Decision
Default P-NP ratio 40%-60$ + exception by roles
Scope of allocation Individual resource
Allocation cadence Monthly
Granularity of time allocation 4 hours
Granularity of work assignment Projects
Forecast horizon 3 months
Reporting frequency Twice a month

Document these dimensions in Section 1.1 of Info-Tech’s Resource Management Playbook. We will be further customizing this template in steps 2.3 and 3.1.

Step 2.2: Determine the resource management tool that will best support your process

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:

  • Consider the pros and cons of commercial tools vs. spreadsheets as a resource management tool
  • Review the PPM Solution Vendor Demo Script to ensure your investment in a commercial tool meets your resource management needs
  • Jump-start spreadsheet-based resource management with Portfolio Manager Lite

This step involves the following participants:

  • PMO Director / Portfolio Manager
  • Functional / Resource Managers
  • Project Managers

Outcomes of this step

  • Choice of tool to support the resource management process
  • Examination of the commercial tool’s ability to support the resource management process chosen
  • Set-up and initial use of Portfolio Manager Lite for a spreadsheet-based resource management solution

Effective resource management practices require an effective resource management tool

The discipline of resource management has largely become inextricable from the tools that help support it. Ensure that you choose the right tool for your environment.

Resource management depends on the flow of information and data from the project level up to functional managers, project managers, and beyond.

Tools are required to help facilitate this flow, and the project portfolio management landscape is littered with endless time-tracking and capacity management options.

These options can each have their merits and their drawbacks. The success of implementing a resource management strategy very much hinges upon weighing these, and then choosing the right solution for your project eco-system.

  • This first part of this step will help you assess the tool landscape and make the right choice to help support your resource management practices.
  • In the second part of this step, we’ll take a deep-dive into Info-Tech’s Excel-based resource management solution. If you are implementing our solution, these sections will help you understand and set up the tool.

Info-Tech Insight

Establish a book of record. While it is possible to succeed using ad hoc tools and data sources, a centralized repository for capacity data works best. Your tool choice should help establish a capacity book of record to help ensure ongoing reconciliation of supply and demand at the portfolio level.

Get to know your resource management tool options

At a high level, those looking for a resource management solution have two broad options: a commercial project portfolio management (PPM) or time-tracking software on the one hand, and a spreadsheet-based tool, like Google Sheets or Excel, on the other.

Obviously, if your team or department already has access to a PPM or time-tracking software, it makes sense to continue using this, as long as it will accommodate the process that was wireframed in the previous step.

Otherwise, pursue the tool option that makes the most sense given both the strategy that you’ve wireframed and other organizational factors. See the table below and the next section for guidance.

If you’re planning on doing resource allocation by hand, you’re not going to get very far.”

Rachel Burger

Commercial Solutions Spreadsheet-Based Solutions
Description
  • These highly powerful solutions are purchased from a software/service provider.
  • These can be as simple as a list of current projects on a spreadsheet or a more advanced solution with resource capacity analysis.
Pros
  • Extraordinary function
  • Potential for automated roll-ups
  • Collaboration functionality
  • Easy to deploy: high process maturity or organization-wide adoption not required.
  • Lower cost-in-use – in many cases, they are free.
  • Highly customizable.
Cons
  • High process maturity required
  • High cost-in-use
  • Generally expensive to customize
  • Comprehensive, continual, and organization-wide adoption required
  • Easy to break.
  • Typically, they require a centralized deployment with a single administrator responsible for data entry.

Option A: When pursuing commercial options, don’t bite off more functionality than your people can sustain

While commercial options offer the most robust functionality for automation, collaboration, and reporting, they are also costly, difficult to implement, and onerous to sustain over the long run.

It’s not uncommon for organizations to sink vast amounts of money into commercial PPM tools, year after year, and never actually get any usable resource or forecasting data from these tools.

The reasons for this can vary, but in many cases it is because organizations mistake a tool for a PPM or a resource management strategy.

A tool is no substitute for having a clearly defined process that staff can support. Be aware of these two factors before investing in a commercial tool:

  • Visibility cannot be automated. It is not uncommon for CIOs to believe that because they’ve invested in a tool, they have an automated portfolio that enables them to sit back and wait for the data to roll in. With many tools, the challenge is that the calculations driving the rollups have become increasingly unsustainable and irrelevant in our high-autonomy staff cultures and interruption-driven work days.
  • Information does not equal knowledge. While commercial tools have robust reporting features, the data outputs can lead to information overload – and, subsequently, disinterest – unless they are curated and filtered to suit your executive’s needs and expectations.

47%
Of those companies using automated software to assist in resource management, almost half report that those systems failed to accurately calculate resource forecasts.

PM Solutions

Info-Tech Insight

Put process sustainability before enhanced tool functionality.

Ensure that you have sustainable processes in place before investing in an expensive commercial tool. Your tool selection should help facilitate capability-matched processes and serve user adoption.

Trying to establish processes around a tool with a functionality that exceeds your process maturity is a recipe for failure.

Before jumping into a commercial tool, consider some basic parameters for your selection

Use the table below as a starting point to help ensure you are pursuing a resource management tool that is right for your organization’s size and process maturity level.

Tool Category Characteristics # of Users PPM Maturity Sample Vendors
Enterprise tools
  • Higher professional services requirements for enterprise deployment
  • Larger reference customers
1,000> High
  • MS Project Server
  • Oracle Primavera
  • Planisware
Mid-market tools
  • Lower expectation of professional services engaged in initial deployment contract
  • Fewer globally recognizable reference clients
  • Faster deployments
100> Intermediate-to-High
  • Workfront
  • Project Insight
  • Innotas
Entry-level tools
  • Lower cost than mid-market and enterprise PPM tools
  • Limited configurability, reporting, and resource management functionalities
  • Compelling solutions to the organizations that want to get a fast start to a trial deployment
<100 Low-to-Intermediate
  • 5PM
  • AceProject
  • Liquid Planner

For a more in-depth treatment of choosing and implementing a commercial PPM tool to assist with your resource management practice, see Info-Tech’s blueprint, Select and Implement a PPM Solution.

Use Info-Tech’s PPM Solution Vendor Demo Script to help ensure you get the functionality you need

PPM Solution Vendor Demo Script (optional)

To ensure your investment in a commercial tool meets your resource management needs, use Info-Tech’s PPM Solution Vendor Demo Script to structure your tool demos and interactions with vendors.

For instance, some important scenarios to consider when looking at potential tools include:

  • How are overallocation and underallocation situations identified and reconciled in the solution?
  • How are users motivated to maintain their own timesheets (beyond simply being mandated as part of their job); how does the solution and timesheet functionality help team members do their job?
  • How will portfolio-level reports remain useful and accurate despite “zero-adoption” scenarios, in which some or all teams do not actively maintain task and timesheet data?

Any deficiencies in answering these types of questions should alert you to the fact that a potential solution may not adequately meet the needs of your resource management strategy.

Download Info-Tech’s PPM Solution Vendor Demo Script

"[H]ow (are PPM solutions) performing in a matrix organization? Well, there are gaps. There will be employees who do not submit timesheets, who share their time between project and operational activities, and whose reporting relationships do not fit neatly into the PPM database structure. This creates exceptions in the PPM application, and you may just have the perfect solution to a small subset of your problems." – Vilmos Rajda

Option B: When managing resourcing via spreadsheets, you don’t have to feel like you’re settling for the lesser option

Spreadsheets can provide a viable alternative for organizations not ready to invest in an expensive tool or for those not getting what they need from their commercial selections.

When it comes to resource management at a portfolio level, spreadsheets can be just as effective as commercial tools for facilitating the flow of accurate and maintainable resourcing data and for communicating resource usage and availability.

Some of the benefits of spreadsheets over commercials tools include:

  • They are easy to set up and deploy. High process maturity or organization-wide user adoption are not required.
  • They have a low cost-in-use. In the case of Excel, the tool itself comes at no additional cost.
  • They are highly customizable. No development time/costs are required to tweak the solution to suit your needs.

To be clear: spreadsheets have their drawbacks (for instance, they are easy to break, require a centralized data administrator, and are yours and yours alone to maintain). If your department has the budget and the process maturity to support a commercial tool, you should pursue the options covered in the previous sections.

However, if you are looking for a viable alternative to an expensive tool, spreadsheets have the ability to support a rigorous resource management practice.

"Because we already have enterprise licensing for an expensive commercial tool, everyone else thinks it’s logical to start there. I think we’re going to start with something quick and dirty like Excel." – EPMO Director, Law Enforcement Services

Info-Tech Insight

Make the choice to ensure adoption.

When making your selection, the most important consideration across all the solution categories is data maintenance. You must be assured that you and your team can maintain the data.

As soon as your portfolio data becomes inconsistent and unreliable, decision makers will lose trust in your resource data, and the authority of your resource management strategy will become very tenuous.

While spreadsheets offer a viable resource management option, not all spreadsheets are created equal

Lean on Info-Tech’s experience and expertise to get up and running quickly with a superior resource management Excel-based tool: Portfolio Manager Lite 2017.

Spreadsheets are the most common PPM tool – and it’s not hard to understand why: they can be created with minimal cost and effort.

But when something is easy to do, it’s important to keep in mind that it’s also easy to do badly. As James Kwak says in his article, “The Importance of Excel,” “The biggest problem is that anyone can create Excel Spreadsheets—badly.”

  • Info-Tech’s Portfolio Manager Lite 2017 offers an antidote to the deficiencies that can haunt home-grown resource management tools.
  • As an easy-to-deploy, highly evolved spreadsheet-based option, Portfolio Manager Lite enables you to mature your resource management processes, and provide effective resource visibility without the costly upfront investment.

Download Info-Tech’s Portfolio Manager Lite 2017

Info-Tech Insight

Balance functionality and adoption. Clients often find it difficult to gain adoption with commercial tools. Though homegrown solutions may have less functionality, the higher adoption level can make up for this and also potentially save your organization thousands a year in licensing fees.

Determine your resource management solution and revisit your seven dimensions of resource management

2.2.1
Times will vary

Participants

  • PMO Director

Based on input from the previous slides, determine the resource management solution option you will pursue and implement to help support your resource management strategy. Record this selection in section 1.2 of the Resource Management Playbook.

  • You may need to revisit the decisions made in step 2.1 to consider if the default values for your seven core dimensions of resource management are still sound. Keep these current and relevant as you become more familiar with your resource management solution.
RM Core Dimensions Default Value
Default P-NP ratio Role-specific
Scope of allocation Individual resource
Allocation cadence Monthly
Granularity of allocation (not defined)
Granularity of work assignment Project
Forecast horizon 6 months
Reporting frequency (not defined)

Portfolio Manager Lite has comprehensive sample data to help you understand its functions.

As you can see in this table, the tool itself assumes five of the seven resource management core dimensions. You will need to determine departmental values for granularity of allocation and reporting frequency. The other dimensions are determined by the tool.

If you’re piloting Info-Tech’s Portfolio Manager Lite, review the subsequent slides in this step before proceeding to step 2.3. If you are not piloting Portfolio Manager Lite, proceed directly to step 2.3.

Overview of Portfolio Manager Lite

Portfolio Manager Lite has two set-up tabs, three data entry tabs, and six output-only tabs. The next 15 slides show how to use them. To use this tool, you need Excel 2013 or 2016. If you’re using Excel 2013, you must download and install Microsoft Power Query version 2.64 or later, available for download from Microsoft.

The image shows an overview of the Portfolio Manager Lite tool. It shows the Input and Data Tabs on the left, and output tabs on the right. The middle of the graphic includes guidance to ensure that you refresh the outputs after each data entry, by using the Refresh All button

Observe “table manners” to maintain table integrity and prevent Portfolio Manager Lite malfunctions

Excel tables enable you to manage and analyze a group of related data. Since Portfolio Manager Lite uses tables extensively, maintaining the table’s integrity is critical. Here are some things to know for working with Excel tables.

Do not leave empty rows at the end.

Adjust the sizing handle to eliminate empty rows.

Always paste values.

Default pasting behavior can interrupt formula references and introduce unwanted external links. Always right-click and select Paste Values.

Correctly add/remove rows within a table.

Do not use row headings; instead, always right-click inside a table to manipulate table rows.

Set up Portfolio Manager Lite

2.2.1
Portfolio Manager Lite, Tab 2a: Org Setup

The Org Setup tab is divided into two sections, Resources and Projects. Each section contains several categories to group your resources and projects. Items listed under each category will be available via drop-down lists in the data tabs.

These categorizations will be used later to “slice” your resource allocation data. For example, you’ll be able to visualize the resource allocations for each team, for each division, or for each role.

The image shows a screenshot of Tab 2a, with sample information filled in.

1. Role and Default Non-Project Ratio columns: From the Supply-Demand Calculator, copy the list of roles, and how much of each role’s time is spent on non-projects by default (see below; add the values marked with yellow arrows).

2. Resource Type column: List the type of resource you have available.

3. Team and Skill columns: List the teams, and skills for your resources.

In the Resources tab, items in drop-down lists will appear in the same order as shown here. Sort them to make things easy to find.

Do not delete tables you won’t use. Instead, leave or hide tables.

Set up Portfolio Manager Lite (continued)

2.2.1
Portfolio Manager Lite, Tab 2a: Org Setup

The projects section of the Org Setup tab contains several categories for entering project data. Items listed under each category will be available via drop-down lists in the Projects tab. These categorizations will be used later to analyze how your resources are allocated.

The image shows the projects sections of Tab 2a.

1. Project Type: Enter the names of project types, in which projects will be grouped. All projects must belong to a type. Examples of types may include sub-portfolios or programs.

2. Project Category: Enter the names of project categories, in which projects will be grouped. Unlike types, category is an optional grouping.

3. Phase: Enter the project phases. Ensure that your phases list has “In Progress” and “Complete” options. They are needed for the portfolio-wide Gantt chart (the Gantt tab).

4. Priority and Status: Define the choices for project priorities and statuses if necessary (optional).

5. Unused: An extra column with predefined choices is left for customization (optional).

Set up Portfolio Manager Lite (continued)

2.2.1
Portfolio Manager Lite, Tab 2b: Calendar Setup

Portfolio Manager Lite is set up for a monthly allocation cadence out of the box. Use this tab to set up the start date, the default resource potential capacity, and the months to include in your reports.

The image shows fields in the calendar set-up section of Tab 2a, with a Start Date and Hours Assumed per day.

1. Enter a start date for the calendar, e.g. start of your fiscal or calendar year.

2. Enter how many hours are assumed in a working day. It is used to calculate the default maximum available hours in a month.

The image shows the Calendar section of tab 2a, with sample information filled in.

Maximum Available Hours, Weekdays, and Business Days are automatically generated.

The current month is highlighted in green.

3. Enter the number of holidays to correct the number of business days for each month.

Year to Date Reporting and Forecast Reporting ranges are controlled by this table. Use the period above Maximum Available Hours.

The image shows the Year-to-Date and Forecast Reporting sections.

Info-Tech Best Practice

Both Portfolio Manager Lite and Portfolio Manager 2017 can be customized for non-monthly resource allocation. Speak to an Info-Tech analyst to ask for more information.

Enter resource information and their total capacity

2.2.2
Portfolio Manager Lite, Tab 3: Resources

Portfolio Manager Lite is set up for allocating time to individual resources out of the box. Information on these resources is entered in the Resources tab. It has four sections, arranged horizontally.

1. Enter basic information on your resources. Resource type, team, role, and skill will be used to help you analyze your resource data.

The image shows a screenshot of the Resources tab with sample information filled in.

Ensure that the resource names are unique.

Sort or filter the table using the filter button in the header row.

2. Their total capacity in work-hours is automatically calculated for each month, using the default numbers from the Calendar Setup tab. If necessary, overwrite the formula and enter in custom values.

The image shows a screenshot of the total capacity in work-hours, with sample info filled in.

Cells with less than 120 hours are highlighted in blue.

Do not add or delete any columns, or modify this header row.

Enter out-of-office time and non-project time for your resources

2.2.2
Portfolio Manager Lite, Tab 3: Resources

3. Enter the resources’ out-of-office time for each month, as they are reported.

The image shows the Absence (hours) section, with sample information filled in.

Do not add or delete any columns, or modify the header row, below the dates.

4. Resources’ percentages of time spent on non-projects are automatically calculated, based on their roles’ default P-NP ratios. If necessary, overwrite the formula and enter in custom values.

The image shows the Non-Project Ratio section, with sample information filled in.

Do not add or delete any columns, or modify the header row, below the dates.

Populate your project records

2.2.3
Portfolio Manager Lite, Tab 4: Projects

Portfolio Manager Lite is set up for allocating time to projects out of the box. Information on these projects is entered in the Projects tab.

1. Enter project names and some basic information. These fields are mandatory.

The image shows the section for filling in project names and basic information in the Projects tab. The image shows the table with sample information.

Ensure that the project names are unique.

Do not modify or change the headers of the first seven columns. Do not add to or delete these columns.

2. Continue entering more information about projects. These fields are optional and can be customized.

The image shows a section of the Projects tab, where you fill in more information.

Headers of these columns can be changed. Extra columns can be added to the right of the Status column if desired. However, Info-Tech strongly recommends that you speak to an Info-Tech analyst before customizing.

The Project Category, Phase, and Priority fields are entered using drop-down lists from the Org Setup tab.

Allocate your resource project capacity to projects

2.2.4
Portfolio Manager Lite, Tab 5: Allocations

Project capacity for each resource is calculated as follows, using the data from the Resources tab:

Project capacity = (total project capacity – absence) x (100% – non-project%)

In the Allocations tab, project capacity is allocated in percentages with 100% representing the allocation of all available project time of a resource to a project.

This allocation-by-percentage model has some advantages and drawbacks:

Advantages

  • Allocating all available project capacity to project is straightforward
  • Easy for project managers to coordinate with each other (e.g. “Jon’s project time will be split 50%-50% between two projects” = enter 50% allocation to each project)

Drawbacks

  • How many hours is represented by a percentage of someone’s capacity is unclear
  • Must check whether enough work-hours are allocated for what’s needed (e.g. “Deliverable A needs 20 hours of work from Jon in November. Is 50% of his project capacity enough?”)

The Allocations tab has a few features to help you mitigate these disadvantages.

Info-Tech Best Practice

For organizations with lower resource management practice maturity, start with percentages. In Portfolio Manager 2017, allocations are entered in work-hours to avoid the above drawbacks altogether, but this may require a higher practice maturity.

Enter your resource project capacity allocations

2.2.4
Portfolio Manager Lite, Tab 5: Allocations

A line item in the Allocations tab requires three pieces of information: a project, a resource, and the percentage of project capacity for each month.

The image shows a screenshot from the Allocations tab, with sample information filled in.

1. Choose a project. Type, Start date, and End date are automatically displayed.

2. Choose a resource. Team is automatically displayed.

This image is another screenshot of the Allocations tab, showing the section with dates, with sample information filled in.

3. Enter the resource’s allocated hours for the project in percentages.

Built-in functions in the Allocations tab display helpful information for balancing project supply and demand

2.2.4
Portfolio Manager Lite, Tab 5: Allocations

The Allocations tab helps you preview the available project capacity of a resource, as well as the work-hours represented by each allocation line item, to mitigate the drawbacks of percentage allocations.

In addition, overallocations (allocations for a given month add up to over 100%) are highlighted in red. These functions help resource managers balance the project supply and demand.

The image shows a screenshot of the Allocations tab, with sample information filled in.

To preview a resource’s project capacity in work-hours, choose a resource using a drop down. The resource’s available project capacity for each month is displayed to the right.

Sort or filter the table using the filter button in the header row. Here, the Time table is sorted by Resource.

The total work-hours for each line item is shown in the Hours column. Here, 25% of Bethel’s project capacity for 4 months adds up to only 16 work-hours for this project.

A resource is overallocated when project capacity allocations add up to more than 100% for a given month. Overallocations are highlighted in red.

Get the timeline of your project portfolio with the Gantt chart tab

2.2.5
Portfolio Manager Lite, Tab 6: Gantt

The Gantt tab is a pivot-table-driven chart that graphically represents the start and end dates of projects and their project statuses.

The image shows a screenshot of the Gantt tab, with sample information filled in.

Filter entries by project type above the chart.

The current month (9-17) is highlighted.

You can filter and sort entries by project name, sponsor, or project manager.

In progress (under Phase column) projects show the color of their overall status.

Projects that are neither completed nor in progress are shown in grey.

Completed (under Phase column) projects are displayed as black.

Get a bird’s-eye view of your available project capacity with the Resource Load tab

2.2.6
Portfolio Manager Lite, Tab 7: Resource Load

The Resource Load tab is a PivotTable showing the available project capacity for each resource.

The image is a screenshot of the Resource Load tab, with sample information filled in.

Change the thresholds for indicating project overallocation at the top right.

You can filter and sort entries by resource or role.

Values in yellow and red highlight overallocation.

Values in green indicate resource availability.

This table provides a bird’s-eye view of all available project capacity. Highlights for overallocated resources yield a simple heat map that indicates resourcing conflicts that need attention.

The next two tabs contain graphical dashboards of available capacity.

Tip: Add more resource information by dragging a column name into the Rows box in the PivotTable field view pane.

Example: add the Team column by dragging it into the Rows box

The image shows a screenshot demonstrating that you can add a Team column.

Analyze your resource allocation landscape with the Capacity Slicer tab

2.2.7
Portfolio Manager Lite, Tab 8: Capacity Slicer

The Capacity Slicer tab is a set of pivot charts showing the distribution of resource allocation and how they compare against the potential capacity.

The image shows a collection of 5 graphs and charts, showing the distribution of resource allocation, and compared against potential capacity.

At the top left of each chart, you can turn Forecast Reporting on (true) or off (false). For Year to Date reporting, replace Forecast with YTD in the Field View pane’s Filter field.

In the Allocated Capacity, in % chart, capacity is shown as a % of total available capacity. Exceeding 100% indicates overallocation.

In the Realized Project Capacity, in hours chart, the vertical axis is in work-hours. This gap between allocation and capacity represents available project capacity.

The bottom plots show how allocated project capacity is distributed. If the boxes are empty, no allocation data is available.

Use the Team slicer to drill down on resource capacity and allocation by groups of resources

2.2.7
Portfolio Manager Lite, Tab 8: Capacity Slicer

A slicer filters the data shown in a PivotTable, a PivotChart, or other slicers. In this tab, the team slicer enables you to view resource capacity and allocation by each team or for multiple teams.

The image shows a sample graph.

The button next to the Team header enables multiple selection.

The next button to the right clears the filter set by this slicer.

All teams with capacity or allocation data are listed in the slicers.

For example, if you select "App Dev":

The image shows the same graph as previously shown, but this time with only App Dev selected in the left-hand column.

The vertical axis scales automatically for filtered data.

The capacity and allocation data for all application division teams is shown.

Resources not in the App Dev team are filtered out.

Drill down on individual-level resource allocation and demand with the Capacity Locator tab

2.2.8
Portfolio Manager Lite, Tab 9: Capacity Locator

The Capacity Locator tab is a group of PivotCharts with multiple slicers to view available project capacity.

For example: click on “Developer” under Role:

The image shows the list of slicers available using the Capacity Locator tab.

The image shows a series of graphs produced in the Capacity Locator tab.

Primary skills of all developers are displayed on the left in the Primary Skill column. You can choose a skill to narrow down the list of resources from all developers to all developers with that skill.

The selected resources are shown in the Resources column. Data on the right pertains to these resources.

  • The top left graph shows the average available project capacity for all selected resources.
  • The top right graph shows the sum of all available capacity from all selected resources.
  • In the lower left graph, pay attention to available total capacity, as selected resources may have significant non-project demands.
  • The lower right graph shows the number of assigned projects. Control the number of concurrent projects to reduce the need for multitasking and optimize your resource use.

Where you see the filter button with an x, you can clear the filter imposed by this slicer.

Check how your projects are resourced with the Project Viewer tab

2.2.9
Portfolio Manager Lite
, Tab 10: Project Viewer

The Project Viewer tab is a set of PivotCharts with multiple slicers to view how resources are allocated to different projects.

The image shows a screenshot of the Project Viewer tab, with a bar graph at the top, filter selections at the bottom left, and four pie charts at the bottom right.

Filtering by sponsor or project manager is useful for examining a group of projects by accountability (sponsor) or responsibility (project manager).

The graphs show how project budgets are distributed across different categories and priorities of projects, and how resource allocations are distributed across different categories and priorities of projects.

Report on your project portfolio status with the Project Updates tab

2.2.10
Portfolio Manager Lite
, Tab 11: Project Updates

The Project Updates tab is a PivotTable showing various fields from the Projects table to rapidly generate a portfolio-wide status report. You can add or remove fields from the Projects table using the PivotTable’s Field View pane.

The image shows a screenshot of a large table, which is the Project Updates tab. A selection is open, showing how you can filter entries.

Filter entries by phase. The screenshot shows an expansion of this drop down at the top left.

Rearrange the columns by first clicking just below the header to select all cells in the column, and then dragging it to the desired position. Alternatively, arrange them in the Field View pane.

Tools and other requirements needed to complete the resource management strategy

2.2.11
10 minutes

  • Recommended: If you are below a level 4 on Info-Tech’s resource management maturity scale, use Info-Tech’s Portfolio Manager Lite to start.
  • Use a commercial PPM tool if you already have one in use and feel that you can accurately maintain the data in this tool.
  • Use this chart to estimate the amount of time it will take to accurately maintain the data for each reporting period.
    • Determine who will be responsible for this maintenance.
    • If there is no one currently available to maintain the data, allocate time for someone or you may even need a portfolio analyst.
    • We will confirm roles and responsibilities in phase 3.
Maturity Level Dimensions Time needed per month
Small (1-25 employees) Medium (25-75) Large (75-100) Enterprise (100+)
1-2 %, team, project, monthly update, 1 month forecast 2 hours 6 hours 20 hours 50 hours
3-4 %, person, phase, weekly update, 1 quarter forecast 4 hours 12 hours 50 hours 150 hours
5 %, person, task, continuous update, 1 year forecast 8+ hours 20+ hours 100+ hours 400+ hours

See also: Grow Your Own PPM Solution with Info-Tech’s Portfolio Manager 2017

Join hundreds of Info-Tech clients who are successfully growing their own PPM solution.

If you are looking for a more robust resource management solution, or prefer to allocate staff time in hours rather than percentages, see Info-Tech’s Portfolio Manager 2017.

Similar to Portfolio Manager Lite, Portfolio Manager 2017 is a Microsoft Excel-based PPM solution that provides project visibility, forecasting, historical insight, and portfolio analytics capabilities for your PMO without a large upfront investment for a commercial solution.

Watch Info-Tech’s Portfolio Manager 2017 Video – Introduction and Demonstration.

System Requirements

To use all functions of Portfolio Manager 2017, you need Excel 2013 or Excel 2016 running on Windows, with the following add-ins:

  • Power Query (Excel 2013 only)
  • Power Pivot
  • Power View

Power View is only available on select editions of Excel 2013 and 2016, but you can still use Portfolio Manager 2017 without Power View.

If you are unsure, speak to your IT help desk or an Info-Tech analyst for help.

For a new PMO, start with the new reality

CASE STUDY

Industry Law Enforcement

Source Info-Tech Client

Because we already have enterprise licensing for an expensive commercial tool, everyone else thinks it’s logical to start there. I think we’re going to start with something quick and dirty like Excel.” – EPMO Director, Law Enforcement Services

Situation

  • This was an enterprise PMO, but with relatively low organizational maturity.
  • The IT department had relatively high project management maturity, but the enterprise was under-evolved at the portfolio level.
  • Other areas of the organization already had licensing and deployment of a top-tier commercial PPM tool.
  • There were no examples of a resource management practice.

Complication

  • There was executive visibility on larger and more strategic projects.
  • There were no constraints on the use of resources for smaller projects.
  • The PMO was generally expected to provide project governance with their limited resources.
  • The organization lacked an understanding of the difference between project and portfolio management. Consequently, it was difficult to create resource management practices at the portfolio level due to a lack of resourcing.

Resolution

  • The organization deferred the implementation of the commercial PPM tool.
  • They added high-level resource management using spreadsheets.
  • Executive focus was reoriented around overall resource capacity as the principle constraint for project approvals.
  • They introduced deeper levels of planning granularity over time.
  • When the planning granularity gets down to the task level, they move toward the commercial solution.

Step 2.3: Build process steps to ensure data accuracy and sustainability

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:
  • Draft a high-level resource management workflow
  • Build on the workflow to determine how data will be collected at each step, and who will support the process
  • Document your provisional resource management process
This step involves the following participants:
  • PMO Director / Portfolio Manager
  • Functional / Resource Managers
  • Project Managers
Outcomes of this step
  • A high-level resource management workflow, customized from Info-Tech’s sample workflow
  • Process for collecting resource supply data for each reporting period
  • Process for capturing the project demand within each reporting period
  • Process for identifying and documenting resource constraints and issues for each reporting period
  • Standard protocol for resolving resource issues within each reporting period
  • Process for finalizing and communicating resource allocations for the forecast window
  • A customized Resource Management Playbook, documenting the standard operating procedure for the processes

Make sustainability the goal of your resource management practices

A resource management process is doing more harm than good if it doesn’t facilitate the flow of accurate and usable data week after week, month after month, year after year.

When resource management strategies fail, it can typically be tied back to the same culprit: unrealistic expectations from the outset.

If a resource management process strives for a level of data precision that staff cannot juggle day to day, over the long run, then things will eventually fall apart as staff and decision makers alike lose faith in the data and the relevancy of the process.

Two things can be done to help avoid this fate:

  1. Strive for accuracy over precision. If your department’s process maturity is low, and staff are ping-ponged from task to task, fire to fire, throughout any given day, then striving for precise data is ill advised. Keep your granularity of allocation more high level, and strive for data that is “maintainably” accurate rather than “unmaintainably” precise.
  2. Keep the process simple. Use the advice in this step to develop a sustainable process, one that is easy to follow with clearly defined responsibilities and accountabilities at each step.

Info-Tech Insight

It's not about what you put together as a one-time snapshot. It's about what you can and will maintain every week, even during a crisis. When you stop maintaining resource management data, it’s nearly impossible to catch up and you’re usually forced to start fresh.

Maintain reliable resourcing data with an easy-to-follow, repeatable process

Info-Tech recommends following a simple five-step process for resource management.

1. Collect resource supply data

  • Resources
  • Resource Managers

2. Collect project demand data

  • Resource Managers
  • Project Managers
  • PMO

3. Identify sources of supply/demand imbalance

  • PMO

4. Resolve conflicts and balance project and non-project allocations

  • Resource Managers
  • Project Managers
  • PMO
  • Steering Committee, CIO, other executives

5. Approve allocations for forecast window

  • PMO
  • Steering Committee, CIO, other executives

This is a sample workflow with sample roles and responsibilities. This step will help you customize the appropriate steps for your department.

Info-Tech Insight

This process aims to control the resource supply to meet the demand – project and non-project alike. Coordinate this process with other portfolio management processes, ensuring that up-to-date resource data is available for project approval, portfolio reporting, closure, etc.

Draft your own high-level resource management workflow

2.3.1
60 to 90 minutes

Participants

  • Portfolio Manager
  • Project Managers
  • Resource Managers
  • Business Analysts

Input

  • Process data requirements

Output

  • High-level description of your target-state process

Materials

  • Whiteboard or recipe cards

Conduct a table-top planning exercise to map out, at a high-level, your required and desired process steps.

While Info-Tech recommends a simple five-step process (see previous slide), you may need to flesh out your process into additional steps, depending upon the granularity of your seven dimensions and the complexity of your resource management tool. A table-top planning exercise can be helpful to ensure the right process steps are covered.

  1. On a whiteboard or using white 4x6 recipe cards, write the unique steps of a resource management process. Use the process example at the bottom of this slide as a guide.
  2. Use a green marker or green cards to write artifacts or deliverables that result from each step.
  3. Use a red marker or red cards to address potential issues, problems, or risks that you can foresee at each step.

For the purposes of this activity, avoid getting into too much detail by keeping to your focus on the high-level data points that will be required to keep supply and demand balanced on an ongoing basis.

"[I]t’s important not to get too granular with your time tracking. While it might be great to get lots of insight into how your team is performing, being too detailed can eat into your team’s productive work time. A good rule of thumb to work by is if your employees’ timesheets include time spent time tracking, then you’ve gone too granular."

Nicolas Jacobeus

Use Info-Tech’s Resource Management Playbook to help evolve your high-level steps into a repeatable practice

Once you’ve determined a high-level workflow, you’ll need to flesh out the organizational details for how data will be collected at each step and who will support the process.

Use Info-Tech’s Resource Management Playbook to help determine and communicate the “who, what, when, where, why, and how” of each of your high-level process steps.

The playbook template is intended to function as your resource management standard operating procedure. Customize Section 3 of the template to record the specific organizational details of how data will be collected at each process step, and the actions and decisions the data collection process will necessitate.

  • Activities 2.3.2-2.3.6 in this step will help you customize the process steps in Info-Tech’s five-step resource management model and record these in the template. If you developed a customized process in activity 2.3.1, you will need to add to/take away from the activity slides and customize the template accordingly.
  • Lean on the seven dimensions of resource management that you developed in step 2.1 to determine the cadence and frequency of data collection. For instance, if your update frequency is monthly, you will need to ensure you collect your supply-demand data prior to that, giving yourself enough time to analyze it and reconcile imbalances with stakeholders before refreshing your monthly reporting data.

Download Info-Tech’s Resource Management Playbook

How the next five activities will help you develop your playbook

2.3 Resource Management Playbook

Each of the slides for activities 2.3.2-2.3.6 are comprised of a task-at-a glance box as well as “important decisions to document” for each step.

Work as a group to complete the task-at-a-glance boxes for each step. Use the “important decisions to document” notes to help brainstorm the “how” for each step. These details should be recorded below the task-at-a-glance boxes in the playbook – see point 6 in the legend below.

Screenshot of Section 3 of the RM Playbook.

The image shows a screenshot of Section 3 of the RM Playbook. A legend is included below.

Screenshot Legend:

  1. Review your existing steps, tools, and templates used for this task. Alternatively, review the example provided in the RM Playbook.
  2. Designate the responsible party/parties for this process. Who carries out the task?
  3. Document the inputs and outputs for the task: artifacts, consulted and informed parties.
  4. If applicable, document the tools and templates used for the task.
  5. Designate the accountable party for this task. Only a single party can be accountable.
  6. Describe the “how” of the task below the Task-at-a-Glance table.

Step one: determine the logistics for collecting resource supply data for each reporting period

2.3.2
20 minutes

Step one in your resource management process should be ensuring a perpetually current view into your resource supply.

Resource supply in this context should be understood as the time, per your scope of allocation (i.e. individual, team, skill, etc.) that is leftover or available once non-project demands have been taken out of the equation. In short, the goal of this process step is to determine the non-project demands for the forecast period.

The important decisions to document for this step include:

  1. What data will be collected and from whom? For example, functional managers to update resource potential capacity and non-project resource allocations.
  2. How often will data be collected and when? For example, data will be collected third Monday of the month, three days before our monthly update frequency.
  3. How will the data be collected? For example, tool admin to send out data to update on third Monday; resource managers update the data and email back to tool admin.

Document your process for determining resource supply in Section 3.1 of Info-Tech’s Resource Management Playbook.

Task-at-a-glance:

Inputs Artifacts i.e. historical usage data
Consulted i.e. project resources
Tools & Templates i.e. time tracking template
Outputs Artifacts i.e. updated template
Informed i.e. portfolio analyst
Timing i.e. every second Monday
Responsible i.e. functional managers
Accountable i.e. IT directors

Step two: map out how project demand will be captured within each reporting period

2.3.3
20 minutes

Step two in your resource management process will be to determine the full extent of project demand for your forecast period.

Project demand in this context can entail both in-flight projects as well as new project plans or new project requests that are proposing to consume capacity during the forecast period. In short, the goal of this process step is to determine all of the project demands for the forecast period.

The important decisions to document for this step include:

  1. What data will be collected and from whom? For example, project managers to update project allocations for in-flight projects, and PMO will provide proposed allocations for new project requests.
  2. How often will data be collected and when? For example, data will be collected third Tuesday of the month, two days before our monthly update frequency.
  3. How will the data be collected? For example, tool admin to send out data to update on third Tuesday; project managers update the data and email back to tool admin.

Document your process for determining project demand in Section 3.2 of Info-Tech’s Resource Management Playbook.

Task-at-a-glance

Inputs Artifacts i.e. historical usage data
Consulted i.e. project resources
Tools & Templates i.e. project demand template
Outputs Artifacts i.e. updated demand table
Informed i.e. portfolio analyst
Timing i.e. every second Monday
Responsible i.e. project managers
Accountable i.e. PMO director

Step three: record how resource constraints and issues for each reporting period will be identified and documented

2.3.4
20 minutes

Step three in your resource management process will be to analyze your resource supply and project demand data to identify points of conflict.

Once the supply-demand data has been compiled, it will need to be analyzed for points of imbalance and conflict. The goal of this process step is to analyze the raw data and to make it consumable by other stakeholders in preparation for a reconciliation or rebalancing process.

The important decisions to document for this step include:

  1. How will the data be checked for inaccuracies? For example, tool admin to enter and QA data; reach out by the following Wednesday at noon with inconsistencies; managers to respond no later than next day by noon.
  2. What reports will employed? For example, a refreshed demand spreadsheet will be made available.
  3. What is an acceptable range for over- and under-allocations? For example, the acceptable tolerance for allocation is 15%; that is, report only those resources that are less than 85% allocated, or more than 115% allocated.

Document your process for identifying resource constraints and issues in Section 3.3 of Info-Tech’s Resource Management Playbook.

Task-at-a-glance

Inputs Artifacts i.e. supply/demand data
Consulted i.e. no one
Tools & Templates i.e. Portfolio Manager Lite
Outputs Artifacts i.e. list of issues
Informed i.e. no one
Timing i.e. every second Tuesday
Responsible i.e. portfolio analyst
Accountable i.e. PMO director

Step four: establish a standard protocol for resolving resource issues within each reporting period

2.3.5
20 minutes

Step four in your resource management process should be to finalize your capacity management book of record for the reporting period and prepare recommendations for resolving conflicts and issues.

The reconciliation process will likely take place at a meeting amongst the management of the PMO and representatives from the various functional groups within the department. The goal of this step is to get the right roles and individuals to agree upon proposed reconciliations and to sign-off on resource allocations.

The important decisions to document for this step include:

  1. What reports will be distributed and in what form? For example, refreshed spreadsheet will be available on the PMO SharePoint site.
  2. When will the reports be generated and for whom? For example, fourth Tuesday of the month, end of day – accessible for all managers.
  3. Who has input into how conflicts should be resolved? For example, conflicts will be resolved at monthly resource management meeting. All meeting participants have input, but the PMO director will have ultimate decision-making authority.

Document your process for resolving resource constraints and issues in Section 3.4 of Info-Tech’s Resource Management Playbook.

Inputs Artifacts i.e. meeting agenda
Consulted i.e. meeting participants
Tools & Templates i.e. capacity reports
Outputs Artifacts i.e. minutes and resolutions
Informed i.e. steering committee
Timing i.e. every second Thursday
Responsible i.e. PMO director
Accountable i.e. CIO

Step five: record how resource allocations will be finalized and communicated for the forecast window

2.3.6
20 minutes

The final step in your resource management process is to clarify how resource allocations will be documented in your resource management solution and reported to the department.

Once a plan to rebalance supply and demand for the reporting period has been agreed on, you will need to ensure that the appropriate data is updated in your resource management book of record, and that allocation decisions are communicated to the appropriate stakeholders.

The important decisions to document for this step include:

  1. Who has ultimate authority for allocation decisions? For example, the CIO has final authority when conflicts need to be escalated and must approve all allocations for the forecast period.
  2. Who will update the book of record and when? For example, the tool admin will update the data before the end of the day following the resource management meeting.
  3. Who needs to be informed and of what? For example, resource plans will be updated in SharePoint for resources and managers to review.

Document your process for approving and finalizing allocation in Section 3.5 of Info-Tech’s Resource Management Playbook.

Task-at-a-glance

Inputs Artifacts i.e. minutes and resolutions
Consulted i.e. CIO, IT directors
Tools & Templates i.e. Portfolio Manager Lite
Outputs Artifacts i.e. updated availability table
Informed i.e. steering committee
Timing i.e. every second Friday
Responsible i.e. portfolio analyst
Accountable i.e. PMO director

Finalize your provisional resource management process in the Playbook Template

2.3 Resource Management Playbook

Use Info-Tech’s Resource Management Playbook to solidify your processes in a formalized operating plan.

Throughout this phase, we have been customizing sections 1, 2, and 3 of the Resource Management Playbook.

Before we move to pilot and implement your resource management strategy in the next phase of this blueprint, ensure that sections 1-3 of your playbook have been drafted and are ready to be communicated and shared with stakeholders.

  • Avoid getting too granular in your process requirements. Keep it to high-level data requirements. Imposing too much detail in your playbook is a recipe for failure.
  • The playbook should remain provisional throughout your pilot phase. Aspects of your process will likely need to be changed or tweaked as they are met with some day-to-day realities. As with any “living document,” it can be helpful to explicitly assign responsibilities for updating the playbook over the long term to ensure it stays relevant.

"People are spending far more time creating these elaborate [time-tracking] systems than it would have taken just to do the task. You’re constantly on your app refiguring, recalculating, re-categorizing... A better strategy would be [returning] to the core principles of good time management…Block out your calendar for the non-negotiable things. [Or] have an organized prioritized task list." – Laura Stack (quoted in Zawacki)

If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

Book a workshop with our Info-Tech analysts:

  • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
  • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
  • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

The following are sample activities that will be conducted by Info-Tech analysts with your team:

2.1 Wireframe a resource management strategy using Info-Tech’s seven dimensions of resource management

Action the decision points across Info-Tech’s seven dimensions to ensure your resource management process is guided by realistic data and process goals.

2.3 Draft a high-level resource management workflow and elaborate it into a repeatable practice

Customize Info-Tech’s five-step resource management process model. Then, document how the process will operate by customizing the Resource Management Playbook.

Phase 3

Implement Sustainable Resource Management Practices

Phase 3 outline

Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

Guided Implementation 3: Implement Sustainable Resource Management Practices

Proposed Time to Completion (in weeks): 4-12 weeks

Step 3.1: Pilot your resource management process

Start with an analyst kick-off call:

  • Review your resource management dimensions and tools
  • Review your provisional resource management processes
  • Discuss your ideas for a pilot

Then complete these activities…

  • Select receptive project/functional managers to work with
  • Define the scope of your pilot and determine logistics
  • Finalize resource management roles and responsibilities

With these tools & templates:

  • Process Pilot Plan Template
  • Resource Management Playbook
  • Project Portfolio Analyst Job Description
Step 3.2: Plan to engage your stakeholders

Review findings with analyst:

  • Results of your pilot, team feedback, and lessons learned
  • Your stakeholder landscape

Then complete these activities…

  • Brainstorm and plan for potential resistance to change, objections, and fatigue from stakeholders
  • Plan for next steps

With these tools & templates:

  • Resource Management Playbook

Phase 3 Results & Insights:

Engagement paves the way for smoother adoption. An engagement approach (rather than simply communication) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

Step 3.1: Pilot your resource management process to assess viability

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:

  • Select receptive project and functional managers to work with during your pilot
  • Define the scope of your pilot and determine logistics
  • Plan to obtain feedback, document lessons learned, and create an action plan for any changes
  • Finalize resource management roles and responsibilities

This step involves the following participants:

  • CIO
  • PMO Director / Portfolio Manager
  • Project Managers
  • Resource Managers

Outcomes of this step

  • A pilot team
  • A process pilot plan that defines the scope, logistics, and process for retrospection
  • Roles, responsibilities, and accountabilities for resource management
  • Project Portfolio Analyst job description template

Pilot your new processes to test feasibility and address issues before a full deployment

Adopting the right set of practices requires a significant degree of change that necessitates buy-in from varied stakeholders throughout IT and the business.

Rome wasn’t built in a day. Similarly, your visibility into resource usage and availability won’t happen overnight.

Resist the urge to deploy a big-bang rollout of your research management practices. This approach is ill advised for two main reasons:

  • It will put more of a strain on the implementation team in the near term, with a larger pool of end users to train and collect data from.
  • Putting untested practices in a department-wide spotlight could lead to mass confusion in the near-term and color the new processes in a negative light, leading to a loss of stakeholder trust and engagement right out of the gate.

Start with a pilot phase. Identify receptive project managers and functional managers to work with, and leverage their insights to help iron out the kinks in your process before unveiling your practices to IT and business users at large.

This step will help you:

  • Plan and execute a pilot of the processes we developed in Phase 2.
  • Incorporate the lessons learned from that pilot to strengthen your playbook and ease the communication process.

Info-Tech Insight

Engagement paves the way for smoother adoption. An engagement approach (rather than simply communication) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

Plan your pilot like you would any project to ensure it’s well defined and its goals are clearly articulated

Use Info-Tech’s Process Pilot Plan Template to help define the scope of your pilot and set appropriate goals for the test run of your new processes.

A process pilot is a limited scope of an implementation (constrained by time and resources involved) to test the viability and effectiveness of the process as it has been designed.

  • Investing time and energy into a pilot phase can help to lower implementation risk, enhance the details and steps within a process, and improve stakeholder relations prior to a full scale rollout.
  • More than a dry run, however, a pilot should be approached strategically and planned out to limit the scope of it and achieve specific outcomes.
  • Leverage a planning document to ensure your process pilot is grounded in a common set of definitions, that the pilot is delivering value and insight, and that ultimately the pilot can serve as a starting point for a full-scale process implementation.

"The advantages to a pilot are several. First, risk is constrained. Pilots are closely monitored so if a problem does occur, it can be fixed immediately. Second, the people working in the pilot can become trainers as you roll the process out to the rest of the organization. Third, the pilot is another opportunity for skeptics to visit the pilot process and learn from those working in it. There’s nothing like seeing a new process working for people to change their minds." – Daniel Madison

Download Info-Tech’s Process Pilot Plan Template

Select receptive project and functional managers to work with during your pilot

3.1.1
20 to 60 minutes

Input

  • Project management staff and functional managers

Output

  • Pilot project teams

Materials

  • Stakeholder Engagement Workbook
  • Process Pilot Plan Template

Participants

  • Process owner (PMO director or portfolio owner)
  • CIO

Info-Tech recommends selecting project managers and functional managers who are aware of your role and some of the supply-demand challenges to assist in the implementation process.

  1. If receptive project and functional managers are known, schedule a 15-minute meeting with them to inquire if they would be willing to be part of the pilot process.
  2. If receptive project managers are not known, use Info-Tech’s Stakeholder Engagement Workbook to conduct a formal selection process.
    1. Enter a list of potential pilot project managers in tab 3.
    2. Rate project managers in terms of influence, pilot interest, and potential deployment contribution within tab 4.
    3. Review tab 5 in the workbook. Receptive project managers will appear in the top quadrants. Ideal project managers for the pilot are located in the top right quadrant of the graph.

Document the project and functional managers involved in your pilot in Section 3 of Info-Tech’s Process Pilot Plan Template.

Define the scope of your pilot and determine logistics

Input

  • Sections 1 through 4 of the Process Pilot Plan Template

Output

  • A process pilot plan

Materials

  • Process Pilot Plan Template

Participants

  • Process Owner (PMO Director or Portfolio Owner)
  • CIO
  • Project and Resource Managers

Use Info-Tech’s Process Pilot Plan Template to design the details of your pilot.

Investing time into planning your pilot phase strategically will ensure a clear scope, better communications for those piloting the processes, and overall, better, more actionable results during the pilot phase. The Process Pilot Plan Template is broken into five sections to assist in these goals:

    • Pilot Overview and Scope
    • Success and Risk Factors
    • Stakeholders Involved and Communications Plan
    • Pilot Retrospective and Feedback Protocol
    • Lessons Learned
  • The duration of your pilot should go at least one allocation period, depending on your frequency of updates, e.g. one week or month.
  • Estimates of time commitments should be captured for each stakeholder. During the retrospective at the end of the pilot, you should capture actuals to help determine the time-cost of the process itself and measure its sustainability.
  • Once the template is completed, schedule time to share and communicate it with the pilot team and executive sponsors of the process.

While you should invest time in this planning document, continue to lean on the Resource Management Playbook as well as a process guide throughout the pilot phase.

Execute your pilot and prepare to make process revisions before the full rollout

Hit play! Begin the process pilot and get familiar with the work routine and resource management solution.

Some things to keep in mind during the pilot include:

  • Depending on the solution you’re using, you will likely need to spend one day or less to populate the tool. During the pilot, measure the time and effort required to manage the data within the tool. Compare with the original estimate from activity 2.2.2. Determine whether time and effort required are viable on an ongoing basis (i.e. can you do it every week or month) and have value.
  • Meet with the pilot team and other stakeholders regularly during the pilot – at least weekly. Allow the team (and yourself) to speak honestly and openly about what isn’t working. The pilot is your chance to make things better.
  • Keep notes about what will need to change in the RM Playbook. For major changes, you may have to tweak the process during the pilot itself. Update the process documents as needed and communicate the changes and why they’re being made. If required, update the scope of the pilot in the Process Pilot Plan Template.

Obtain feedback from the pilot group to improve your processes before a wider rollout

3.1.3
30 minutes

Input

  • What’s working and what isn’t in the process

Output

  • Ideas to improve process

Materials

  • Whiteboard
  • Sticky notes
  • Process Pilot Plan Template

Participants

  • Process Owner (PMO Director or Portfolio Owner)
  • Pilot Team

Pilot projects allow you to validate your assumptions and leverage lessons learned. During the planning of the pilot, you should have scheduled a retrospective meeting with the pilot team to formally assess strengths and weaknesses in the process you have drafted.

  • Schedule the retrospective shortly after the pilot is completed. Info-Tech recommends a stop/start/continue activity with pilot participants to obtain and capture feedback.
  • Have members of the meeting record any processes/activities on sticky notes that should:
    • Stop: because they are ineffective or not useful
    • Start: because they would be useful for the tool and have not been incorporated into current processes
    • Continue: because they are useful and positively contribute to intended process outcomes

An example of how to structure a stop/start/continue activity on a whiteboard using sticky notes.

The image shows three black squares, each with three brightly coloured sticky notes in it. The three squares are labelled: Stop; Start; Continue.

See below for additional instructions

Document lessons learned and create an action plan for any changes to the resource management processes

3.1.4
30 minutes

As a group, discuss everyone’s responses and organize according to top priority (mark with a 1) and lower priority/next steps (mark with a 2). At this point, you can also remove any sticky notes that are repetitive or no longer relevant.

Once you have organized based on priority, be sure to come to a consensus with the group regarding which actions to take. For example, if the group agrees that they should “stop holding meetings weekly,” come to a consensus regarding how often meetings will be held, i.e. monthly.

Create an action plan for the top priority items that require changes (the stops and starts). Record in this slide or your preferred medium. Be sure to include who is responsible for the action and the date that it will be implemented.

Priority Action Required Who is Responsible Implementation Date
Stop: Holding meetings weekly Hold meetings monthly Jane Doe, PMO Next Meeting: November 1, 2017
Start: Discussing backlog during meetings Ensure that backlog data is up to date for discussion on date of next meeting John Doe, Portfolio Manager November 1, 2017

Document the outcomes of the start/stop/continue exercise and your action plan in Section 6 of Info-Tech’s Process Pilot Plan Template.

Review actions that can be taken based on the results of your pilot

Situation Action Next Steps
The dimensions that we chose for our strategy have proven to be too difficult to accurately maintain. The dimensions that we chose for our strategy have proven to be too difficult to accurately maintain. Reassess the dimensions that you chose for your strategy. Make sure that you are not overcommitting yourself based on your maturity level. You can always go back and adjust for a higher level of resource management maturity once you have mastered your current level. For example, if you chose “weekly” as your update frequency and this has proven to be too much to maintain, try updating monthly for a few months. Once you have mastered this update frequency, it will be easier to adjust to a weekly update process.
We were able to maintain the data for our pilot based on the dimensions that we chose. However, allocating projects based on realized capacity did not alleviate any of our resourcing issues and resources still seem to be working on more projects than they can handle. Determine other factors at the organization that would help to maintain the data and work toward reclaiming capacity. Continue working with the dimensions that you chose and maintain the accuracy of this data. The next step is to identify other factors that are contributing to your resource allocation problems and begin reclaiming capacity. Continue forward to the resource management roadmap section and work on changing organizational structures and worker behavior to maximize capacity for project work.
We were able to easily and accurately maintain the data, which led to positive results and improvement in resource allocation issues. If your strategy is easily maintained, identify factors that will help your organization reclaim capacity. Continue to maintain this data, and eventually work toward maintaining it at a more precise level. For example, if you are currently using an update frequency of “monthly” and succeeding, think about moving toward a “weekly” frequency within a few months. Once you feel confident that you can maintain project and resource data, continue on to the roadmap section to discover ways to reclaim resource capacity through organizational and behavioral change.

Finalize resource management roles and responsibilities

3.1.5
15 to 30 minutes

Input

  • Tasks for resource management
  • Stakeholder involved

Output

  • Roles, responsibilities, and accountabilities for resource management

Materials

  • Resource Management Playbook

Participants

  • PMO Director/ Portfolio Manager
  • Functional Managers
  • Project Managers

Perform a RACI exercise to help standardize terminology around roles and responsibilities and to ensure that expectations are consistent across stakeholders and teams.

  • A RACI will help create a clear understanding of the tasks and expectations for each stakeholder at each process step, assigning responsibilities and accountability for resource management outcomes.

Responsible

Accountable

Consulted

Informed

Roles CIO PMO Portfolio Analyst Project Manager Functional Manager
Collect supply data I A R I C
Collect demand data I A R C I
Identify conflicts I C/A R C C
Resolve conflicts C A/R I R R
Approve allocations A R I R I

Document your roles and responsibilities in Section 2 of Info-Tech’s Resource Management Playbook.

Use Info-Tech’s Portfolio Analyst job description to help fill any staffing needs around data maintenance

3.1 Project Portfolio Analyst/PMO Analyst Job Description

You will need to determine responsibilities and accountabilities for portfolio management functions within your team.

If you do not have a clearly identifiable portfolio manager at this time, you will need to clarify who will wear which hats in terms of facilitating intake and prioritization, high-level capacity awareness, and portfolio reporting.

  • Use Info-Tech’s Project Portfolio Analyst job description template to help clarify some of the required responsibilities to support your PPM strategy.
    • If you need to bring in an additional staff member to help support the strategy, you can customize the job description template to help advertise the position. Simply edit the text in grey within the template.
  • If you have other PPM tasks that you need to define responsibilities for, you can use the RASCI chart on the final tab of the PPM Strategy Development Tool.

Download Info-Tech’s Project Portfolio Analyst Job Description Template

Finalize the Resource Management Playbook and prepare to communicate your processes

Once you’ve completed the pilot process and made the necessary tweaks, you should finalize your Resource Management Playbook and prepare to communicate it.

Revisit your RM Playbook from step 2.3 and ensure it has been updated to reflect the process changes that were identified in activity 3.1.4.

  • If during the pilot process the data was too difficult or time consuming to maintain, revisit the dimensions you have chosen and select dimensions that are easier to accurately maintain. Tweak your process steps in the playbook accordingly.
  • In the long term, if you are not observing any capacity being reclaimed, revisit the roadmap that we’ll prepare in step 3.2 and address some of these inhibitors to organizational change.
  • In the next step, we will also be repurposing some of the content from the playbook, as well as from previous activities, to include them in your presentation to stakeholders, using Info-Tech’s Resource Management Communications Template.

Download Info-Tech’s Resource Management Playbook

Info-Tech Best Practice

Make your process standardization comprehensive. The RM Playbook should serve as your resource management standard operating procedure. In addition to providing a walk-through of the process, an SOP also clarifies project governance by clearly defining roles and responsibilities.

Step 3.2: Plan to engage your stakeholders with your playbook

PHASE 1

1.1 Set a course of action

1.2 Estimate supply and demand

PHASE 2

2.1 Select resource management dimensions

2.2 Select resource management tools

2.3 Build process steps

PHASE 3

3.1 Pilot your process for viability

3.2 Plan stakeholder engagement

This step will walk you through the following activities:

  • Brainstorm and plan for potential resistance to change, objections, and fatigue from stakeholders
  • Plan for next steps in reclaiming project capacity
  • Plan for next steps in overcoming supply-demand reconciliation challenges

This step involves the following participants:

  • CIO
  • PMO Director / Portfolio Manager
  • Pilot Team from Step 3.1

Outcomes of this step

  • Plan for communicating responses and objections from stakeholders and staff
  • Plan to manage structural/enabling factors that influence success of the resource management strategy
  • Description of next steps in reclaiming project capacity and overcoming supply-demand reconciliation challenges
  • Final draft of the customized Resource Management Playbook

Develop a resource management roadmap to communicate and reinforce the strategy

A roadmap will help anticipate, plan, and address barriers and opportunities that influence the success of the resource management strategy.

This step of the project will ensure the new strategy is adopted and applied with maximum success by helping you manage challenges and opportunities across three dimensions:

1. Executive Stakeholder Factors

For example, resistance to adopting new assumptions about ratio of project versus non-project work.

2. Workforce/Team Factors

For example, resistance to moving from individual- to team-based allocations.

3. Structural Factors

For example, ensuring priorities are stable within the chosen resource planning horizon.

See Info-Tech’s Drive Organizational Change from the PMOfor comprehensive tools and guidance on achieving organizational buy-in for your new resource management practices.

Info-Tech Insight

Communicate, communicate, communicate. Staff are 34% more likely to adapt to change quickly during the implementation and adoption phases when they are provided with a timeline of impending changes specific to their department. (McLean & Company)

Anticipate a wide range of responses toward your new processes

While your mandate may be backed by an executive sponsor, you will need to influence stakeholders from throughout the organization in order to succeed. Indeed, as EPMO leader, success will depend upon your ability to confirm and reaffirm commitments on soft or informal grounds. Prepare an engagement strategy that anticipates a wide range of responses.

Enthusiasts Fence-sitters Skeptics Saboteurs
What they look like: Put all their energy into learning new skills and behaviors. Start to use new skills and behaviors at a sluggish pace. Look for alternate ways of implementing the change. Refuse to learn anything new or try new behaviors.
How they contribute: Lead the rest of the group. Provide an undercurrent of movement from old behaviors to new. Challenge decisions and raise risk points with managers. May raise valid points about the process that should be fixed.
How to manage them: Give them space to learn and lead others. Keep them moving forward by testing their progress. Listen to them, but don’t give in to their demands. Keep communicating with them until you convert them.
How to leverage them: Have them lead discussions and training sessions. Use them as an example to forecast the state once the change is adopted. Test new processes by having them try to poke holes in them. If you can convert them, they will lead the Skeptics and Fence-sitters.

Info-Tech Insight

Hone your stakeholder engagement strategy. Most people affected by an IT-enabled change tend to be fence-sitters. Small minorities will be enthusiasts, saboteurs, and skeptics. Your communication strategy should focus on engaging the skeptics, saboteurs, and enthusiasts. Fence-sitters will follow.

Define plans to deal with resistance to change, objections, and fatigue

Be prepared to confront skeptics and saboteurs when communicating the change.

  1. Use the templates on the following slide to:
    1. Brainstorm possible objections from stakeholders and staff. Prioritize objections that are likely to occur.
    2. Develop responses to objections.
  2. Develop a document and plan for proactively communicating responses and objections to show people that you understand their point of view.
    1. Revise the communications messaging and plan to include proactive objection handling.
  3. Discuss the likelihood and impact of “saboteurs” who aren’t convinced or affected by change management efforts.
    1. Explore contingency plans for dealing with difficult saboteurs. These individuals can negate the progress of the rest of the team by continuing to resist the process and spreading toxic energy. If necessary, be ruthless with these individuals. Let them know that the rest of the group is moving on without them, and if they can’t or won’t adopt the new standards, then they can leave.

Info-Tech Insight

Communicate well and engage often. Agility and continuous improvement are good, but can degenerate into volatility if change isn’t managed properly. People will perceive change to be volatile if their expectations aren’t managed through communications and engagement planning.

Info-Tech Best Practice

The individuals best positioned to provide insight and influence change positively are also best positioned to create resistance.

These people should be engaged early and often in the implementation process – not just to make them feel included or part of the change, but also because their insight could very likely identify risks, barriers, and opportunities that need to be addressed.

Develop a plan to manage stakeholder resistance to the new resource management strategy

3.2.1
30 minutes

Brainstorm potential implications and objections that executive stakeholders might raise about your new processes.

Dimension Decision Potential Impact, Implications, and Objections Possible Responses and Actions
i.e. Default Project Ratio 50% “This can’t be right...” “We conducted a thorough time audit to establish this ratio.”
“We need to spend more time on project work.” “Realistic estimates will help us control new project intake, which will help us optimize time allocated to projects.”
i.e. Frequency Monthly “This data isn’t detailed enough, we need to know what people are working on right now.” “Maintaining an update frequency of weekly would require approximately [X] extra hours of PMO effort. We can work toward weekly as we mature.”
i.e. Scope Person “That is a lot of people to keep track of.” “Managing individuals is still the job of the project manager; we are responsible for allocating individuals to projects.”
i.e. Granularity of Work Assignment Project “We need to know exactly what tasks are being worked on and what the progress is.” “Assigning at task level is very difficult to accurately maintain. Once we have mastered a project-level granularity we can move toward task level.”
i.e. Forecast Horizon One month “We need to know what each resource is working on next year.” “With a monthly forecast, our estimates are dependable. If we forecast a year in advance, this estimate will not be accurate.”

Document the outcomes of this activity on slide 26 of Info-Tech’s Resource Management Communications Template.

Develop a plan to manage staff/team resistance to the new resource management strategy

3.2.2
30 minutes

Brainstorm potential implications and objections that individual staff and members of project teams might raise about your new processes.

Dimension Decision Potential Impact, Implications, and Objections Possible Responses and Actions
i.e. Default Project Ratio 50% “There’s too much support work.” “We conducted a thorough time audit to establish this ratio. Realistic estimates will help us control new project intake, which will help us optimize your project time.”
i.e. Frequency Monthly “I don’t have time to give you updates on project progress.” “This update frequency requires only [X] amount of time from you per week/month.”
i.e. Granularity Project “I need more clarity on what I’m working on.” “Team members and project managers are in the best position to define and assign (or self-select) individual tasks.”
i.e. Forecast Horizon One month “I need to know what my workload will be further in advance.” “You will still have a high-level understanding of what you will be working on in the future, but projects will only be officially forecasted one month in advance.”
i.e. Allocation Cadence Monthly “We need a more frequent cadence.” “We can work toward weekly cadence as we mature.”

Document the outcomes of this activity on slide 27 of Info-Tech’s Resource Management Communications Template.

Develop a plan to manage structural/enabling factors that influence success of the resource management strategy

3.2.3
30 minutes

Brainstorm a plan to manage other risks and challenges to implementing your processes.

Dimension Decision Potential Impact, Implications, and Objections Possible Responses and Actions
i.e. Default Project Ratio 50% “We have approved too many projects to allocate so little time to project work.” Nothing has changed – this was always the amount of time that would actually go toward projects. If you are worried about a backlog, stop approving projects until you have completed the current workload.
i.e. Frequency Monthly “Status reports aren’t reliably accurate and up to date more than quarterly.” Enforce strict requirements to provide monthly status updates for 1-3 key KPIs.
i.e. Scope Person “How can we keep track of what each individual is working on?” Establish a simple, easy reporting mechanism so that resources are reporting their own progress.
i.e. Granularity Project “How will we know the status of a project without knowing what tasks are completed?” It is in the domain of the project manager to know what tasks have been completed and to report overall project progress.
i.e. Forecast Horizon One Month “It will be difficult to plan for resource needs in advance.” Planning a month in advance allows you to address conflicts or issues before they are urgent.

Document the outcomes of this activity on slide 28 of Info-Tech’s Resource Management Communications Template.

Finalize your communications plan and prepare to present the new processes to the organization

Use Info-Tech’s Resource Management Communications Template to record the challenges your resource management strategy is addressing and how it is addressing them.

Highlight organizational factors that necessitated the change.

  • Stakeholders and staff understandably tend to dislike change for the sake of change. Use Info-Tech’s Resource Management Communications Template to document the pain points that your process change is addressing and explain the intended benefits for all who will be subject to the new procedures.

Determine goals and benefits for implementation success.

  • Provide metrics by which the implementation will be deemed a success. Providing this horizon will provide some structure for stakeholders and hopefully help to encourage process discipline.

Clearly indicate what is required of people to adopt new processes.

  • Document your Resource Management Playbook. Be sure to include specific roles and responsibilities so there is no doubt regarding who is accountable for what.

Download Info-Tech’s Resource Management Communications Template

"You need to be able to communicate effectively with major stakeholders – you really need their buy-in. You need to demonstrate credibility with your audience in the way you communicate and show how portfolio [management] is a structured decision-making process." – Dr. Shan Rajegopal (quoted in Akass, “What Makes a Successful Portfolio Manager”)

Review tactics for keeping your processes on track

Once the strategy is adopted, the next step is to be prepared to address challenges as they come up. Review the tactics in the table below for assistance.

Challenge Resolution Next Step
Workers are distracted because they are working on too many projects at once; their attention is split and they are unproductive. Workers are distracted because they are working on too many projects at once; their attention is split and they are unproductive. Review portfolio practices for ways to limit work in progress (WIP).
Employees are telling project managers what they want to hear and not giving honest estimates about the way their time is spent. Ensure that employees understand the value of honest time tracking. If you’re allocating your hours to the wrong projects, it is your projects that suffer. If you are overallocated, be honest and share this with management. Display employee time-tracking reports on a public board so that everyone will see where their time is spent. If they are struggling to complete projects by their deadlines they must be able to demonstrate the other work that is taking up their time.
Resources are struggling with projects because they do not have the necessary expertise. Perform a skills audit to determine what skills employees have and assign them to projects accordingly. If an employee with a certain skill is in high demand, consider hiring more resources who are able to complete this work.

See below for additional challenges and tactics

Review tactics for keeping supply and demand aligned

Once the strategy is adopted, the next step is to use the outputs of the strategy to reclaim capacity and ensure supply and demand remain aligned. Review the tactics in the table below for assistance.

Challenge Resolution Next Step
There is insufficient project capacity to take on new work, but demand continues to grow. Extend project due date and manage the expectations of project sponsors with data. If possible, reclaim capacity from non-project work. Customize the playbook to address insufficient project capacity.
There is significant fluctuation in demand, making it extremely challenging to stick to allocations. Project managers can build in additional contingencies to project plans based on resourcing data, with plans for over-delivering with surplus capacity. In addition, the CIO can leverage business relationships to curb chaotic demand. The portfolio manager should analyze the project portfolio for clues on expanding demand. Customize the playbook to address large fluctuations in demand.
On a constant basis, there are conflicting project demands over specific skills. Re-evaluate the definition of a project to guard the value of the portfolio. Continually prioritize projects based on their business values as of today. Customize the playbook to address conflicting project demands. Feed into any near- and long-term staffing plans.

Prepare to communicate your new resource management practices and reap their benefits

As you roll out your resource management strategy, familiarize yourself with the capability improvements that will drive your resource management success metrics.

  1. Increased capacity awareness through the ability to more efficiently and more effectively collect and track complex, diverse, and dynamic project data across the project portfolio.
  2. Improved supply management. Increased awareness of resource capacity (current and forecasted) combined with the ability to see the results of resource allocations across the portfolio will help ensure that project resources are used as effectively as possible.
  3. Improved demand management. Increased capacity awareness, combined with reliable supply management, will help PMOs set realistic limits on the amount and kind of IT projects the organization can take on at any given time. The ability to present user-friendly reports to key decision makers will help the PMO to ensure that the projects that are approved are realistically attainable and strategically aligned.
  4. Increased portfolio success. Improvements in the three areas indicated above should result in more realistic demands on project workers/managers, better products, and better service to all stakeholders. While successfully implemented PPM solutions should produce more efficient PPM processes, ideally they should also drive improved project stakeholder satisfaction across the organization.

The image shows a series on concentric circles, labelled (from the inside out): Capacity Awareness; Supply Management; Demand Management; Project Success.

Info-Tech client achieves resource management success by right-sizing its data requirements and focusing on reporting

CASE STUDY

Industry Manufacturing

Source Info-Tech Client

We were concerned that the staff would not want to do timesheets. With one level of task definition, it’s not really timesheets. It’s more about reconciling our allocations.” – PMO Director, Manufacturing

Challenge

  • In a very fast-paced environment, the PMO had developed a meaningful level of process maturity.
  • There had never been time to slow down enough to introduce a mature PPM tool set.
  • The executive leadership had started to ask for more throughput of highly visible IT projects.

Solution

  • There had never been oversight on how much IT time went toward escalated support issues and smaller enhancement requests.
  • Staff had grown accustomed to a lack of documentation rigor surrounding the portfolio.
  • Despite a historic baseline of the ratio between strategic projects, small projects, and support, the lack of recordkeeping made it hard to validate or reconcile these ratios.

Results

  • The organization introduced a robust commercial PPM tool.
  • They were able to restrict the granularity of data to a high level in order to limit the time required to enter and manage, and track the actuals.
  • They prepared executive leadership for their renewed focus on the allocation of resources to strategically important projects.
  • Approval of projects was right-sized based on the actual capacity and realized through improved timesheet recordkeeping.

If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

Book a workshop with our Info-Tech analysts:

  • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
  • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
  • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

The following are sample activities that will be conducted by Info-Tech analysts with your team:

3.1 Define the scope of your pilot and set appropriate goals for the test-run of your new processes

An effective pilot lowers implementation risk, enhances the details and steps within a process, and improves stakeholder relations prior to a full scale rollout.

3.2 Develop a plan to manage stakeholder and staff resistance to the new resource management practice

Proactively plan for communicating responses and objections to show people that you understand their point of view and win their buy-in.

Insight breakdown

Insight 1

A matrix organization creates many small, untraceable demands that are often overlooked in resource management efforts, which lead to underestimating total demand and overcommitting resources. To capture them and enhance the success of your resource management effort, focus on completeness rather than precision. Precision of data will improve over time as your process maturity grows.

Insight 2

Draft the resource management practice with sustainability in mind. It is about what you can and will maintain every week, even during a crisis: it is not about what you put together as a one-time snapshot. Once you stop maintaining resource data, it’s nearly impossible to catch up.

Insight 3

Engagement paves the way for smoother adoption. An engagement approach (rather than simply communication) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.

Summary of accomplishment

Knowledge Gained

  • Disconnect between traditional resource management paradigms and today’s reality of work environment
  • Differentiation of accuracy and precision in capacity data
  • Snapshot of resource capacity supply and demand
  • Seven dimensions of resource management strategy
  • How to create sustainability of a resource management practice

Processes Optimized

  • Collecting resource supply data
  • Capturing the project demand
  • Identifying and documenting resource constraints and issues
  • Resolving resource issues
  • Finalizing and communicating resource allocations for the forecast window

Deliverable Completed

  • Resource Management Supply-Demand Calculator, to create an initial estimate of resource capacity supply and demand
  • Time-tracking survey emails, to validate assumptions made for creating the initial snapshot of resource capacity supply and demand
  • Resource Management Playbook, which documents your resource management strategy dimensions, process steps, and responses to challenges
  • PPM Solution Vendor Demo Script, to structure your resource management tool demos and interactions with vendors to ensure that their solutions can fully support your resource management practices
  • Portfolio Manager Lite, a spreadsheet-based resource management solution to facilitate the flow of data
  • Process Pilot Plan, to ensure that the pilot delivers value and insight necessary for a wider rollout
  • Project Portfolio Analyst job description, to help your efforts in bringing in additional staff to provide support for the new resource management practice
  • Resource Management Communications presentation, with which to engage your stakeholders during the new process rollout

Research contributors and experts

Trevor Bramwell, ICT Project Manager Viridor Waste Management

John Hansknecht, Director of Technology University of Detroit Jesuit High School & Academy

Brian Lasby, Project Manager Toronto Catholic District School Board

Jean Charles Parise, CIO & DSO Office of the Auditor General of Canada

Darren Schell, Associate Executive Director of IT Services University of Lethbridge

Related Info-Tech research

Develop a Project Portfolio Management Strategy

Grow Your Own PPM Solution

Optimize Project Intake, Approval, and Prioritization

Maintain and Organized Portfolio

Manage a Minimum-Viable PMO

Establish the Benefits Realization Process

Manage an Agile Portfolio

Tailor Project Management Processes to Fit Your Projects

Project Portfolio Management Diagnostic Program

The Project Portfolio Management Diagnostic Program is a low-effort, high-impact program designed to help project owners assess and improve their PPM practices. Gather and report on all aspects of your PPM environment to understand where you stand and how you can improve.

Bibliography

actiTIME. “How Poor Tracking of Work Time Affects Your Business.” N.p., Oct. 2016. Web.

Akass, Amanda. “What Makes a Successful Portfolio Manager.” Pcubed, n.d. Web.

Alexander, Moira. “5 Steps to avoid overcommitting resources on your IT projects.” TechRepublic. 18 July 2016. Web.

Anderson, Ryan. “Some Shocking Statistics About Interruptions in Your Work Environment.” Filevine, 9 July 2015. Web.

Bondale, Kiron. “Focus less on management and more on the resources with resource management.” Easy in Theory, Difficult in Practice. 16 July 2014. Web.

Burger, Rachel. “10 Software Options that Will Make Your Project Resource Allocation Troubles Disappear.” Capterra Project Management Blog, 6 January 2016. Web.

Cooper, Robert, G. “Effective Gating: Make product innovation more productive by using gates with teeth.” Stage-Gate International and Product Development Institute. March/April 2009. Web.

Dimensional Research. “Lies, Damned Lies and Timesheet Data.” Replicon, July 2013. Web.

Edelman Trust Barometer. “Leadership in a Divided World.” 2016. Web.

Frank, T.A. “10 Execs with Time-Management Secrets You Should Steal.” Monday*. Issue 2: Nov-Dec 2014. Drucker Institute. Web.

Huth, Susanna. “Employees waste 759 hours each year due to workplace distractions.” The Telegraph, 22 Jun 2015. Web.

Jacobeus, Nicolas. “How Detailed Does Your Agency Time Tracking Need to Be?” Scale Blog, 18 Jul 2016. Web.

Lessing, Lawrence. Free Culture. Lulu Press Inc.: 30 July 2016.

Kwak, James. “The Importance of Excel. The Baseline Scenario, 9 Feb 2013. Web.

Madison, Daniel. “The Five Implementation Options to Manage the Risk in a New Process.” BPMInstitute.org. n.d. Web.

Mark, Gloria. Multitasking in the Digital Age. Morgan & Claypool Publishers. 1 April 2015

Maron, Shim. “Accountability Vs. Responsibility In Project Management.” Workfront, 10 June 2016. Web.

PM Solutions. “Resource Management and the PMO: Three Strategies for Addressing Your Biggest Challenge.” N.p., 2009. Web.

Project Management Institute. “Pulse of the Profession 2014.” PMI, 2014. Web.

Planview. “Capacity Planning Fuels Innovation Speed.” 2016. Web.

Rajda, Vilmos. “The Case Against Project Portfolio Management.” PMtimes, 1 Dec 2010. Web.

Reynolds, Justin. “The Sad Truth about Nap Pods at Work.” TINYpulse, 22 Aug 2016. Web.

Schulte, Brigid. “Work interrupts can cost you 6 hours a day. An efficiency expert explains how to avoid them.” Washington Post, 1 June 2015. Web.

Stone, Linda. "Continuous Partial Attention." Lindastone.net. N.p., n.d. Web.

Zawacki, Kevin. “The Perils of Time Tracking.” Fast Company, 26 Jan 2015. Web.

2021 IT Talent Trend Report

  • Buy Link or Shortcode: {j2store}516|cart{/j2store}
  • member rating overall impact: 10.0/10 Overall Impact
  • member rating average dollars saved: $9,919 Average $ Saved
  • member rating average days saved: 2 Average Days Saved
  • Parent Category Name: Lead
  • Parent Category Link: /lead
  • In March 2020, many organizations were forced to switch to a virtual working world. IT enabled organizations to be successful while working from home. Ultimately, this shift changed the way that we all work, and in turn, the way IT leaders manage talent.
  • Many organizations are considering long-term remote work (Kelly, 2020).
  • Change is starting but is lagging.

Our Advice

Critical Insight

  • Increase focus on employee experience to navigate new challenges.
  • A good employee experience is what is best for the IT department.

Impact and Result

  • The data shows IT is changing in the area of talent management.
  • IT has a large role in enabling organizations to work from home, especially from a technological and logistics perspective. There is evidence to show that they are now expanding their role to better support employees when working from home.
  • Survey respondents identified efforts already underway for IT to improve employee experience and subsequently, IT effectiveness.

2021 IT Talent Trend Report Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should focus on the employee experience and get an overview of what successful IT leaders are doing differently heading into 2021 – the five new talent management trends.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. DEI: A top talent objective

The focus on diversity, equity, and inclusion (DEI) initiatives spans the entire organization beyond just HR. Learn which DEI efforts are underway with IT.

  • 2021 IT Talent Trend Report – Trend 1: DEI: A Top Talent Objective

2. Remote work is here to stay

Forced work-from-home demonstrated to organizations that employees can be productive while working away from the physical office. Learn more about how remote work is changing work.

  • 2021 IT Talent Trend Report – Trend 2: Remote Work Is Here to Stay

3. A greater emphasis on wellbeing

When the pandemic hit, organizations were significantly concerned about how employees were doing. Learn more about wellbeing.

  • 2021 IT Talent Trend Report – Trend 3: A Greater Emphasis on Wellbeing

4. A shift in skills priorities

Upskilling and finding sought after skills were challenging before the pandemic. How has it changed since? Learn more about skills priorities.

  • 2021 IT Talent Trend Report – Trend 4: A Shift in Skills Priorities

5. Uncertainty unlocks performance

The pandemic and remote work has affected performance. Learn about how uncertainty has impacted performance management.

  • 2021 IT Talent Trend Report – Trend 5: Uncertainty Unlocks Performance
[infographic]

Optimize the Service Desk With a Shift-Left Strategy

  • Buy Link or Shortcode: {j2store}478|cart{/j2store}
  • member rating overall impact: 9.4/10 Overall Impact
  • member rating average dollars saved: $21,171 Average $ Saved
  • member rating average days saved: 11 Average Days Saved
  • Parent Category Name: Service Desk
  • Parent Category Link: /service-desk
  • Tier 2 and 3 specialists lose time and resources working on tickets instead of more complex projects.
  • The service desk finds themselves resolving the same incidents over and over, wasting manual work on tasks that could be automated.
  • Employees expect modern, consumer-like experiences when they need help; they want to access information and resources from wherever they are and have the tools to solve their problems themselves without waiting for help.

Our Advice

Critical Insight

  • It can be difficult to overcome the mindset that difficult functions need to be escalated. Shift left involves a cultural change to the way the service desk works, and overcoming objections and getting buy-in up front is critical.
  • Many organizations have built a great knowledgebase but fail to see the value of it over time as it becomes overburdened with overlapping and out-of-date information. Knowledge capture, updating, and review must be embedded into your processes if you want to keep the knowledgebase useful.
  • Similarly, the self-service portal is often deployed out of the box with little input from end users and fails to deliver its intended benefits. The portal needs to be designed from the end user’s point of view with the goal of self-resolution if it will serve its purpose of deflecting tickets.

Impact and Result

  • Embrace a shift-left strategy by moving repeatable service desk tasks and requests into lower-cost delivery channels such as self-help tools and automation.
  • Shift work from Tier 2 and 3 support to Tier 1 through good knowledge management practices that empower the first level of support with documented solutions to recurring issues and free up more specialized resources for project work and higher value tasks.
  • Shift knowledge from the service desk to the end user by enabling them to find their own solutions. A well-designed and implemented self-service portal will result in fewer logged tickets to the service desk and empowered, satisfied end users.
  • Shift away manual repetitive work through the use of AI and automation.
  • Successfully shifting this work left can reduce time to resolve, decrease support costs, and increase end-user satisfaction.

Optimize the Service Desk With a Shift-Left Strategy Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to understand why a shift-left strategy can help to optimize your service desk, review Info-Tech's methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Prepare to shift left

Assess whether you’re ready to optimize the service desk with a shift-left strategy, get buy-in for the initiative, and define metrics to measure success.

  • Optimize the Service Desk With a Shift-Left Strategy – Phase 1: Prepare to Shift Left
  • Shift-Left Prerequisites Assessment
  • Shift-Left Strategy
  • Shift-Left Stakeholder Buy-In Presentation

2. Design shift-left model

Build strategy and identify specific opportunities to shift service support left to Level 1 through knowledge sharing and other methods, to the end-user through self-service, and to automation and AI.

  • Optimize the Service Desk With a Shift-Left Strategy – Phase 2: Design Shift Left Model
  • Shift-Left Action Plan
  • Knowledge Management Workflows (Visio)
  • Knowledge Management Workflows (PDF)
  • Self-Service Portal Checklist
  • Self-Service Resolution Workflow (Visio)
  • Self-Service Resolution Workflow (PDF)

3. Implement and communicate

Identify, track, and implement specific shift-left opportunities and document a communications plan to increase adoption.

  • Optimize the Service Desk With a Shift-Left Strategy – Phase 3: Implement & Communicate
  • Incident Management Workflow (Visio)
  • Incident Management Workflow (PDF)
[infographic]

Workshop: Optimize the Service Desk With a Shift-Left Strategy

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Prepare to Shift Left

The Purpose

Define how shift left would apply in your organization, get buy-in for the initiative, and define metrics to measure success.

Key Benefits Achieved

Defined scope and objectives for the shift-left initiative

Buy-in for the program

Metrics to keep the project on track and evaluate success

Activities

1.1 Review current service desk structure

1.2 Discuss challenges

1.3 Review shift-left model and discuss how it would apply in your organization

1.4 Complete the Shift-Left Prerequisites Assessment

1.5 Complete a RACI chart for the project

1.6 Define and document objectives

1.7 Review the stakeholder buy-in presentation

1.8 Document critical success factors

1.9 Define KPIs and metrics

Outputs

Shift-left scope

Completed shift-left prerequisites assessment

RACI chart

Defined objectives

Stakeholder buy-in presentation

Critical success factors

Metrics to measure success

2 Plan to Shift to Level 1

The Purpose

Build strategy and identify specific opportunities to shift service support left to Level 1 through knowledge sharing and other methods.

Key Benefits Achieved

Identified initiatives to shift work to Level 1

Documented knowledge management process workflows and strategy

Activities

2.1 Identify barriers to Level 1 resolution

2.2 Discuss knowledgebase challenges and areas for improvement

2.3 Optimize KB input process

2.4 Optimize KB usage process

2.5 Optimize KB review process

2.6 Discuss and document KCS strategy and roles

2.7 Document knowledge success metrics

2.8 Brainstorm additional methods of increasing FLR

Outputs

KB input workflow

KB usage workflow

KB review workflow

KCS strategy and roles

Knowledge management metrics

Identified opportunities to shift to Level 1

3 Plan to Shift to End User and Automation

The Purpose

Build strategy and identify specific opportunities to shift service support left to the end user through self-service and to automation and AI.

Key Benefits Achieved

Identified initiatives to shift work to self-service and automation

Evaluation of self-service portal and identified opportunities for improvement

Activities

3.1 Review existing self-service portal and discuss vision

3.2 Identify opportunities to improve portal accessibility, UI, and features

3.3 Evaluate the user-facing knowledgebase

3.4 Optimize the ticket intake form

3.5 Document plan to improve, communicate, and evaluate portal

3.6 Map the user experience with a workflow

3.7 Document your AI strategy

3.8 Identify candidates for automation

Outputs

Identified opportunities to improve portal

Improvements to knowledgebase

Improved ticket intake form

Strategy to communicate and measure success of portal

Self-service resolution workflow

Strategy to apply AI and automation

Identified opportunities to shift tasks to automation

4 Build Implementation and Communication Plan

The Purpose

Build an action plan to implement shift left, including a communications strategy.

Key Benefits Achieved

Action plan to track and implement shift-left opportunities

Communications plan to increase adoption

Activities

4.1 Examine process workflows for shift-left opportunities

4.2 Document shift-left-specific responsibilities for each role

4.3 Identify and track shift-left opportunities in the action plan

4.4 Brainstorm objections and responses

4.5 Document communications plan

Outputs

Incident management workflow with shift-left opportunities

Shift left responsibilities for key roles

Shift-left action plan

Objection handling responses

Communications plan

Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management

  • Buy Link or Shortcode: {j2store}209|cart{/j2store}
  • member rating overall impact: N/A
  • member rating average dollars saved: N/A
  • member rating average days saved: N/A
  • Parent Category Name: Vendor Management
  • Parent Category Link: /vendor-management

  • Moreso than at any other time, our world is changing. As a result, organizations – and their vendors – need to be able to adapt their plans to accommodate risk on an unprecedented level.
  • It is increasingly likely that one of an organization's vendors, or their n-party support vendors, will cause an incident. Organizations must protect themselves by creating better mechanisms to hold their n-party vendors accountable and validate that they comply.

Our Advice

Critical Insight

  • Identifying and managing a vendor’s potential risk impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes may affect your organization.
  • Organizational leadership is often taken unaware by changes, and their plans lack the flexibility to adjust to significant regulatory upheavals.

Impact and Result

  • Vendor management practices educate organizations on the different potential risks from vendors in your market and suggest creative and alternative ways to avoid and help manage them.
  • Prioritize and classify your vendors with quantifiable, standardized rankings.
  • Prioritize focus on your high-risk vendors.
  • Standardize your processes for identifying and monitoring vendor risks with our Comprehensive Risk Impact Tool to manage potential impacts.

Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management Research & Tools

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management – Use the research to better understand the negative impacts of vendor actions to your organization

Use this research to identify and quantify the potential risk impacts caused by vendors. Utilize Info-Tech's approach to look at the impact from various perspectives to better prepare for issues that may arise.

  • Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management Storyboard

2. Comprehensive Risk Impact Tool – Use this tool to help identify and quantify the impacts of negative vendor actions.

By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

  • Comprehensive Risk Impact Tool
[infographic]

Further reading

Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management

Approach vendor risk impact assessments from all perspectives.

Analyst Perspective

Organizations must comprehensively understand the impacts vendors may cause through different potential actions.

Frank Sewell

The risks from the vendor market have become more prevalent as the technologies and organizational strategies shift to a global direction. With this shift in risk comes a necessary perspective change to align with the greater likelihood of an incident occurring from vendors' (or one of their downstream support vendor's) negative actions.

Organizational leadership must become more aware of the increasing risks that engaging vendors impose. To do so, they need to make informed decisions, which can only be provided by engaging expert resources in their organizations to compile a comprehensive look at potential risk impacts.

Frank Sewell

Research Director, Vendor Management
Info-Tech Research Group

Executive Summary

Your Challenge

More so than at any other time, our world is changing. As a result organizations – and their vendors – need to be able to adapt their plans to accommodate risk on an unprecedented level.

It is increasingly likely that one of your vendors, or their n-party support vendors, will cause an incident. Organizations must protect themselves by creating better mechanisms to hold their n-party vendors accountable and validate that they comply.

Common Obstacles

Identifying and managing a vendor’s potential risk impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes may affect your organization.

Organizational leadership is often taken unaware by changes, and their plans lack the flexibility to adjust to significant regulatory upheavals.

Info-Tech's Approach

Vendor management practices educate organizations on the different potential risks from vendors in your market and suggest creative and alternative ways to avoid and help manage them.

Prioritize and classify your vendors with quantifiable, standardized rankings.

Prioritize focus on your high-risk vendors.

Standardize your processes for identifying and monitoring vendor risks with our Comprehensive Risk Impact Tool to manage potential impacts.

Info-Tech Insight

Organizations must evolve their risk assessments to be more adaptive to respond to changes in the global market. Ongoing monitoring and continual assessment of vendors’ risks is crucial to avoiding negative impacts.

Info-Tech’s multi-blueprint series on vendor risk assessment

There are many individual components of vendor risk beyond cybersecurity.`

6 components of vendor risk beyond cybersecurity.  Financial, Reputational, Operational, Strategic, Security, Regulatory & Compliance.

This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

Out of Scope:
This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

The world is constantly changing

The IT market is constantly reacting to global influences. By anticipating changes, leaders can set expectations and work with their vendors to accommodate them.

When the unexpected happens, being able to adapt quickly to new priorities ensures continued long-term business success.

Below are some things no one expected to happen in the last few years:

62%

of IT professionals are more concerned about being a victim of ransomware than they were a year ago.

Info-Tech Tech Trends Survey 2022

82%

of Microsoft non-essential employees shifted to working from home in 2020, joining the 18% already remote.

Info-Tech Tech Trends Survey 2022

89%

of organizations invested in web conferencing technology to facilitate collaboration.

Info-Tech Tech Trends Survey 2022

Looking at Risk in a New Light:

the 6 Pillars of Vendor Risk Management

Vendor Risk

  • Financial

  • Strategic

  • Operational

  • Security

  • Reputational

  • Regulatory

  • Organizations must review their risk appetite and tolerance levels, considering their complete landscape.
  • Changing regulations, acquisitions, and events that affect global supply chains are current realities, not unlikely scenarios.
  • Prepare your vendor risk management for success using due diligence and scenario- based “What If” discussions to bring all the relevant parties to the table and educate your whole organization on risk factors.
Assessing Financial Risk Impacts

Strategic risks on a global scale

Odds are at least one of these is currently affecting your strategic plans

  • Vendor Acquisitions
  • Global Pandemic
  • Global Shortages
  • Gas Prices
  • Poor Vendor Performance
  • Travel Bans
  • War
  • Natural Disasters
  • Supply Chain Disruptions
  • Security Incidents

Make sure you have the right people at the table to identify and plan to manage impacts.

Assess internal and external operational risk impacts

Two sides of the same coin

Internal

  • Poorly vetted supplemental staff
  • Bad system configurations
  • Lack of relevant skills
  • Poor vendor performance
  • Failure to follow established processes
  • Weak contractual accountability
  • Unsupportable or end-of-life system components

External

  • Cyberattacks
  • Supply Chain Issues
  • Geo-Political Disruptions
  • Vendor Acquisitions
  • N-Party Non-Compliance
  • Vendor Fraud

Operational risk is the risk of losses caused by flawed or failed processes, policies, systems, or events that disrupt business operations.

Identify and manage security risk impacts on your organization

Due diligence will enable successful outcomes

  • Poor vendor performance
  • Vendor acquisition
  • Supply chain disruptions and shortages
  • N-party risk
  • Third-party risk

What your vendor associations say about you

Reputations that affect your brand: Bad customer reviews, breach of data, poor security posture, negative news articles, public lawsuits, poor performance.

Regulatory compliance

Consider implementing vendor management initiatives and practices in your organization to help gain compliance with your expanding vendor landscape.

Your organizational risks may be monitored but are your n-party vendors?

6 components of vendor risk beyond cybersecurity.  Financial, Reputational, Operational, Strategic, Security, Regulatory & Compliance.

Review your expectations with your vendors and hold them accountable

Regulatory entities are looking beyond your organization’s internal compliance these days. Instead, they are more and more diving into your third-party and downstream relationships, particularly as awareness of downstream breaches increases globally.

  • Are you assessing your vendors regularly?
  • Are you validating those assessments?
  • Do your vendors have a map of their downstream support vendors?
  • Do they have the mechanisms to hold those downstream vendors accountable to your standards?

Identify and manage risks

Regulatory

Regulatory agencies are putting more enforcement around ESG practices across the globe. As a result, organizations will need to monitor the changing regulations and validate that their vendors and n-party support vendors are adhering to these regulations or face penalties for non-compliance.

Security-Data protection

Data protection remains an issue. Organizations should ensure that the data their vendors obtain remains protected throughout the vendor’s lifecycle, including post-termination. Otherwise, they could be monitoring for a data breach in perpetuity.

Mergers and acquisitions

More prominent vendors continuously buy smaller companies to control the market in the IT industry. Organizations should put protections in their contracts to ensure that an IT vendor’s acquisition does not put them in a relationship with someone that could cause them an issue.

Identify and manage risks

Poor vendor performance

Consider the impact of a vendor that fails to perform midway through the implementation. Organizations need to be able to manage the impact of replacing that vendor and cutting their losses rather than continuing to throw good money away after bad performance.

Supply chain disruptions and global shortages

Geopolitical disruptions and natural disasters have caused unprecedented interruptions to business. Incorporate forecasting of product and ongoing business continuity planning into your strategic plans to adapt as events unfold.

Poorly configured systems

Failing to ensure that your vendor-supported systems are properly configured and that your vendors are meeting your IT change control and configuration standards is more commonplace than expected. Proper oversight and management of your support vendors is crucial to ensure they are meeting expectations in this regard.

What to look for

Identify potential risk impacts

  • Is there a record of complaints against the vendor from their employees or customers?
  • Is the vendor financially sound, with the resources to support your needs?
  • Has the vendor been cited for regulatory compliance issues in the past?
  • Does the vendor have a comprehensive list of their n-party vendor partners?
    • Are they willing to accept appropriate contractual protections regarding them?
  • Does the vendor self-audit, or do they use a vetted third-party audit firm to issue a SOC report annually?
  • Does the vendor operate in regions known for instability?
  • Is the vendor willing to make concessions on contractual protections, or are they only offering one-sided agreements with as-is warranties?

Prepare your vendor risk management for success

Due diligence will enable successful outcomes.

  1. Obtain top-level buy-in; it is critical to success.
  2. Build enterprise risk management (ERM) through incremental improvement.
  3. Focus initial efforts on the “big wins” to prove the process works.
  4. Use existing resources.
  5. Build on any risk management activities that already exist in the organization.
  6. Socialize ERM throughout the organization to gain additional buy-in.
  7. Normalize the process long term with ongoing updates and continuing education for the organization.
  8. (Adapted from COSO)

How to assess third-party risk

  1. Review organizational risks

    Understand the organizations risks to prepare for the “What If” game exercise.
  2. Identify and understand potential risks

    Play the “What If” game with the right people at the table.
  3. Create a risk profile packet for leadership

    Pull all the information together in a presentation document.
  4. Validate the risks

    Work with leadership to ensure that the proposed risks are in line with their thoughts.
  5. Plan to manage the risks

    Lower the overall risk potential by putting mitigations in place.
  6. Communicate the plan

    It is important not only to have a plan but also to socialize it in the organization for awareness.
  7. Enact the plan

    Once the plan is finalized and socialized, put it in place with continued monitoring for success.

Adapted from Harvard Law School Forum on Corporate Governance

Insight summary

Risk impacts often come from unexpected places and have significant consequences.

Knowing who your vendors are using for their support and supply chain could be crucial in eliminating the risk of non-compliance for your organization.

Having a plan to identify and validate the regulatory compliance of your vendors is a must for any organization to avoid penalties.

Insight 1

Organizations’ strategic plans need to be adaptable to avoid vendors’ negative actions causing an expedited shift in priorities.

For example, Philips’ recall of ventilators impacted its products and the availability of its competitors’ products as demand overwhelmed the market.

Insight 2

Organizations often fail to understand how n-party vendors could place them in non-compliance.

Even if you know your complete third-party vendor landscape, you may not be aware of the downstream vendors in play. Ensure that you get visibility into this space as well, and hold your direct vendors accountable for the actions of their vendors.

Insight 3

Organizations need to know where their data lives and ensure it is protected.

Make sure you know which vendors are accessing/storing your data, where they are keeping it, and that you can get it back and have the vendors destroy it when the relationship is over. Without adequate protections throughout the lifecycle of the vendor, you could be monitoring for breaches in perpetuity.

Insight summary

Assessing financial impacts is an ongoing, educative, and collaborative multidisciplinary process that vendor management initiatives are uniquely designed to coordinate and manage for organizations.

Operational risk impacts often come from unexpected places and have unforeseen impacts. Knowing where your vendors place in critical business processes and those vendors' business continuity plans concerning your organization should be a priority for those managing the vendors.

Insight 4

Organizations need to learn how to assess the likelihood of potential risks in the rapidly changing online environments and recognize how their partnerships and subcontractors’ actions can affect their brand.

For example, do you understand how a simple news article raises your profile for short-term and long-term adverse events?

Insight 5

Organizations fail to plan for vendor acquisitions appropriately.

Vendors routinely get acquired in the IT space. Does your organization have appropriate safeguards from inadvertently entering a negative relationship? Do you have plans for replacing critical vendors purchased in such a manner?

Insight 6

Vendors are becoming more and more crucial to organizations’ overall operations, and most organizations have a poor understanding of the potential impacts they represent.

Is your vendor solvent? Do they have enough staff to accommodate your needs? Has their long-term planning been affected by changes in the market? Are they unique in their space?

Identifying vendor risk

Who should be included in the discussion?

  • While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make informed decisions.
  • Getting input from operational experts at your organization will enhance your business's long-term potential for success.
  • Involving those who directly manage vendors and understand the market will aid operational experts in determining the forward path for relationships with your current vendors and identifying emerging potential strategic partners.
  • Make sure security, risk, and compliance are all at the table. These departments all look at risk from different angles for the business and give valuable insight collectively.
  • Organizations have a wealth of experience in their marketing departments that can help identify real-world scenarios of negative actions.

See the blueprint Build an IT Risk Management Program

Review your risk management plans for new risks on a regular basis.

Keep in mind Risk =
Likelihood x Impact

(R=L*I).

Impact (I) tends to remain the same, while Likelihood (L) is becoming closer to 100% as threat actors become more prevalent.

Managing vendor risk impacts

How could your vendors impact your organization?

  • Review vendors’ downstream connections to understand thoroughly who you are in business with
  • Institute continuous vendor lifecycle management
  • Develop IT risk governance and change control
  • Introduce continual risk assessment to monitor the relevant vendor markets
  • Monitor and schedule contract renewals and new service/module negotiations
  • Perform business alignment meetings to reassess relationships
  • Ensure strategic alignment in contracts
  • Review vendors’ business continuity plans and disaster recovery testing
  • Re-evaluate corporate policies frequently
  • Monitor your company’s and associated vendors’ online presence
  • Be adaptable and allow for innovations that arise from the current needs
    • Capture lessons learned from prior incidents to improve over time, and adjust your plans accordingly

Organizations must review their risk appetite and tolerance levels, considering their complete landscape.

Changing regulations, acquisitions, new security issues, and events that affect global supply chains are current realities, not unlikely scenarios.

Ongoing Improvement

Incorporating lessons learned.

  • Over time, despite everyone’s best observations and plans, incidents will catch us off guard.
  • When that happens, follow your incident response plans and act accordingly.
  • An essential step is to document what worked and what did not – collectively known as the “lessons learned.”
  • Use the lessons learned document to devise, incorporate, and enact a better risk management process.

Sometimes disasters occur despite our best plans to manage them.

When this happens, it is important to document the lessons learned and improve our plans going forward.

The "what if" game

1-3 hours

Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible adverse outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

  1. Break into smaller groups (if too small, continue as a single group).
  2. Use the Comprehensive Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potentials but manage the overall process to keep the discussion pertinent and on track.
  3. Collect the outputs and ask the subject matter experts (SMEs) for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

Download the Comprehensive Risk Impact Tool

Input

  • List of identified potential risk scenarios scored by impact
  • List of potential mitigations of the scenarios to reduce the risk

Output

  • Comprehensive risk profile on the specific vendor solution

Materials

  • Whiteboard/flip charts
  • Comprehensive Risk Impact Tool to help drive discussion

Participants

  • Vendor Management – Coordinator
  • Organizational Leadership
  • Operations Experts (SMEs)
  • Business Process Experts
  • Legal/Compliance/Risk Manager

High risk example from tool

High risk example from Tool.  Shows sample questions to ask to identify impacts, their associated score, weight, and comments or notes.

Note: Even though a few items are “scored” they have not been added to the overall weight, signaling that the company has noted but does not necessarily hold them against the vendor.

How to mitigate:

  • Contractually insist that the vendor have a third-party security audit performed annually with the stipulation that they will not denigrate below your acceptable standards.
  • At renewal negotiate better contractual terms and protections for your organization.

Low risk example from tool

Low risk example from Tool.  Shows sample questions to ask to identify impacts, their associated score, weight, and comments or notes.

Summary

Seek to understand all potential risk impacts to better prepare your organization for success.

  • Organizations need to understand and map out their entire vendor landscape.
  • Understand where all your data lives and how you can control it throughout the vendor lifecycle.
  • Organizations need to be realistic about the likelihood of potential risks in the changing global world.
  • Those organizations that consistently follow their established risk-assessment and due-diligence processes are better positioned to avoid penalties.
  • Understand how your vendors prioritize your organization in their business continuity processes.
  • Bring the right people to the table to outline potential risks in the market and your organization.
  • Socialize the third-party vendor risk management process throughout the organization to heighten awareness and enable employees to help protect the organization.
  • Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
  • Incorporate lessons learned from prior incidents into your risk management process to build better plans for future issues.

Organizations must evolve their risk assessments to be more meaningful to respond to global changes in the market.

Organizations should increase the resources dedicated to monitoring the market as regulatory agencies continue to hold them more and more accountable.

Bibliography

Olaganathan, Rajee. “Impact of COVID-19 on airline industry and strategic plan for its recovery with special reference to data analytics technology.” Global Journal of Engineering and Technology Advances, vol 7, no 1, 2021, pp. 033-046.

Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012.

Frigo, Mark L., and Richard J. Anderson. “Embracing Enterprise Risk Management: Practical Approaches for Getting Started.” COSO, 2011.

Weak Cybersecurity is taking a toll on Small Businesses (tripwire.com)

SecureLink 2022 White Paper SL_Page_EA+PAM (rocketcdn.me)

Shared Assessments Member Poll March 2021 "Guide: Evolving Work Environments Impact of Covid-19 on Profile and Management of Third Parties“

“Cybersecurity only the tip of the iceberg for third-party risk management”. Help Net Security, April 21, 2021. Accessed: 2022-07-29.

“Third-Party Risk Management (TPRM) Managed Services”. Deloitte, 2022. Accessed: 2022-07-29.

“The Future of TPRM: Third Party Risk Management Predictions for 2022”. OneTrust, December 20th2021. Accessed 2022-07-29.

“Third Party Vendor definition”. Law Insider, Accessed 2022-07-29.

“Third Party Risk”. AWAKE Security, Accessed 2022-07-29.

Glidden, Donna. "Don't Underestimate the Need to Protect Your Brand in Publicity Clauses", Info-Tech Research Group, June 2022.

Greenaway, Jordan. "Managing Reputation Risk: A start-to-finish guide", Transmission Private, July 2022. Accessed June 2022.

Jagiello, Robert D, and Thomas T Hills. “Bad News Has Wings: Dread Risk Mediates Social Amplification in Risk Communication. ”Risk analysis : an official publication of the Society for Risk Analysis vol. 38,10 (2018): 2193-2207.doi:10.1111/risa.13117

Kenton, Will. "Brand Recognition", Investopedia, August 2021. Accessed June 2022. Lischer, Brian. "How Much Does it Cost to Rebrand Your Company?", Ignyte, October 2017. Accessed June 2022.

"Powerful Examples of How to Respond to Negative Reviews", Review Trackers, February 2022. Accessed June 2022.

"The CEO Reputation Premium: Gaining Advantage in the Engagement Era", Weber Shadwick, March 2015. Accessed on June 2022.

"Valuation of Trademarks: Everything You Need to Know",UpCounsel, 2022. Accessed June 2022.

Related Info-Tech Research

Identify and Manage Financial Risk Impacts on Your Organization

  • Vendor management practices educate organizations on potential financial impacts that vendors may incur and suggest systems to help manage them.
  • Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

Identify and Manage Reputational Risk Impacts on Your Organization

  • Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
  • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

Identify and Manage Strategic Risk Impacts on Your Organization

  • Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
  • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your strategic plan with our Strategic Risk Impact Tool.

Regulatory guidance and industry standards

Improve Application Development Throughput

  • Buy Link or Shortcode: {j2store}151|cart{/j2store}
  • member rating overall impact: 10.0/10 Overall Impact
  • member rating average dollars saved: $59,399 Average $ Saved
  • member rating average days saved: 39 Average Days Saved
  • Parent Category Name: Development
  • Parent Category Link: /development
  • The business is demanding more features at an increasing pace. It is expecting your development teams to keep up with its changing needs while maintaining high quality.
  • However, your development process is broken. Tasks are taking significant time to complete, and development handoffs are not smooth.

Our Advice

Critical Insight

  • Lean development is independent of your software development lifecycle (SDLC) methodology. Lean development practices can be used in both Agile and Waterfall teams.
  • Lean isn’t about getting rid of sound development processes. Becoming lean means fine-tuning the integration of core practices like coding and testing.
  • Lean thinking motivates automation. By focusing on optimizing the development process, automation becomes a logical and necessary step toward greater maturity and improved throughput.

Impact and Result

  • Gain a deep understanding of lean principles and associated behaviors. Become familiar with the core lean principles and the critical attitudes and mindsets required by lean. Understand how incorporating DevOps and Agile principles can help your organization.
  • Conduct a development process and tool review. Use a value-stream analysis of your current development process and tools to reveal bottlenecks and time-consuming or wasteful tasks. Analyze these insights to identify root causes and the impact to product delivery.
  • Incorporate the right tools and practices to become more lean. Optimize the key areas where you are experiencing the most pain and consuming the most resources. Look at how today’s best development and testing practices (e.g. version control, branching) and tools (e.g. automation, continuous integration) can improve the throughput of your delivery pipeline.

Improve Application Development Throughput Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should make development teams leaner, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Conduct a current state analysis

Acquire a holistic perspective of the development team, process, and tools to identify the bottlenecks and inefficiency points that are significantly delaying releases.

  • Improve Application Development Throughput – Phase 1: Conduct a Current State Analysis
  • Lean Implementation Roadmap Template
  • Lean Development Readiness Assessment

2. Define the lean future state

Identify the development guiding principles and artifact management practices and build automation and continuous integration processes and tools that best fit the context and address the organization’s needs.

  • Improve Application Development Throughput – Phase 2: Define the Lean Future State

3. Create an implementation roadmap

Prioritize lean implementation initiatives in a gradual, phased approach and map the critical stakeholders in the lean transformation.

  • Improve Application Development Throughput – Phase 3: Create an Implementation Roadmap
[infographic]

Workshop: Improve Application Development Throughput

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Conduct a Current State Analysis

The Purpose

Assess the current state of your development environment.

Select a pilot project to demonstrate the value of your optimization.

Key Benefits Achieved

Realization of the root causes behind the bottlenecks and inefficiencies in your current development process.

Valuation of your current development tools.

Selection of a pilot project that will be used to gather the metrics in order obtain buy-in for wider optimization initiatives.

Activities

1.1 Assess your readiness to transition to lean development.

1.2 Conduct a SWOT analysis and value-stream assessment of your current development process.

1.3 Evaluate your development tools.

1.4 Select a pilot project.

Outputs

Lean development readiness assessment

Current state analysis of development process

Value assessment of existing development tools

Pilot project selection

2 Define Your Lean Future State

The Purpose

Establish your development guiding principles.

Enhance the versioning and management of your development artifacts.

Automatically build and continuously integrate your code.

Key Benefits Achieved

Grounded and well-understood set of guiding principles that are mapped to development tasks and initiatives.

Version control strategy of development artifacts, including source code, adapted to support lean development.

A tailored approach to establish the right environment to support automated build, testing, and continuous integration tools.

Activities

2.1 Assess your alignment to the lean principles.

2.2 Define your lean development guiding principles.

2.3 Define your source code branching approach.

2.4 Define your build automation approach.

2.5 Define your continuous integration approach.

Outputs

Level of alignment to lean principles

Development guiding principles

Source code branching approach

Build automation approach.

Continuous integration approach

3 Create Your Implementation Roadmap

The Purpose

Prioritize your optimization initiatives to build an implementation roadmap.

Identify the stakeholders of your lean transformation.

Key Benefits Achieved

Phased implementation roadmap that accommodates your current priorities, constraints, and enablers.

Stakeholder engagement strategy to effectively demonstrate the value of the optimized development environment.

Activities

3.1 Identify metrics to gauge the success of your lean transformation.

3.2 List and prioritize your implementation steps.

3.3 Identify the stakeholders of your lean transformation.

Outputs

List of product, process, and tool metrics

Prioritized list of tasks to optimize your development environment

Identification of key stakeholders

Deliver Digital Products at Scale

  • Buy Link or Shortcode: {j2store}156|cart{/j2store}
  • member rating overall impact: 10.0/10 Overall Impact
  • member rating average dollars saved: $86,499 Average $ Saved
  • member rating average days saved: 53 Average Days Saved
  • Parent Category Name: Development
  • Parent Category Link: /development
  • Products are the lifeblood of an organization. They provide the capabilities the business needs to deliver value to both internal and external customers and stakeholders.
  • Product organizations are expected to continually deliver evolving value to the overall organization as they grow.
  • You need to clearly convey the direction and strategy of a broad product portfolio to gain alignment, support, and funding from your organization.

Our Advice

Critical Insight

  • Product delivery requires significant shifts in the way you complete development work and deliver value to your users. Make the changes that improve end-user value and enterprise alignment.
  • Your organizational goals and strategy are achieved through capabilities that deliver value. Your product hierarchy is the mechanism to translate enterprise goals, priorities, and constraints down to the product level where changes can be made.
  • Recognize that each product owner represents one of three primary perspectives: business, technical, and operational. Although all share the same capabilities, how they approach their responsibilities is influenced by their perspective.
  • The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.
  • Your product family roadmap and product roadmap tell different stories. The product family roadmap represents the overall connection of products to the enterprise strategy, while the product roadmap focuses on the fulfillment of the product’s vision.
  • Although products can be delivered with any software development lifecycle, methodology, delivery team structure, or organizational design, high-performing product teams optimize their structure to fit the needs of product and product family delivery.

Impact and Result

  • Understand the importance of product families for scaling product delivery.
  • Define products in your context and organize products into operational families.
  • Use product family roadmaps to align product roadmaps to enterprise goals and priorities.
  • Evaluate the different approaches to improve your product family delivery pipelines and milestones.

Deliver Digital Products at Scale Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should define enterprise product families to scale your product delivery capability, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Become a product-centric organization

Define products in your organization’s context and explore product families as a way to organize products at scale.

  • Deliver Digital Products at Scale – Phase 1: Become a Product-Centric Organization
  • Deliver Digital Products at Scale Workbook
  • Digital Product Family Strategy Playbook

2. Organize products into product families

Identify an approach to group the inventory of products into one or more product families.

  • Deliver Digital Products at Scale – Phase 2: Organize Products Into Product Families

3. Ensure alignment between products and families

Confirm alignment between your products and product families via the product family roadmap and a shared definition of delivered value.

  • Deliver Digital Products at Scale – Phase 3: Ensure Alignment Between Products and Families

4. Bridge the gap between product families and delivery

Agree on a delivery approach that best aligns with your product families.

  • Deliver Digital Products at Scale – Phase 4: Bridge the Gap Between Product Families and Delivery
  • Deliver Digital Products at Scale Readiness Assessment

5. Build your transformation roadmap and communication plan

Define your communication plan and transformation roadmap for transitioning to delivering products at the scale of your organization.

  • Deliver Digital Products at Scale – Phase 5: Transformation Roadmap and Communication

Infographic

Workshop: Deliver Digital Products at Scale

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Become a Product-Centric Organization

The Purpose

Define products in your organization’s context and explore product families as a way to organize products at scale.

Key Benefits Achieved

An understanding of the case for product practices

A concise definition of products and product families

Activities

1.1 Understand your organizational factors driving product-centric delivery.

1.2 Establish your organization’s product inventory.

1.3 Determine your approach to scale product families.

Outputs

Organizational drivers and goals for a product-centric delivery

Definition of product

Product scaling principles

Scaling approach and direction

Pilot list of products to scale

2 Organize Products Into Product Families

The Purpose

Identify a suitable approach to group the inventory of products into one or more product families.

Key Benefits Achieved

A scaling approach for products that fits your organization

Activities

2.1 Define your product families.

Outputs

Product family mapping

Enabling applications

Dependent applications

Product family canvas

3 Ensure Alignment Between Products and Families

The Purpose

Confirm alignment between your products and product families via the product family roadmap and a shared definition of delivered value.

Key Benefits Achieved

Recognition of the product family roadmap and a shared definition of value as key concepts to maintain alignment between your products and product families

Activities

3.1 Leverage product family roadmaps.

3.2 Use stakeholder management to improve roadmap communication.

3.3 Configure your product family roadmaps.

3.4 Confirm product family to product alignment.

Outputs

Current approach for communication of product family strategy

List of product family stakeholders and a prioritization plan for communication

Defined key pieces of a product family roadmap

An approach to confirming alignment between products and product families through a shared definition of business value

4 Bridge the Gap Between Product Families and Delivery

The Purpose

Agree on the delivery approach that best aligns with your product families.

Key Benefits Achieved

An understanding of the team configuration and operating model required to deliver value through your product families

Activities

4.1 Assess your organization’s delivery readiness.

4.2 Understand your delivery options.

4.3 Determine your operating model.

4.4 Identify how to fund product delivery.

4.5 Learn how to introduce your digital product family strategy.

4.6 Communicate changes on updates to your strategy.

4.7 Determine your next steps.

Outputs

Assessment results on your organization’s delivery maturity

A preferred approach to structuring product delivery

Your preferred operating model for delivering product families

Understanding of your preferred approach for product family funding

Product family transformation roadmap

Your plan for communicating your roadmap

List of actionable next steps to start on your journey

5 Advisory: Next Steps and Wrap-Up (offsite)

The Purpose

Implement your communication plan and transformation roadmap for transitioning to delivering products at the scale of your organization.

Key Benefits Achieved

New product family organization and supporting product delivery approach

Activities

5.1 Execute communication plan and product family changes.

5.2 Review the pilot family implementation and update the transformation roadmap.

5.3 Begin advisory calls for related blueprints.

Outputs

Organizational communication of product families and product family roadmaps

Product family implementation and updated transformation roadmap

Support for product owners, backlog and roadmap management, and other topics

Further reading

Deliver Digital Products at Scale

Deliver value at the scale of your organization through defining enterprise product families.

Analyst Perspective

Product families align enterprise goals to product changes and value realization.

A picture of Info-Tech analyst Banu Raghuraman. A picture of Info-Tech analyst Ari Glaizel. A picture of Info-Tech analyst Hans Eckman

Our world is changing faster than ever, and the need for business agility continues to grow. Organizations are shifting from long-term project delivery to smaller, iterative product delivery models to be able to embrace change and respond to challenges and opportunities faster.

Unfortunately, many organizations focus on product delivery at the tactical level. Product teams may be individually successful, but how well are their changes aligned to division and enterprise goals and priorities?

Grouping products into operationally aligned families is key to delivering the right value to the right stakeholders at the right time.

Product families translate enterprise goals, constraints, and priorities down to the individual product level so product owners can make better decisions and more effectively manage their roadmaps and backlogs. By scaling products into families and using product family roadmaps to align product roadmaps, product owners can deliver the capabilities that allow organizations to reach their goals.

In this blueprint, we’ll provide the tools and guidance to help you define what “product” means to your organization, use scaling patterns to build product families, align product and product family roadmaps, and identify impacts to your delivery and organizational design models.

Banu Raghuraman, Ari Glaizel, and Hans Eckman

Applications Practice

Info-Tech Research Group

Deliver Digital Products at Scale

Deliver value at the scale of your organization through defining enterprise product families.

EXECUTIVE BRIEF

Executive Summary

Your Challenge

  • Products are the lifeblood of an organization. They deliver the capabilities needed to deliver value to customers, internal users, and stakeholders.
  • The shift to becoming a product organization is intended to continually increase the value you provide to the broader organization as you grow and evolve.
  • You need to clearly convey the direction and strategy of your product portfolio to gain alignment, support, and funding from your organization.

Common Obstacles

  • IT organizations are traditionally organized to deliver initiatives in specific periods of time. This conflicts with product delivery, which continuously delivers value over the lifetime of a product.
  • Delivering multiple products together creates additional challenges because each product has its own pedigree, history, and goals.
  • Product owners struggle to prioritize changes to deliver product value. This creates a gap and conflict between product and enterprise goals.

Info-Tech’s Approach

Info-Tech’s approach will guide you through:

  • Understanding the importance of product families in scaling product delivery.
  • Defining products in your context and organizing products into operational families.
  • Using product family roadmaps to align product roadmaps to enterprise goals and priorities.
  • Evaluating the different approaches to improve your product family delivery pipelines and milestones.

Info-Tech Insight

Changes can only be made at the individual product or service level. To achieve enterprise goals and priorities, organizations needed to organize and scale products into operational families. This structure allows product managers to translate goals and constraints to the product level and allows product owners to deliver changes that support enabling capabilities. In this blueprint, we’ll help you define your products, scale them using the best patterns, and align your roadmaps and delivery models to improve throughput and value delivery.

Info-Tech’s approach

Operationally align product delivery to enterprise goals

A flowchart is shown on how to operationally align product delivery to enterprise goals.

The Info-Tech difference:

  1. Start by piloting product families to determine which approaches work best for your organization.
  2. Create a common definition of what a product is and identify products in your inventory.
  3. Use scaling patterns to build operationally aligned product families.
  4. Develop a roadmap strategy to align families and products to enterprise goals and priorities.
  5. Use products and families to evaluate delivery and organizational design improvements.

Deliver Digital Products at Scale via Enterprise Product Families

An infographic on the Enterprise Product Families is shown.

Product does not mean the same thing to everyone

Do not expect a universal definition of products.

Every organization and industry has a different definition of what a product is. Organizations structure their people, processes, and technologies according to their definition of the products they manage. Conflicting product definitions between teams increase confusion and misalignment of product roadmaps.

“A product [is] something (physical or not) that is created through a process and that provides benefits to a market.”

- Mike Cohn, Founding Member of Agile Alliance and Scrum Alliance

“A product is something ... that is created and then made available to customers, usually with a distinct name or order number.”

- TechTarget

“A product is the physical object ... , software or service from which customer gets direct utility plus a number of other factors, services, and perceptions that make the product useful, desirable [and] convenient.”

- Mark Curphey

Organizations need a common understanding of what a product is and how it pertains to the business. This understanding needs to be accepted across the organization.

“There is not a lot of guidance in the industry on how to define [products]. This is dangerous because what will happen is that product backlogs will be formed in too many areas. All that does is create dependencies and coordination across teams … and backlogs.”

– Chad Beier, "How Do You Define a Product?” Scrum.org

What is a product?

“A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements.”

Info-Tech Insight

A proper definition of product recognizes three key facts:

  1. Products are long-term endeavors that don’t end after the project finishes.
  2. Products are not just “apps” but can be software or services that drive the delivery of value.
  3. There is more than one stakeholder group that derives value from the product or service.

Products and services share the same foundation and best practices

For the purpose of this blueprint, product/service and product owner/service owner are used interchangeably. Product is used for consistency but would apply to services as well.

Product = Service

“Product” and “service” are terms that each organization needs to define to fit its culture and customers (internal and external). The most important aspect is consistent use and understanding of:

  • External products
  • Internal products
  • External services
  • Internal services
  • Products as a service (PaaS)
  • Productizing services (SaaS)

Recognize the different product owner perspectives

Business:

  • Customer facing, revenue generating

Technical:

  • IT systems and tools

Operations:

  • Keep the lights on processes

Info-Tech Best Practice

Product owners must translate needs and constraints from their perspective into the language of their audience. Kathy Borneman, Digital Product Owner at SunTrust Bank, noted the challenges of finding a common language between lines of business and IT (e.g. what is a unit?).

Info-Tech Insight

Recognize that product owners represent one of three primary perspectives. Although all share the same capabilities, how they approach their responsibilities is influenced by their perspective.

“A Product Owner in its most beneficial form acts like an Entrepreneur, like a 'mini-CEO'. The Product Owner is someone who really 'owns' the product.”

– Robbin Schuurman, “Tips for Starting Product Owners”

Identify the differences between a project-centric and a product-centric organization

Project

Product

Fund projects

Funding

Fund products or teams

Line of business sponsor

Prioritization

Product owner

Makes specific changes to a product

Product management

Improve product maturity and support

Assign people to work

Work allocation

Assign work to product teams

Project manager manages

Capacity management

Team manages capacity

Info-Tech Insight

Product delivery requires significant shifts in the way you complete development work and deliver value to your users. Make the changes that support improving end-user value and enterprise alignment.

Projects can be a mechanism for delivering product changes and improvements

A flowchart is shown to demonstrate the difference between project lifecycle, hybrid lifecycle and product lifecycle.

Projects within products

Regardless of whether you recognize yourself as a product-based or project-based shop, the same basic principles should apply. The purpose of projects is to deliver the scope of a product release. The shift to product delivery leverages a product roadmap and backlog as the mechanism for defining and managing the scope of the release. Eventually, teams progress to continuous integration/continuous delivery (CI/CD) where they can release on demand or as scheduled, requiring org change management.

Define product value by aligning backlog delivery with roadmap goals

In each product plan, the backlogs show what you will deliver. Roadmaps identify when and in what order you will deliver value, capabilities, and goals.

An image is shown to demonstrate the relationship between the product backlog and the product roadmap.

Product roadmaps guide delivery and communicate your strategy

In Deliver on Your Digital Product Vision, we demonstrate how the product roadmap is core to value realization. The product roadmap is your communicated path, and as a product owner, you use it to align teams and changes to your defined goals while aligning your product to enterprise goals and strategy.

An example of a product roadmap is shown to demonstrate how it is the core to value realization.

Adapted from: Pichler, "What Is Product Management?""

Info-Tech Insight

The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.

Use Agile DevOps principles to expedite product-centric delivery and management

Delivering products does not necessarily require an Agile DevOps mindset. However, Agile methods facilitate the journey because product thinking is baked into them.

A flowchart is shown to demonstrate the product deliery maturity and the Agile DevOps used.
Based on: Ambysoft, 2018

Organizations start with Waterfall to improve the predictable delivery of product features.

Iterative development shifts the focus from delivery of features to delivery of user value.

Agile further shifts delivery to consider ROI. Often, the highest-value backlog items aren’t the ones with the highest ROI.

Lean and DevOps improve your delivery pipeline by providing full integration between product owners, development teams, and operations.

CI/CD reduces time in process by allowing release on demand and simplifying release and support activities.

Although teams will adopt parts of all these stages during their journey, it isn’t until you’ve adopted a fully integrated delivery chain that you’ve become product centric.

Scale products into related families to improve value delivery and alignment

Defining product families builds a network of related products into coordinated value delivery streams.

A flowchart is shown to demonstrate the relations between product family and the delivery streams.

“As with basic product management, scaling an organization is all about articulating the vision and communicating it effectively. Using a well-defined framework helps you align the growth of your organization with that of the company. In fact, how the product organization is structured is very helpful in driving the vision of what you as a product company are going to do.”

– Rich Mironov, Mironov Consulting

Product families translate enterprise goals into value-enabling capabilities

A flowchart is shown to demonstrate the relationship between enterprise strategy and enabling capabilities.

Info-Tech Insight

Your organizational goals and strategy are achieved through capabilities that deliver value. Your product hierarchy is the mechanism to translate enterprise goals, priorities, and constraints down to the product level where changes can be made.

Arrange product families by operational groups, not solely by your org chart

A flowchart is shown to demonstrate how to arrange product families by operational groups.

1. To align product changes with enterprise goals and priorities, you need to organize your products into operational groups based on the capabilities or business functions the product and family support.

2. Product managers translate these goals, priorities, and constraints into their product families, so they are actionable at the next level, whether that level is another product family or products implementing enhancements to meet these goals.

3. The product family manager ensures that the product changes enhance the capabilities that allow you to realize your product family, division, and enterprise goals.

4. Enabling capabilities realize value and help reach your goals, which then drives your next set of enterprise goals and strategy.

Approach alignment from both directions, validating by the opposite way

Defining your product families is not a one-way street. Often, we start from either the top or the bottom depending on our scaling principles. We use multiple patterns to find the best arrangement and grouping of our products and families.

It may be helpful to work partway, then approach your scaling from the opposite direction, meeting in the middle. This way you are taking advantage of the strengths in both approaches.

Once you have your proposed structure, validate the grouping by applying the principles from the opposite direction to ensure each product and family is in the best starting group.

As the needs of your organization change, you may need to realign your product families into your new business architecture and operational structure.

A top-down alignment example is shown.

When to use: You have a business architecture defined or clear market/functional grouping of value streams.

A bottom-up alignment example is shown.

When to use: You are starting from an Application Portfolio Management application inventory to build or validate application families.

Leverage patterns for scaling products

Organizing your products and families is easier when leveraging these grouping patterns. Each is explained in greater detail on the following slides

Value Stream Alignment

Enterprise Applications

Shared Services

Technical

Organizational Alignment

  • Business architecture
    • Value stream
    • Capability
    • Function
  • Market/customer segment
  • Line of business (LoB)
  • Example: Customer group > value stream > products
  • Enabling capabilities
  • Enterprise platforms
  • Supporting apps
  • Example: HR > Workday/Peoplesoft > ModulesSupporting: Job board, healthcare administrator
  • Organization of related services into service family
  • Direct hierarchy does not necessarily exist within the family
  • Examples: End-user support and ticketing, workflow and collaboration tools
  • Domain grouping of IT infrastructure, platforms, apps, skills, or languages
  • Often used in combination with Shared Services grouping or LoB-specific apps
  • Examples: Java, .NET, low-code, database, network
  • Used at higher levels of the organization where products are aligned under divisions
  • Separation of product managers from organizational structure no longer needed because the management team owns product management role

Leverage the product family roadmap for alignment

It’s more than a set of colorful boxes. It’s the map to align everyone to where you are going.

Your product family roadmap

    ✓ Lays out a strategy for your product family.

    ✓ Is a statement of intent for your family of products.

    ✓ Communicates direction for the entire product family and product teams.

    ✓ Directly connects to the organization’s goals.

However, it is not:

    x Representative of a hard commitment.

    x A simple combination of your current product roadmaps.

Before connecting your family roadmap to products, think about what each roadmap typically presents

An example of a product family roadmap is shown and how it can be connected to the products.

Info-Tech Insight

Your product family roadmap and product roadmap tell different stories. The product family roadmap represents the overall connection of products to the enterprise strategy, while the product roadmap focuses on the fulfillment of the product’s vision.

Product family roadmaps are more strategic by nature

While individual product roadmaps can be different levels of tactical or strategic depending on a variety of market factors, your options are more limited when defining roadmaps for product families.

Product

TACTICAL

A roadmap that is technical, committed, and detailed.

Product Family

STRATEGIC

A roadmap that is strategic, goal based, high level, and flexible.

Info-Tech Insight

Roadmaps for your product family are, by design, less detailed. This does not mean they aren’t actionable! Your product family roadmap should be able to communicate clear intentions around the future delivery of value in both the near and long term.

Consider volatility when structuring product family roadmaps

A roadmap is shown without any changes.

There is no such thing as a roadmap that never changes.

Your product family roadmap represents a broad statement of intent and high-level tactics to get closer to the organization’s goals.

A roadmap is shown with changes.

All good product family roadmaps embrace change!

Your strategic intentions are subject to volatility, especially those planned further in the future. The more costs you incur in planning, the more you leave yourself exposed to inefficiency and waste if those plans change.

Info-Tech Insight

A good product family roadmap is intended to manage and communicate the inevitable changes as a result of market volatility and changes in strategy.

Product delivery realizes value for your product family

While planning and analysis are done at the family level, work and delivery are done at the individual product level.

PRODUCT STRATEGY

What are the artifacts?

What are you saying?

Defined at the family level?

Defined at the product level?

Vision

I want to...

Strategic focus

Delivery focus

Goals

To get there we need to...

Roadmap

To achieve our goals, we’ll deliver...

Backlog

The work will be done in this order...

Release Plan

We will deliver in the following ways...

Typical elements of a product family roadmap

While there are others, these represent what will commonly appear across most family-based roadmaps.

An example is shown to highlight the typical elements of a product family roadmap.

GROUP/CATEGORY: Groups are collections of artifacts. In a product family context, these are usually product family goals, value streams, or products.

ARTIFACT: An artifact is one of many kinds of tangible by-products produced during the delivery of products. For a product family, the artifacts represented are capabilities or value streams.

MILESTONE: Points in the timeline when established sets of artifacts are complete. This is a critical tool in the alignment of products in a given family.

TIME HORIZON: Separated periods within the projected timeline covered by the roadmap.

Connecting your product family roadmaps to product roadmaps

Your product and product family roadmaps should be connected at an artifact level that is common between both. Typically, this is done with capabilities, but it can be done at a more granular level if an understanding of capabilities isn’t available.

An example is shown on how the product family roadmpas can be connected to the product roadmaps.

Multiple roadmap views can communicate differently, yet tell the same truth

Audience

Business/ IT Leaders

Users/Customers

Delivery Teams

Roadmap View

Portfolio

Product Family

Technology

Objectives

To provide a snapshot of the portfolio and priority products

To visualize and validate product strategy

To coordinate broad technology and architecture decisions

Artifacts

Line items or sections of the roadmap are made up of individual products, and an artifact represents a disposition at its highest level.

Artifacts are generally grouped by product teams and consist of strategic goals and the features that realize those goals.

Artifacts are grouped by the teams who deliver that work and consist of technical capabilities that support the broader delivery of value for the product family.

Your communication objectives are linked to your audience; ensure you know your audience and speak their language

I want to...

I need to talk to...

Because they are focused on...

ALIGN PRODUCT TEAMS

Get my delivery teams on the same page.

Architects

Products Owners

PRODUCTS

A product that delivers value against a common set of goals and objectives.

SHOWCASE CHANGES

Inform users and customers of product strategy.

Bus. Process Owners

End Users

FUNCTIONALITY

A group of functionality that business customers see as a single unit.

ARTICULATE RESOURCE REQUIREMENTS

Inform the business of product development requirements.

IT Management

Business Stakeholders

FUNDING

An initiative that those with the money see as a single budget.

Assess the impacts of product-centric delivery on your teams and org design

Product delivery can exist within any org structure or delivery model. However, when making the shift toward product management, consider optimizing your org design and product team structure to match your capacity and throughput needs.

A flowchart is shown to see how the impacts of product-centric delivery can impact team and org designs.

Determine which delivery team structure best fits your product pipeline

Four delivery team structures are shown. The four are: functional roles, shared service and resource pools, product or system, and skills and competencies.

Weigh the pros and cons of IT operating models to find the best fit

There are many different operating models. LoB/Product Aligned and Hybrid Functional align themselves most closely with how products and product families are typically delivered.

  1. LoB/Product Aligned – Decentralized Model: Line of Business, Geographically, Product, or Functionally Aligned
  2. A decentralized IT operating model that embeds specific functions within LoBs/product teams and provides cross-organizational support for their initiatives.

  3. Hybrid Functional: Functional/Product Aligned
  4. A best-of-both-worlds model that balances the benefits of centralized and decentralized approaches to achieve both customer responsiveness and economies of scale.

  5. Hybrid Service Model: Product-Aligned Operating Model
  6. A model that supports what is commonly referred to as a matrix organization, organizing by highly related service categories and introducing the role of the service owner.

  7. Centralized: Plan-Build-Run
  8. A highly typical IT operating model that focuses on centralized strategic control and oversight in delivering cost-optimized and effective solutions.

  9. Centralized: Demand-Develop-Service
  10. A centralized IT operating model that lends well to more mature operating environments. Aimed at leveraging economies of scale in an end-to-end services delivery model.

Consider how investment spending will differ in a product environment

Reward for delivering outcomes, not features

Autonomy

Flexibility

Accountability

Fund what delivers value

Allocate iteratively

Measure and adjust

Fund long-lived delivery of value through products (not projects).

Give autonomy to the team to decide exactly what to build.

Allocate to a pool based on higher-level business case.

Provide funds in smaller amounts to different product teams and initiatives based on need.

Product teams define metrics that contribute to given outcomes.

Track progress and allocate more (or less) funds as appropriate.

Adapted from Bain, 2019

Info-Tech Insight

Changes to funding require changes to product and Agile practices to ensure product ownership and accountability.

Why is having a common value measure important?

CIO-CEO Alignment Diagnostic

A stacked bar graph is shown to demonstrate CIO-CEO Alignment Diagnostic. A bar titled: Business Value Metrics is highlighted. 51% had some improvement necessary and 32% had significant improvement necessary.

Over 700 Info-Tech members have implemented the Balanced Value Measurement Framework.

“The cynic knows the price of everything and the value of nothing.”

– Oscar Wilde

“Price is what you pay. Value is what you get.”

– Warren Buffett

Understanding where you derive value is critical to building solid roadmaps.

Measure delivery and success

Metrics and measurements are powerful tools to drive behavior change and decision making in your organization. However, metrics are highly prone to creating unexpected outcomes, so use them with great care. Use metrics judiciously to uncover insights but avoid gaming or ambivalent behavior, productivity loss, and unintended consequences.

Build good practices in your selection and use of metrics:

  • Choose the metrics that are as close to measuring the desired outcome as possible.
  • Select the fewest metrics possible and ensure they are of the highest value to your team, the safest from gaming behaviors and unintended consequences, and the easiest to gather and report.
  • Never use metrics for reward or punishment; use them to develop your team.
  • Automate as much metrics gathering and reporting as possible.
  • Focus on trends rather than precise metrics values.
  • Review and change your metrics periodically.

Executive Brief Case Study

INDUSTRY: Public Sector & Financial Services

SOURCE: Info-Tech Interviews

A tale of two product transformations

Two of the organizations we interviewed shared the challenges they experienced defining product families and the impact these challenges had on their digital transformations.

A major financial services organization (2,000+ people in IT) had employed a top-down line of business–focused approach and found itself caught in a vicious circle of moving applications between families to resolve cross-LoB dependencies.

A similarly sized public sector organization suffered from a similar challenge as grouping from the bottom up based on technology areas led to teams fragmented across multiple business units employing different applications built on similar technology foundations.

Results

Both organizations struggled for over a year to structure their product families. This materially delayed key aspects of their product-centric transformation, resulting in additional effort and expenditure delivering solutions piecemeal as opposed to as a part of a holistic product family. It took embracing a hybrid top-down and bottom-up approach and beginning with pilot product families to make progress on their transformation.

A picture of Cole Cioran is shown.

Cole Cioran

Practice Lead,

Applications Practice

Info-Tech Research Group

There is no such thing as a perfect product-family structure. There will always be trade-offs when you need to manage shifting demand from stakeholder groups spanning customers, business units, process owners, and technology owners.

Focusing on a single approach to structure your product families inevitably leads to decisions that are readily challenged or are brittle in the face of changing demand.

The key to accelerating a product-centric transformation is to build a hybrid model that embraces top-down and bottom-up perspectives to structure and evolve product families over time. Add a robust pilot to evaluate the structure and you have the key to unlocking the potential of product delivery in your organization.

Info-Tech’s methodology for Deliver Digital Products at Scale

1. Become a Product-Centric Organization

2. Organize Products Into Product Families

3. Ensure Alignment Between Products and Families

4. Bridge the Gap Between Product Families and Delivery

5. Build Your Transformation Roadmap and Communication Plan

Phase Steps

1.1 Understand the organizational factors driving product-centric delivery

1.2 Establish your organization’s product inventory

2.1 Determine your approach to scale product families

2.2 Define your product families

3.1 Leverage product family roadmaps

3.2 Use stakeholder management to improve roadmap communication

3.3 Configure your product family roadmaps

3.4 Confirm goal and value alignment of products and their product families

4.1 Assess your organization’s delivery readiness

4.2 Understand your delivery options

4.3 Determine your operating model

4.4 Identify how to fund product family delivery

5.1 Introduce your digital product family strategy

5.2 Communicate changes on updates to your strategy

5.3 Determine your next steps

Phase Outcomes
  • Organizational drivers and goals for a product-centric delivery
  • Definition of product
  • Pilot list of products to scale
  • Product scaling principles
  • Scaling approach and direction
  • Product family mapping
  • Enabling applications
  • Dependent applications
  • Product family canvas
  • Approach for communication of product family strategy
  • Stakeholder management plan
  • Defined key pieces of a product family roadmap
  • An approach to confirming alignment between products and product families
  • Assessment of delivery maturity
  • Approach to structuring product delivery
  • Operating model for product delivery
  • Approach for product family funding
  • Product family transformation roadmap
  • Your plan for communicating your roadmap
  • List of actionable next steps to start on your journey

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Deliver Digital Products at Scale Workbook

Use this supporting workbook to document interim results from a number of exercises that will contribute to your overall strategy.

A screenshot of the Scale Workbook is shown.

Deliver Digital Products at Scale Readiness Assessment

Your strategy needs to encompass your approaches to delivery. Understand where you need to focus using this simple assessment.

A screenshot of the Scale Readiness Assessment is shown.

Key deliverable:

Digital Product Family Strategy Playbook

Record the results from the exercises to help you define, detail, and deliver digital products at scale.

A screenshot of the Digital Product Family Strategy Playbook is shown.

Blueprint benefits

IT Benefits

  • Improved product delivery ROI.
  • Improved IT satisfaction and business support.
  • Greater alignment between product delivery and product family goals.
  • Improved alignment between product delivery and organizational models.
  • Better support for Agile/DevOps adoption.

Business Benefits

  • Increased value realization across product families.
  • Faster delivery of enterprise capabilities.
  • Improved IT satisfaction and business support.
  • Greater alignment between product delivery and product family goals.
  • Uniform understanding of product and product family roadmaps and key milestones.

Measure the value of this blueprint

Align product family metrics to product delivery and value realization.

Member Outcome Suggested Metric Estimated Impact

Increase business application satisfaction

Satisfaction with business applications (CIO Business Vision diagnostic)

20% increase within one year after implementation

Increase effectiveness of application portfolio management

Effectiveness of application portfolio management (Management & Governance diagnostic)

20% increase within one year after implementation

Increase importance and effectiveness of application portfolio

Importance and effectiveness to business ( Application Portfolio Assessment diagnostic)

20% increase within one year after implementation

Increase satisfaction of support of business operations

Support to business (CIO Business Vision diagnostic.

20% increase within one year after implementation

Successfully deliver committed work (productivity)

Number of successful deliveries; burndown

20% increase within one year after implementation

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keeps us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

Phase 1: Become a Product-Centric Organization

Phase 2: Organize Products Into Product Families

Phase 3: Ensure Alignment Between Products and Families

Phase 4: Bridge the Gap Between Product Families and Delivery

Call #1: Scope requirements, objectives, and your specific challenges.

Call #2: Define products and product families in your context.

Call #3: Understand the list of products in your context.

Call #4: Define your scaling principles and goals.

Call #5: Select a pilot and define your product families.

Call #6: Understand the product family roadmap as a method to align products to families.

Call #7: Define components of your product family roadmap and confirm alignment.

Call #8: Assess your delivery readiness.

Call #9: Discuss delivery, operating, and funding models relevant to delivering product families.

Call #10: Wrap up.

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Day 1

Become a Product-Centric Organization

Day 2

Organize Products Into Product Families

Day 3

Ensure Alignment Between Products and Families

Day 4

Bridge the Gap Between Product Families and Delivery

Advisory

Next Steps and Wrap-Up (offsite)

Activities

1.1 Understand your organizational factors driving product-centric delivery.

1.2 Establish your organization’s product inventory.

2.1 Determine your approach to scale product families.

2.2 Define your product families.

3.1 Leverage product family roadmaps.

3.2 Use stakeholder management to improve roadmap communication.

3.3 Configure your product family roadmaps.

3.4 Confirm product family to product alignment.

4.1 Assess your organization’s delivery readiness.

4.2 Understand your delivery options.

4.3 Determine your operating model.

4.4 Identify how to fund product family delivery.

5.1 Learn how to introduce your digital product family strategy.

5.2 Communicate changes on updates to your strategy.

5.3 Determine your next steps.

  1. Execute communication plan and product family changes.
  2. Review the pilot family implementation and update the transformation roadmap.
  3. Begin advisory calls for related blueprints.

Key Deliverables

  1. Organizational drivers and goals for a product-centric delivery
  2. Definition of product
  3. Product scaling principles
  4. Scaling approach and direction
  5. Pilot list of products to scale
  1. Product family mapping
  2. Enabling applications
  3. Dependent applications
  4. Product family canvas
  1. Current approach for communication of product family strategy
  2. List of product family stakeholders and a prioritization plan for communication
  3. Defined key pieces of a product family roadmap
  4. An approach to confirming alignment between products and product families through a shared definition of business value
  1. Assessment results on your organization’s delivery maturity
  2. A preferred approach to structuring product delivery
  3. Your preferred operating model for delivering product families
  4. Understanding your preferred approach for product family funding
  5. Product family transformation roadmap
  6. Your plan for communicating your roadmap
  7. List of actionable next steps to start on your journey
  1. Organizational communication of product families and product family roadmaps
  2. Product family implementation and updated transformation roadmap
  3. Support for product owners, backlog and roadmap management, and other topics

Phase 1

Become a Product-Centric Organization

Phase 1Phase 2Phase 3Phase 4Phase 5

1.1 Understand the organizational factors driving product-centric delivery

1.2 Establish your organization’s product inventory

2.1 Determine your approach to scale product families

2.2 Define your product families

3.1 Leverage product family roadmaps

3.2 Use stakeholder management to improve roadmap communication

3.3 Configure your product family roadmaps

3.4 Confirm product family to product alignment

4.1 Assess your organization’s delivery readiness

4.2 Understand your delivery options

4.3 Determine your operating model

4.4 Identify how to fund product family delivery

5.1 Learn how to introduce your digital product family strategy

5.2 Communicate changes on updates to your strategy

5.3 Determine your next steps

This phase will walk you through the following activities:

1.1.1 Understand your drivers for product-centric delivery

1.1.2 Identify the differences between project and product delivery

1.1.3 Define the goals for your product-centric organization

1.2.1 Define “product” in your context

1.2.2 Identify and establish a pilot list of products

This phase involves the following participants:

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Step 1.1

Understand the organizational factors driving product-centric delivery

Activities

1.1.1 Understand your drivers for product-centric delivery

1.1.2 Identify the differences between project and product delivery

1.1.3 Define the goals for your product-centric organization

This phase involves the following participants:

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Outcomes of this step

  • Organizational drivers to move to product-centric delivery
  • List of differences between project and product delivery
  • Goals for product-centric delivery

1.1.1 Understand your drivers for product-centric delivery

30-60 minutes

  1. Identify your pain points in the current delivery model.
  2. What is the root cause of these pain points?
  3. How will a product-centric delivery model fix the root cause?
  4. Record the results in the Deliver Digital Products at Scale Workbook.
Pain Points Root Causes Drivers
  • Lack of ownership
  • Siloed departments
  • Accountability

Output

  • Organizational drivers to move to product-centric delivery.

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

1.1.2 Identify the differences between project and product delivery

30-60 minutes

  1. Consider project delivery and product delivery.
  2. Discuss what some differences are between the two.
  3. Note: This exercise is not about identifying the advantages and disadvantages of each style of delivery. This is to identify the variation between the two.

  4. Record the results in the Deliver Digital Products at Scale Workbook.
Project Delivery Product Delivery
Point in time What is changed
Method of funding changes Needs an owner

Output

  • List of differences between project and product delivery

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

Identify the differences between a project-centric and a product-centric organization

Project Product
Fund projects Funding Fund products or teams
Line of business sponsor Prioritization Product owner
Makes specific changes to a product Product management Improves product maturity and support
Assignment of people to work Work allocation Assignment of work to product teams
Project manager manages Capacity management Team manages capacity

Info-Tech Insight

Product delivery requires significant shifts in the way you complete development work and deliver value to your users. Make the changes that support improving end-user value and enterprise alignment.

Projects can be a mechanism for funding product changes and improvements

A flowchart is shown to demonstrate the difference between project lifecycle, hybrid lifecycle, and product lifecycle.

Projects within products

Regardless of whether you recognize yourself as a product-based or project-based shop, the same basic principles should apply.

The purpose of projects is to deliver the scope of a product release. The shift to product delivery leverages a product roadmap and backlog as the mechanism for defining and managing the scope of the release.

Eventually, teams progress to continuous integration/continuous delivery (CI/CD) where they can release on demand or as scheduled, requiring org change management.

Use Agile DevOps principles to expedite product-centric delivery and management

Delivering products does not necessarily require an Agile DevOps mindset. However, Agile methods facilitate the journey because product thinking is baked into them.

A flowchart is shown to demonstrate the product delivery maturity and the Agile DevOps used.

Based on: Ambysoft, 2018

Organizations start with Waterfall to improve the predictable delivery of product features.

Iterative development shifts the focus from delivery of features to delivery of user value.

Agile further shifts delivery to consider ROI. Often, the highest-value backlog items aren’t the ones with the highest ROI.

Lean and DevOps improve your delivery pipeline by providing full integration between product owners, development teams, and operations.

CI/CD reduces time in process by allowing release on demand and simplifying release and support activities.

Although teams will adopt parts of all these stages during their journey, it isn’t until you’ve adopted a fully integrated delivery chain that you’ve become product centric.

1.1.3 Define the goals for your product-centric organization

30 minutes

  1. Review your list of drivers from exercise 1.1.1 and the differences between project and product delivery from exercise 1.1.2.
  2. Define your goals for achieving a product-centric organization.
  3. Note: Your drivers may have already covered the goals. If so, review if you would like to change the drivers based on your renewed understanding of the differences between project and product delivery.

Pain PointsRoot CausesDriversGoals
  • Lack of ownership
  • Siloed departments
  • Accountability
  • End-to-end ownership

Output

  • Goals for product-centric delivery

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

Step 1.2

Establish your organization’s product inventory

Activities

1.2.1 Define “product” in your context

1.2.2 Identify and establish a pilot list of products

This step involves the following participants:

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Outcomes of this step

  • Your organizational definition of products and services
  • A pilot list of active products

Product does not mean the same thing to everyone

Do not expect a universal definition of products.

Every organization and industry has a different definition of what a product is. Organizations structure their people, processes, and technologies according to their definition of the products they manage. Conflicting product definitions between teams increase confusion and misalignment of product roadmaps.

“A product [is] something (physical or not) that is created through a process and that provides benefits to a market.”

- Mike Cohn, Founding Member of Agile Alliance and Scrum Alliance

“A product is something ... that is created and then made available to customers, usually with a distinct name or order number.”

- TechTarget

“A product is the physical object ... , software or service from which customer gets direct utility plus a number of other factors, services, and perceptions that make the product useful, desirable [and] convenient.”

- Mark Curphey

Organizations need a common understanding of what a product is and how it pertains to the business. This understanding needs to be accepted across the organization.

“There is not a lot of guidance in the industry on how to define [products]. This is dangerous because what will happen is that product backlogs will be formed in too many areas. All that does is create dependencies and coordination across teams … and backlogs.”

– Chad Beier, "How Do You Define a Product?” Scrum.org

Products and services share the same foundation and best practices

For the purpose of this blueprint, product/service and product owner/service owner are used interchangeably. Product is used for consistency but would apply to services as well.

Product = Service

“Product” and “service” are terms that each organization needs to define to fit its culture and customers (internal and external). The most important aspect is consistent use and understanding of:

  • External products
  • Internal products
  • External services
  • Internal services
  • Products as a service (PaaS)
  • Productizing services (SaaS)

Recognize the different product owner perspectives

Business:

  • Customer facing, revenue generating

Technical:

  • IT systems and tools

Operations

  • Keep the lights on processes

Info-Tech Best Practice

Product owners must translate needs and constraints from their perspective into the language of their audience. Kathy Borneman, Digital Product Owner at SunTrust Bank, noted the challenges of finding a common language between lines of business and IT (e.g. what is a unit?).

Info-Tech Insight

Recognize that product owners represent one of three primary perspectives. Although all share the same capabilities, how they approach their responsibilities is influenced by their perspective.

“A Product Owner in its most beneficial form acts like an Entrepreneur, like a 'mini-CEO'. The Product Owner is someone who really 'owns' the product.”

– Robbin Schuurman, “Tips for Starting Product Owners”

Your product definition should include everything required to support it, not just what users see.

A picture of an iceburg is shown, showing the ice both above and below the water to demonstrate that the product definition should include everything, not just what users see. On top of the picture are various words to go with the product definition. They inlude: funding, external relationships, adoption, product strategy, stakeholder managment. The product defitions that may not be seen include: Product governance, business functionality, user support, managing and governing data, maintenance and enhancement, R-and-D, requirements analysis and design, code, and knowledge management.

Establish where product management would be beneficial in the organization

What does not need product ownership?

  • Individual features
  • Transactions
  • Unstructured data
  • One-time solutions
  • Non-repeatable processes
  • Solutions that have no users or consumers
  • People or teams

Characteristics of a discrete product

  • Has end users or consumers
  • Delivers quantifiable value
  • Evolves or changes over time
  • Has predictable delivery
  • Has definable boundaries
  • Has a cost to produce and operate

Product capabilities deliver value!

These are the various facets of a product. As a product owner, you are responsible for managing these facets through your capabilities and activities.

A flowchart is shown that demonstrates the various facets of a product.

It is easy to lose sight of what matters when we look at a product from a single point of view. Despite what The Agile Manifesto says, working software is not valuable without the knowledge and support that people need in order to adopt, use, and maintain it. If you build it, they will not come. Product leaders must consider the needs of all stakeholders when designing and building products.

Define product value by aligning backlog delivery with roadmap goals

In each product plan, the backlogs show what you will deliver. Roadmaps identify when and in what order you will deliver value, capabilities, and goals.

An image is shown to demonstrate the relationship between the product backlog and the product roadmap.

Product roadmaps guide delivery and communicate your strategy

In Deliver on Your Digital Product Vision, we demonstrate how the product roadmap is core to value realization. The product roadmap is your communicated path, and as a product owner, you use it to align teams and changes to your defined goals while aligning your product to enterprise goals and strategy.

An example of a product roadmap is shown to demonstrate how it is the core to value realization.

Info-Tech Insight

The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.

What is a product?

Not all organizations will define products in the same way. Take this as a general example:

“A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements.”

Info-Tech Insight

A proper definition of product recognizes three key facts:

  1. Products are long-term endeavors that don’t end after the project finishes.
  2. Products are not just “apps” but can be software or services that drive the delivery of value.
  3. There is more than one stakeholder group that derives value from the product or service.

1.2.1 Define “product” in your context

30-60 minutes

  1. Discuss what “product” means in your organization.
  2. Create a common, enterprise-wide definition for “product.”
  3. Record the results in the Deliver Digital Products at Scale Workbook.

For example:

  • An application, platform, or application family.
  • Discrete items that deliver value to a user/customer.

Output

  • Your enterprise/organizational definition of products and services

Participants

  • Product owners
  • Product managers
  • Development team leads
  • Portfolio managers’
  • Business analysts

Record the results in the Deliver Digital Products at Scale Workbook.

1.2.2 Identify and establish a pilot list of products

1-2 hours

  1. Review any current documented application inventory. If you have these details in an existing document, share it with the team. Select the group of applications for your family scaling pilot.
  2. List your initial application inventory on the Product List tab of the Deliver Digital Products at Scale Workbook.
  • For each of the products listed, add the vision and goals of the product. Refer to Deliver on Your Digital Product Vision to learn more about identifying vision and goals or to complete the product vision canvas.
  • You’ll add business capabilities and vision in Phase 2, but you can add these now if they are available in your existing inventory.
  • Output

    • A pilot list of active products

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Phase 2

    Organize Products Into Product Families

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    2.1.1 Define your scaling principles and goals

    2.1.2 Define your pilot product family areas and direction

    2.2.1 Arrange your applications and services into product families

    2.2.2 Define enabling and supporting applications

    2.2.3 Build your product family canvas

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Step 2.1

    Determine your approach to scale product families

    Activities

    2.1.1 Define your scaling principles and goals

    2.1.2 Define your pilot product family areas and direction

    This step involves the following participants:

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Outcomes of this step

    • List of product scaling principles
    • Scope of product scaling pilot and target areas
    • Scaling approach and direction

    Use consistent terminology for product and service families

    In this blueprint, we refer to any grouping of products or services as a “family.” Your organization may prefer other terms, such as product/service line, portfolio, group, etc. The underlying principles for grouping and managing product families are the same, so define the terminology that fits best with your culture. The same is true for “products” and “services,” which may also be referred to in different terms.

    An example flowchart is displayed to demonstrate the terminology for product and service families.

    A product family is a logical and operational grouping of related products or services. The grouping provides a scaled hierarchy to translate goals, priorities, strategy, and constraints down the grouping while aligning value realization upwards.

    Group product families by related purpose to improve business value

    Families should be scaled by how the products operationally relate to each other, with clear boundaries and common purpose.

    A product family contains...

    • Vision
    • Goals
    • Cumulative roadmap of the products within the family

    A product family can be grouped by...

    • Function
    • Value stream and capability
    • Customer segments or end-user group
    • Strategic purpose
    • Underlying architecture
    • Common technology or support structures
    • And many more
    A flowchart is shown to demonstrate the product family and product relations.

    Scale products into related families to improve value delivery and alignment

    Defining product families builds a network of related products into coordinated value delivery streams.

    A flowchart is shown to demonstrate the relations between product family and the delivery streams.

    “As with basic product management, scaling an organization is all about articulating the vision and communicating it effectively. Using a well-defined framework helps you align the growth of your organization with that of the company. In fact, how the product organization is structured is very helpful in driving the vision of what you as a product company are going to do.”

    – Rich Mironov, Mironov Consulting

    Product families translate enterprise goals into value-enabling capabilities

    A flowchart is shown to demonstrate the relationship between enterprise strategy and enabling capabilities.

    Info-Tech Insight

    Your organizational goals and strategy are achieved through capabilities that deliver value. Your product hierarchy is the mechanism to translate enterprise goals, priorities, and constraints down to the product level where changes can be made.

    Arrange product families by operational groups, not solely by your org chart

    A flowchart is shown to demonstrate how to arrange product families by operational groups.

    1. To align product changes with enterprise goals and priorities, you need to organize your products into operational groups based on the capabilities or business functions the product and family support.

    2. Product managers translate these goals, priorities, and constraints into their product families, so they are actionable at the next level, whether that level is another product family or products implementing enhancements to meet these goals.

    3. The product family manager ensures that the product changes enhance the capabilities that allow you to realize your product family, division, and enterprise goals.

    4. Enabling capabilities realize value and help reach your goals, which then drives your next set of enterprise goals and strategy.

    Product families need owners with a more strategic focus

    Product Owner

    (More tactical product delivery focus)

    • Backlog management and prioritization
    • Product vision and product roadmap
    • Epic/story definition, refinement in conjunction with business stakeholders
    • Sprint planning with Scrum Master and delivery team
    • Working with Scrum Master to minimize disruption to team velocity
    • Ensuring alignment between business and Scrum teams during sprints
    • Profit and loss (P&L) product analysis and monitoring

    Product Manager

    (More strategic product family focus)

    • Product strategy, positioning, and messaging
    • Product family vision and product roadmap
    • Competitive analysis and positioning
    • New product innovation/definition
    • Release timing and focus (release themes)
    • Ongoing optimization of product-related marketing and sales activities
    • P&L product analysis and monitoring

    Info-Tech Insight

    “Product owner” and “product manager” are terms that should be adapted to fit your culture and product hierarchy. These are not management relationships but rather a way to structure related products and services that touch the same end users. Use the terms that work best in your culture.

    Download Build a Better Product Owner for role support.

    2.1.1 Define your scaling principles and goals

    30-60 minutes

    1. Discuss the guiding principles for your product scaling model. Your guiding principles should consider key business priorities, organizational culture, and division/team objectives, such as improving:
    • Business agility and ability to respond to changes and needs.
    • Alignment of product roadmaps to enterprise goals and priorities.
    • Collaboration between stakeholders and product delivery teams.
    • Resource utilization and productivity.
    • The quality and value of products.
    • Coordination between related products and services.

    Output

    • List of product scaling principles

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Start scaling with a pilot

    You will likely use a combination of patterns that work best for each product area. Pilot your product scaling with a domain, team, or functional area before organizing your entire portfolio.

    Learn more about each pattern.

    Discuss the pros and cons of each.

    Select a pilot product area.

    Select a pattern.

    Approach alignment from both directions, validating by the opposite way

    Defining your product families is not a one-way street. Often, we start from either the top or the bottom depending on our scaling principles. We use multiple patterns to find the best arrangement and grouping of our products and families.

    It may be helpful to work partway, then approach your scaling from the opposite direction, meeting in the middle. This way you are taking advantage of the strengths in both approaches.

    Once you have your proposed structure, validate the grouping by applying the principles from the opposite direction to ensure each product and family is in the best starting group.

    As the needs of your organization change, you may need to realign your product families into your new business architecture and operational structure.

    A top-down alignment example is shown.

    When to use: You have a business architecture defined or clear market/functional grouping of value streams.

    A bottom-up alignment example is shown.

    When to use: You are starting from an Application Portfolio Management application inventory to build or validate application families.

    Top-down examples: Start with your enterprise structure or market grouping

    A top-down example flowchart is shown.

    Examples:

    Market Alignment
    • Consumer Banking
      • DDA: Checking, Savings, Money Market
      • Revolving Credit: Credit Cards, Line of Credit
      • Term Credit: Mortgage, Auto, Boat, Installment
    Enterprise Applications
    • Human Resources
      • Benefits: Health, Dental, Life, Retirement
      • Human Capital: Hiring, Performance, Training
      • Hiring: Posting, Interviews, Onboarding
    Shared Service
    • End-User Support
      • Desktop: New Systems, Software, Errors
      • Security: Access Requests, Password Reset, Attestations
    Business Architecture
    • Value Stream
      • Capability
        • Applications
        • Services

    Bottom-up examples: Start with your inventory

    Based on your current inventory, start organizing products and services into related groups using one of the five scaling models discussed in the next step.

    A bottom-up example flowchart is shown.

    Examples:

    Technical Grouping
    • Custom Apps: Java, .NET, Python
    • Cloud: Azure, AWS, Virtual Environments
    • Low Code: ServiceNow, Appian
    Functional/Capability Grouping
    • CRM: Salesforce, Microsoft CRM
    • Security Platforms: IAM, SSO, Scanning
    • Workflow: Remedy, ServiceNow
    Shared Services Grouping
    • Workflow: Appian, Pega, ServiceNow
    • Collaboration: SharePoint, Teams
    • Data: Dictionary, Lake, BI/Reporting

    2.1.2 Define your pilot product family areas and direction

    30-60 minutes

    1. Using your inventory of products for your pilot, consider the top-down and bottom-up approaches.
    2. Identify areas where you will begin arranging your product into families.
    3. Prioritize these pilot areas into waves:
      1. First pilot areas
      2. Second pilot areas
      3. Third pilot areas
    4. Discuss and decide whether a top-down or bottom-up approach is the best place to start for each pilot group.
    5. Prioritize your pilot families in the order in which you want to organize them. This is a guide to help you get started, and you may change the order during the scaling pattern exercise.

    Output

    • Scope of product scaling pilot and target areas

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Step 2.2

    Define your product families

    Activities

    2.2.1 Arrange your applications and services into product families

    2.2.2 Define enabling and supporting applications

    2.2.3 Build your product family canvas

    This step involves the following participants:

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers’
    • Business analysts

    Outcomes of this step

    • Product family mapping
    • Product families
    • Enabling applications
    • Dependent applications
    • Product family canvas

    Use three perspectives to guide scaling pattern selection

    • One size does not fit all. There is no single or static product model that fits all product teams.
    • Structure relationships based on your organizational needs and capabilities.
    • Be flexible. Product ownership is designed to enable value delivery.
    • Avoid structures that promote proxy product ownership.
    • Make decisions based on products and services, not people. Then assign people to the roles.
    Alignment perspectives:

    Value Stream

    Align products based on the defined sources of value for a collection of products or services.

    For example: Wholesale channel for products that may also be sold directly to consumers, such as wireless network service.

    Users/Consumers

    Align products based on a common group of users or product consumers.

    For example: Consumer vs. small business vs. enterprise customers in banking, insurance, and healthcare.

    Common Domain

    Align products based on a common domain knowledge or skill set needed to deliver and support the products.

    For example: Applications in a shared service framework supporting other products.

    Leverage patterns for scaling products

    Organizing your products and families is easier when leveraging these grouping patterns. Each is explained in greater detail on the following slides

    Value Stream AlignmentEnterprise ApplicationsShared ServicesTechnicalOrganizational Alignment
    • Business architecture
      • Value stream
      • Capability
      • Function
    • Market/customer segment
    • Line of business (LoB)
    • Example: Customer group > value stream > products
    • Enabling capabilities
    • Enterprise platforms
    • Supporting apps
    • Example: HR > Workday/Peoplesoft > ModulesSupporting: Job board, healthcare administrator
    • Organization of related services into service family
    • Direct hierarchy does not necessarily exist within the family
    • Examples: End-user support and ticketing, workflow and collaboration tools
    • Domain grouping of IT infrastructure, platforms, apps, skills, or languages
    • Often used in combination with Shared Services grouping or LoB-specific apps
    • Examples: Java, .NET, low-code, database, network
    • Used at higher levels of the organization where products are aligned under divisions
    • Separation of product managers from organizational structure no longer needed because the management team owns product management role

    Select the best family pattern to improve alignment

    A flowchart is shown on how to select the best family pattern to improve alignment.

    Use scenarios to help select patterns

    Top-Down

    Bottom-Up

    We have a business architecture defined.

    (See Document Your Business Architecture and industry reference architectures for help.)

    Start with your business architecture

    Start with market segments

    We want to be more customer first or customer centric.

    Start with market segments

    Our organization has rigid lines of business and organizational boundaries.

    Start with LoB structure

    Most products are specific to a business unit or division. Start with LoB structure

    Products are aligned to people, not how we are operationally organized.

    Start with market or LoB structure

    We are focusing on enterprise or enabling applications.

    1. Start with enterprise app and service team

    2. Align supporting apps

    We already have applications and services grouped into teams but want to evaluate if they are grouped in the best families.

    Validate using multiple patterns

    Validate using multiple patterns

    Our applications and services are shared across the enterprise or support multiple products, value streams, or shared capabilities.

    Our applications or services are domain, knowledge, or technology specific.

    Start by grouping inventory

    We are starting from an application inventory. (See the APM Research Center for help.)

    Start by grouping inventory

    Pattern: Value Stream – Capability

    Grouping products into capabilities defined in your business architecture is recommended because it aligns people/processes (services) and products (tools) into their value stream and delivery grouping. This requires an accurate capability map to implement.

    Example:

    • Healthcare is delivered through a series of distinct value streams (top chevrons) and shared services supporting all streams.
    • Diagnosing Health Needs is executed through the Admissions, Testing, Imaging, and Triage capabilities.
    • Products and services are needed to deliver each capability.
    • Shared capabilities can also be grouped into families to better align capability delivery and maturity to ensure that the enterprise goals and needs are being met in each value stream the capabilities support.
    An example is shown to demonstrate how to group products into capabilities.

    Sample business architecture/ capability map for healthcare

    A sample business architecture/capability map for healthcare is shown.

    Your business architecture maps your value streams (value delivered to your customer or user personas) to the capabilities that deliver that value. A capability is the people, processes, and/or tools needed to deliver each value function.

    Defining capabilities are specific to a value stream. Shared capabilities support multiple value streams. Enabling capabilities are core “keep the lights on” capabilities and enterprise functions needed to run your organization.

    See Info-Tech’s industry coverage and reference architectures.

    Download Document Your Business Architecture

    Pattern: Value Stream – Market

    Market/Customer Segment Alignment focuses products into the channels, verticals, or market segments in the same way customers and users view the organization.

    An example is shown to demonstrate how products can be placed into channels, verticals, or market segments.

    Example:

    • Customers want one stop to solve all their issues, needs, and transactions.
    • Banking includes consumer, small business, and enterprise.
    • Consumer banking can be grouped by type of financial service: deposit accounts (checking, savings, money market), revolving credit (credit cards, lines of credit), term lending (mortgage, auto, installment).
    • Each group of services has a unique set of applications and services that support the consumer product, with some core systems supporting the entire relationship.

    Pattern: Value Stream – Line of Business (LoB)

    Line of Business Alignment uses the operational structure as the basis for organizing products and services into families that support each area.

    An example of the operational structure as the basis is shown.

    Example:

    • LoB alignment favors continuity of services, tools, and skills based on internal operations over unified customer services.
    • A hospital requires care and services from many different operational teams.
    • Emergency services may be internally organized by the type of care and emergency to allow specialized equipment and resources to diagnose and treat the patients, relying on support teams for imaging and diagnostics to support care.
    • This model may be efficient and logical from an internal viewpoint but can cause gaps in customer services without careful coordination between product teams.

    Pattern: Enterprise Applications

    A division or group delivers enabling capabilities, and the team’s operational alignment maps directly to the modules/components of an enterprise application and other applications that support the specific business function.

    An example flowchart is shown with enterprise applications.

    Example:

    • Human resources is one corporate function. Within HR, however, there are subfunctions that operate independently.
    • Each operational team is supported by one or more applications or modules within a primary HR system.
    • Even though the teams work independently, the information they manage is shared with or ties into processes used by other teams. Coordination of efforts helps provide a higher level of service and consistency.

    For additional information about HRMS, please download Get the Most Out of Your HRMS.

    Pattern: Shared Services

    Grouping by service type, knowledge area, or technology allows for specialization while families align service delivery to shared business capabilities.

    An example is shown with the shared services.

    Example:

    • Recommended for governance, risk, and compliance; infrastructure; security; end-user support; and shared platforms (workflow, collaboration, imaging/record retention). Direct hierarchies do not necessarily exist within the shared service family.
    • Service groupings are common for service owners (also known as support managers, operations managers, etc.).
    • End-user ticketing comes through a common request system, is routed to the team responsible for triage, and then is routed to a team for resolution.
    • Collaboration tools and workflow tools are enablers of other applications, and product families might support multiple apps or platforms delivering that shared capability.

    Pattern: Technical

    Technical grouping is used in Shared Services or as a family grouping method within a Value Stream Alignment (Capability, Market, LoB) product family.

    An example of technical grouping is shown.

    Example:

    • Within Shared Services, Technical product grouping focuses on domains requiring specific experience and knowledge not common to typical product teams. This can also support insourcing so other product teams do not have to build their own capacity.
    • Within a Market or LoB team, these same technical groups support specific tools and services within that product family only while also specializing in the business domain.
    • Alignment into tool, platform, or skill areas improves delivery capabilities and resource scalability.

    Pattern: Organizational Alignment

    Eventually in your product hierarchy, the management structure functions as the product management team.

    • When planning your product families, be careful determining when to merge product families into the management team structure.
    • Since the goal of scaling products into families is to align product delivery roadmaps to enterprise goals and enable value realization, the primary focus of scaling must be operational.
    • Alignment to the organizational chart should only occur when the product families report into an HR manager who has ownership for the delivery and value realization for all product and services within that family.
    Am example of organizational alignment is shown.

    Download Build a Better Product Owner for role support.

    2.2.1 Arrange your applications and services into product families

    1-4 hours

    1. (Optional but recommended) Define your value streams and capabilities on the App Capability List tab in the Deliver Digital Products at Scale Workbook.
    2. On the Product Families tab, build your product family hierarchy using the following structure:
    • Value Stream > Capability > Family 3 > Family 2 > Family 1 > Product/Service.
    • If you are not using a Value Stream > Capability grouping, you can leave these blank for now.
    A screenshot of the App Capability List in the Deliver Disital Products at Scale Workbook is shown.
  • If you previously completed an application inventory using one of our application portfolio management (APM) resources, you can paste values here. Do not paste cells, as Excel may create a cell reference or replace the current conditional formatting.
  • Output

    • Product family mapping

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    2.2.2 Define enabling and supporting applications

    1-4 hours

    1. Review your grouping from the reverse direction or with different patterns to validate the grouping. Consider each grouping.
    • Does it operationally align the products and families to best cascade enterprise goals and priorities while validating enabling capabilities?
    • In the next phase, when defining your roadmap strategy, you may wish to revisit this phase and adjust as needed.
  • Select and enter enabling or dependent applications to the right of each product.
  • A screenshot from the Deliver Digitial Products at Scale Workbook is shown.

    Output

    • Product families
    • Enabling applications
    • Dependent applications

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers
    • Business analysts

    Record the results in the Deliver Digital Products at Scale Workbook.

    Use a product canvas to define key elements of your product family

    A product canvas is an excellent tool for quickly providing important information about a product family.

    Product owners/managers

    Provide target state to align child product and product family roadmaps.

    Stakeholders

    Communicate high-level concepts and key metrics with leadership teams and stakeholders.

    Strategy teams

    Use the canvas as a tool for brainstorming, scoping, and ideation.

    Operations teams

    Share background overview to align operational team with end-user value.

    Impacted users

    Refine communication strategy and support based on user impacts and value realization.

    Download Deliver on Your Digital Product Vision.

    Product Family Canvas: Define your core information

    A screenshot of the product family canvas is shown.

    Problem Statement: The problem or need the product family is addressing

    Business Goals: List of business objectives or goals for the product

    Personas/Customers/Users: List of groups who consume the product/service

    Vision: Vision, unique value proposition, elevator pitch, or positioning statement

    Child Product Families or Products: List of product families or products within this family

    Stakeholders: List of key resources, stakeholders, and teams needed to support the product or service

    Download Deliver on Your Digital Product Vision.

    2.2.3 Build your product family canvas

    30-60 minutes

    1. Complete the following fields to build your product family canvas in your Digital Product Family Strategy Playbook:
      1. Product family name
      2. Product family owner
      3. Parent product family name
      4. Problem that the family is intending to solve (For additional help articulating your problem statement, refer to Deliver on Your Digital Product Vision.)
      5. Product family vision/goals (For additional help writing your vision, refer to Deliver on Your Digital Product Vision..)
      6. Child product or product family name(s)
      7. Primary customers/users (For additional help with your product personas, download and complete Deliver on Your Digital Product Vision..)
      8. Stakeholders (If you aren’t sure who your stakeholders are, fill this in after completing the stakeholder management exercises in phase 3.)

    Output

    • Product family canvas

    Participants

    • Product owners
    • Product managers
    • Development team leads
    • Portfolio managers
    • Business analysts

    Record the results in the Digital Product Family Strategy Playbook.

    A screenshot of the Product Family Canvas is shown.

    Phase 3

    Ensure Alignment Between Products and Families

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    • 3.1.1 Evaluate your current approach to product family communication
    • 3.2.1 Visualize interrelationships among stakeholders to identify key influencers
    • 3.2.2 Group stakeholders into categories
    • 3.2.3 Prioritize your stakeholders
    • 3.3.1 Define the communication objectives and audience of your product family roadmaps
    • 3.3.2 Identify the level of detail that you want your product family roadmap artifacts to represent
    • 3.4.1 Validate business value alignment between products and their product families

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Step 3.1

    Leverage product family roadmaps

    Activities

    3.1.1 Evaluate your current approach to product family communication

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • Understanding of what a product family roadmap is
    • Comparison of Info-Tech’s position on product families to how you currently communicate about product families

    Aligning products’ goals with families

    Without alignment between product family goals and their underlying products, you aren’t seeing the full picture.

    An example of a product roadmap is shown to demonstrate how it is the core to value realization.

    Adapted from: Pichler," What Is Product Management?"

    • Aligning product strategy to enterprise goals needs to happen through the product family.
    • A product roadmap has traditionally been used to express the overall intent and visualization of the product strategy.
    • Connecting the strategy of your products with your enterprise goals can be done through the product family roadmap.

    Leveraging product family roadmaps

    It’s more than a set of colorful boxes.

      ✓ Lays out a strategy for your product family.

      ✓ Is a statement of intent for your family of products.

      ✓ Communicates direction for the entire product family and product teams.

      ✓ Directly connects to the organization’s goals.

    However, it is not:

      x Representative of a hard commitment.

      x A simple combination of your current product roadmaps.

      x A technical implementation plan.

    Product family roadmaps

    A roadmap is shown without any changes.

    There is no such thing as a roadmap that never changes.

    Your product family roadmap represents a broad statement of intent and high-level tactics to get closer to the organization’s goals.

    A roadmap is shown with changes.

    All good product family roadmaps embrace change!

    Your strategic intentions are subject to volatility, especially those planned further in the future. The more costs you incur in planning, the more you leave yourself exposed to inefficiency and waste if those plans change.

    Info-Tech Insight

    A good product family roadmap is intended to manage and communicate the inevitable changes as a result of market volatility and changes in strategy.

    Product family roadmaps are more strategic by nature

    While individual product roadmaps can be different levels of tactical or strategic depending on a variety of market factors, your options are more limited when defining roadmaps for product families.

    An image is displayed to show the relationships between product and product family, and how the roadmaps could be tactical or strategic.

    Info-Tech Insight

    Roadmaps for your product family are, by design, less detailed. This does not mean they aren’t actionable! Your product family roadmap should be able to communicate clear intentions around the future delivery of value in both the near and long term.

    Reminder: Your enterprise vision provides alignment for your product family roadmaps

    Not knowing the difference between enterprise vision and goals will prevent you from both dreaming big and achieving your dream.

    Your enterprise vision represents your “north star” – where you want to go. It represents what you want to do.

    • Your enterprise goals represent what you need to achieve in order to reach your enterprise vision.
    • A key element of operationalizing your vision.
    • Your strategy, initiatives, and features will align with one or more goals.

    Download Deliver on Your Digital Product Vision for support.

    Multiple roadmap views can communicate differently, yet tell the same truth

    Audience

    Business/ IT Leaders

    Users/Customers

    Delivery Teams

    Roadmap View

    Portfolio

    Product Family

    Technology

    Objectives

    To provide a snapshot of the portfolio and priority products

    To visualize and validate product strategy

    To coordinate broad technology and architecture decisions

    Artifacts

    Line items or sections of the roadmap are made up of individual products, and an artifact represents a disposition at its highest level.

    Artifacts are generally grouped by product teams and consist of strategic goals and the features that realize those goals.

    Artifacts are grouped by the teams who deliver that work and consist of technical capabilities that support the broader delivery of value for the product family.

    Typical elements of a product family roadmap

    While there are others, these represent what will commonly appear across most family-based roadmaps.

    An example is shown to highlight the typical elements of a product family roadmap.

    GROUP/CATEGORY: Groups are collections of artifacts. In a product family context, these are usually product family goals, value streams, or products.

    ARTIFACT: An artifact is one of many kinds of tangible by-products produced during the delivery of products. For a product family, the artifacts represented are capabilities or value streams.

    MILESTONE: Points in the timeline when established sets of artifacts are complete. This is a critical tool in the alignment of products in a given family.

    TIME HORIZON: Separated periods within the projected timeline covered by the roadmap.

    3.1.1 Evaluate your current approach to product family communication

    1-2 hours

    1. Write down how you currently communicate your intentions for your products and family of products.
    2. Compare and contrast this to how this blueprint defines product families and product family roadmaps.
    3. Consider the similarities and the key gaps between your current approach and Info-Tech’s definition of product family roadmaps.

    Output

    • Your documented approach to product family communication

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Step 3.2

    Use stakeholder management to improve roadmap communication

    Activities

    3.2.1 Visualize interrelationships among stakeholders to identify key influencers

    3.2.2 Group stakeholders into categories

    3.2.3 Prioritize your stakeholders

    Info-Tech Note

    If you have done the stakeholder exercises in Deliver on Your Digital Product Vision or Build a Better Product Owner u don’t need to repeat the exercises from scratch.

    You can bring the results forward and update them based on your prior work.

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • Relationships among stakeholders and influencers
    • Categorization of stakeholders and influencers
    • Stakeholder and influencer prioritization

    Reminder: Not everyone is a user!

    USERS

    Individuals who directly obtain value from usage of the product.

    STAKEHOLDERS

    Represent individuals who provide the context, alignment, and constraints that influence or control what you will be able to accomplish.

    FUNDERS

    Individuals both external and internal that fund the product initiative. Sometimes they are lumped in as stakeholders. However, motivations can be different.

    For more information, see Deliver on Your Digital Product Vision.

    A stakeholder strategy is a key part of product family attainment

    A roadmap is only “good” when it effectively communicates to stakeholders. Understanding your stakeholders is the first step in delivering great product family roadmaps.

    A picture is shown that has 4 characters with puzzle pieces, each repersenting a key to product family attainment. The four keys are: Stakeholder management, product lifecycle, project delivery, and operational support.

    Create a stakeholder network map for product roadmaps and prioritization

    Follow the trail of breadcrumbs from your direct stakeholders to their influencers to uncover hidden stakeholders.

    An example stakeholder network map is displayed.

    Legend

    Black arrows: indicate the direction of professional influence

    Dashed green arrows: indicate bidirectional, informal influence relationships

    Info-Tech Insight

    Your stakeholder map defines the influence landscape your product family operates in. It is every bit as important as the teams who enhance, support, and operate your product directly.

    Use connectors to determine who may be influencing your direct stakeholders. They may not have any formal authority within the organization, but they may have informal yet substantial relationships with your stakeholders.

    3.2.1 Visualize interrelationships among stakeholders to identify key influencers

    60 minutes

    1. List direct stakeholders for your product.
    2. Determine the stakeholders of your stakeholders and consider adding each of them to the stakeholder list.
    3. Assess who has either formal or informal influence over your stakeholders; add these influencers to your stakeholder list.
    4. Construct a diagram linking stakeholders and their influencers together.
    • Use black arrows to indicate the direction of professional influence.
    • Use dashed green arrows to indicate bidirectional, informal influence relationships.

    Output

    • Relationships among stakeholders and influencers

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Categorize your stakeholders with a prioritization map

    A stakeholder prioritization map helps product leaders categorize their stakeholders by their level of influence and ownership in the product and/or teams.

    An example stakeholder prioritization map is shown.

    There are four areas in the map, and the stakeholders within each area should be treated differently.

    Players – players have a high interest in the initiative and the influence to effect change over the initiative. Their support is critical, and a lack of support can cause significant impediment to the objectives.

    Mediators – mediators have a low interest but significant influence over the initiative. They can help to provide balance and objective opinions to issues that arise.

    Noisemakers – noisemakers have low influence but high interest. They tend to be very vocal and engaged, either positively or negatively, but have little ability to enact their wishes.

    Spectators – generally, spectators are apathetic and have little influence over or interest in the initiative.

    3.2.2 Group stakeholders into categories

    30-60 minutes

    1. Identify your stakeholders’ interest in and influence on your product as high, medium, or low by rating the attributes below.
    2. Map your results to the model below to determine each stakeholder’s category.
    Level of Influence
    • Power: Ability of a stakeholder to effect change.
    • Urgency: Degree of immediacy demanded.
    • Legitimacy: Perceived validity of stakeholder’s claim.
    • Volume: How loud their “voice” is or could become.
    • Contribution: What they have that is of value to you.
    Level of Interest

    How much are the stakeholder’s individual performance and goals directly tied to the success or failure of the product?

    The example stakeholder prioritization map is shown with the stakeholders grouped into the categories.

    Output

    • Categorization of stakeholders and influencers

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Prioritize your stakeholders

    There may be too many stakeholders to be able to manage them all. Focus your attention on the stakeholders that matter most.

    Level of Support

    Stakeholder Category

    Supporter

    Evangelist

    Neutral Blocker

    Player

    Critical

    High

    High

    Critical

    Mediator

    Medium

    Low

    Low

    Medium

    Noisemaker

    High

    Medium

    Medium

    High

    Spectator

    Low

    Irrelevant

    Irrelevant

    Low

    Consider the three dimensions for stakeholder prioritization: influence, interest, and support. Support can be determined by answering the following question: How likely is it that this stakeholder would recommend your product?

    These parameters are used to prioritize which stakeholders are most important and should receive your focused attention.

    3.2.3 Prioritize your stakeholders

    30 minutes

    1. Identify the level of support of each stakeholder by answering the following question: How likely is it that this stakeholder would endorse your product?
    2. Prioritize your stakeholders using the prioritization scheme on the previous slide.

    Stakeholder

    Category

    Level of Support

    Prioritization

    CMO

    Spectator

    Neutral

    Irrelevant

    CIO

    Player

    Supporter

    Critical

    Output

    • Stakeholder and influencer prioritization

    Participants

    • Product owners
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    Define strategies for engaging stakeholders by type

    An example is shown to demonstrate how to define strategies to engage staeholders by type.

    Type

    Quadrant

    Actions

    Players

    High influence, high interest – actively engage

    Keep them updated on the progress of the project. Continuously involve Players in the process and maintain their engagement and interest by demonstrating their value to its success.

    Mediators

    High influence, low interest – keep satisfied

    They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust and including them in important decision-making steps. In turn, they can help you influence other stakeholders.

    Noisemakers

    Low influence, high interest – keep informed

    Try to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using Mediators to help them.

    Spectators

    Low influence, low interest – monitor

    They are followers. Keep them in the loop by providing clarity on objectives and status updates.

    Info-Tech Insight

    Each group of stakeholders draws attention and resources away from critical tasks. By properly identifying your stakeholder groups, the product owner can develop corresponding actions to manage stakeholders in each group. This can dramatically reduce wasted effort trying to satisfy Spectators and Noisemakers, while ensuring the needs of Mediators and Players are met.

    Step 3.3

    Configure your product family roadmaps

    Activities

    3.3.1 Define the communication objectives and audience of your product family roadmaps

    3.3.2 Identify the level of detail that you want your product family roadmap artifacts to represent

    Info-Tech Note

    If you are unfamiliar with product roadmaps, Deliver on Your Digital Product Vision contains more detailed exercises we recommend you review before focusing on product family roadmaps.

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • An understanding of the key communication objectives and target stakeholder audience for your product family roadmaps
    • A position on the level of detail you want your product family roadmap to operate at

    Your communication objectives are linked to your audience; ensure you know your audience and speak their language

    I want to... I need to talk to... Because they are focused on...
    ALIGN PRODUCT TEAMS Get my delivery teams on the same page. Architects Products Owners PRODUCTS A product that delivers value against a common set of goals and objectives.
    SHOWCASE CHANGES Inform users and customers of product strategy. Bus. Process Owners End Users FUNCTIONALITY A group of functionality that business customers see as a single unit.
    ARTICULATE RESOURCE REQUIREMENTS Inform the business of product development requirements. IT Management Business Stakeholders FUNDING An initiative that those with the money see as a single budget.

    3.3.1 Define the communication objectives and audience of your product family roadmaps

    30-60 minutes

    1. Explicitly state the communication objectives and audience of your roadmap.
    • Think of finishing this sentence: This roadmap is designed for … in order to …
  • You may want to consider including more than a single audience or objective.
  • Example:
  • Roadmap

    Audience

    Statement

    Internal Strategic Roadmap

    Internal Stakeholders

    This roadmap is designed to detail the strategy for delivery. It tends to use language that represents internal initiatives and names.

    Customer Strategic Roadmap

    External Customers

    This roadmap is designed to showcase and validate future strategic plans and internal teams to coordinate the development of features and enablers.

    Output

    • Roadmap list with communication objectives and audience

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Deliver Digital Products at Scale Workbook.

    The length of time horizons on your roadmap depend on the needs of the underlying products or families

    Info-Tech InsightAn example timeline is shown.

    Given the relationship between product and product family roadmaps, the product family roadmap needs to serve the time horizons of its respective products.

    This translates into product family roadmaps with timelines that, at a minimum, cover the full scope of the respective product roadmaps.

    Based on your communication objectives, consider different ways to visualize your product family roadmap

    Swimline/Stream-Based roadmap example.

    Swimlane/Stream-Based – Understanding when groups of items intend to be delivered.

    An example is shown that has an overall plan with rough intentions around delivery.

    Now, Next, Later – Communicate an overall plan with rough intentions around delivery without specific date ranges.

    An example of a sunrise roadmap is shown.

    Sunrise Roadmap – Articulate the journey toward a given target state across multiple streams.

    Before connecting your family roadmap to products, think about what each roadmap typically presents

    An example of a product family roadmap is shown and how it can be connected to the products.

    Info-Tech Insight

    Your product family roadmap and product roadmap tell different stories. The product family roadmap represents the overall connection of products to the enterprise strategy, while the product roadmap focuses on the fulfillment of the product’s vision.

    Example: Connecting your product family roadmaps to product roadmaps

    Your roadmaps should be connected at an artifact level that is common between both. Typically, this is done with capabilities, but you can do it at a more granular level if an understanding of capabilities isn’t available.

    Example is shown connecting product family roadmaps to product roadmaps.

    3.3.2 Identify the level of detail that you want your product family roadmap artifacts to represent

    30-60 minutes

    1. Consider the different available artifacts for a product family (goals, value stream, capabilities).
    2. List the roadmaps that you wish to represent.
    3. Based on how you currently articulate details on your product families, consider:
    • What do you want to use as the level of granularity for the artifact? Consider selecting something that has a direct connection to the product roadmap itself (for example, capabilities).
    • For some roadmaps you will want to categorize your artifacts – what would work best in those cases?

    Examples

    Level of Hierarchy

    Artifact Type

    Roadmap 1

    Goals

    Capability

    Roadmap 2

    Roadmap 3

    Output

    • Details on your roadmap granularity

    Participants

    • Product owners
    • Product managers
    • Portfolio managers

    Record the results in the Deliver Digital Products at Scale Workbook.

    Step 3.4

    Confirm goal and value alignment of products and their product families

    Activities

    3.4.1 Validate business value alignment between products and their product families

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Business analysts

    Outcomes of this step

    • Validation of the alignment between your product families and products

    Confirming product to family value alignment

    It isn’t always obvious whether you have the right value delivery alignment between products and product families.

    An example is shown to demonstrate product-to-family-alignment.

    Product-to-family alignment can be validated in two different ways:

    1. Initial value alignment
    2. Confirm the perceived business value at a family level is aligned with what is being delivered at a product level.

    3. Value measurement during the lifetime of the product
    4. Validate family roadmap attainment through progression toward the specified product goals.

    For more detail on calculating business value, see Build a Value Measurement Framework.

    To evaluate a product family’s contribution, you need a common definition of value

    Why is having a common value measure important?

    CIO-CEO Alignment Diagnostic

    A stacked bar graph is shown to demonstrate CIO-CEO Alignment Diagnostic. A bar titled Business Value Metrics is highlighted. 51% had some improvement necessary and 32% had significant improvement necessary.

    Over 700 Info-Tech members have implemented the Balanced Value Measurement Framework.

    “The cynic knows the price of everything and the value of nothing.”

    – Oscar Wilde

    “Price is what you pay. Value is what you get.”

    – Warren Buffett

    Understanding where you derive value is critical to building solid roadmaps.

    All value in your product family is not created equal

    Business value is the value of the business outcome the application produces and how effective the product is at producing that outcome. Dissecting value by the benefit type and the value source allows you to see the many ways in which a product or service brings value to your organization. Capture the value of your products in short, concise statements, like an elevator pitch.

    A business value matrix is shown.

    Increase Revenue

    Product or service functions that are specifically related to the impact on your organization’s ability to generate revenue.

    Reduce Costs

    Reduction of overhead. The ways in which your product limits the operational costs of business functions.

    Enhance Services

    Functions that enable business capabilities that improve the organization’s ability to perform its internal operations.

    Reach Customers

    Application functions that enable and improve the interaction with customers or produce market information and insights.

    Financial Benefits vs. Improved Capabilities

    • Financial Benefit refers to the degree to which the value source can be measured through monetary metrics and is often quite tangible.
    • Human Benefit refers to how a product or service can deliver value through a user’s experience.

    Inward vs. Outward Orientation

    • Inward refers to value sources that have an internal impact and improve your organization’s effectiveness and efficiency in performing its operations.
    • Outward refers to value sources that come from your interaction with external factors, such as the market or your customers.

    3.4.1 Validate business value alignment between products and their product families

    30-60 minutes

    1. Draw the 2x2 Business Value Matrix on a flip chart or open the Business Value Matrix tab in the Deliver Digital Products at Scale Workbook to use in this exercise.
    2. Brainstorm and record the different types of business value that your product and product family produce on the sticky notes (one item per sticky note).
    3. As a team, evaluate how the product value delivered contributes to the product family value delivered. Note any gaps or differences between the two.

    Download and complete Build a Value Measurement Framework for full support in focusing product delivery on business value–driven outcomes.

    A business value matrix is shown.

    Output

    • Confirmation of value alignment between product families and their respective products

    Participants

    • Product owners
    • Product managers

    Record the results in the Deliver Digital Products at Scale Workbook.

    Example: Validate business value alignment between products and their product families

    An example of a business value matrix is shown.

    Measure product value with metrics tied to your business value sources and objectives

    Assign metrics to your business value sources

    Business Value Category

    Source Examples

    Metric Examples

    Profit Generation

    Revenue

    Customer Lifetime Value (LTV)

    Data Monetization

    Average Revenue per User (ARPU)

    Cost Reduction

    Reduce Labor Costs

    Contract Labor Cost

    Reduce Overhead

    Effective Cost per Install (eCPI)

    Service Enablement

    Limit Failure Risk

    Mean Time to Mitigate Fixes

    Collaboration

    Completion Time Relative to Deadline

    Customer and Market Reach

    Customer Satisfaction

    Net Promoter Score

    Customer Trends

    Number of Customer Profiles

    The importance of measuring business value through metrics

    The better an organization is at using business value metrics to evaluate IT’s performance, the more satisfied the organization is with IT’s performance as a business partner. In fact, those that say they’re effective at business value metrics have satisfaction scores that are 30% higher than those that believe significant improvements are necessary (Info-Tech’s IT diagnostics).

    Assigning metrics to your prioritized values source will allow you to more accurately measure a product’s value to the organization and identify optimization opportunities. See Info-Tech’s Related Research: Value, Delivery Metrics, Estimation blueprint for more information.

    Your product delivery pipeline connects your roadmap with business value realization

    The effectiveness of your product roadmap needs to be evaluated based on delivery capacity and throughput.

    A product roadmap is shown with additional details to demonstrate delivery capacity and throughput.

    When thinking about product delivery metrics, be careful what you ask for…

    As the saying goes “Be careful what you ask for, because you will probably get it.”

    Metrics are powerful because they drive behavior.

    • Metrics are also dangerous because they often lead to unintended negative outcomes.
    • Choose your metrics carefully to avoid getting what you asked for instead of what you intended.

    It’s a cautionary tale that also offers a low-risk path through the complexities of metrics use.

    For more information on the use (and abuse) of metrics, see Select and Use SDLC Metrics Effectively.

    Measure delivery and success

    Metrics and measurements are powerful tools to drive behavior change and decision making in your organization. However, metrics are highly prone to creating unexpected outcomes, so use them with great care. Use metrics judiciously to uncover insights but avoid gaming or ambivalent behavior, productivity loss, and unintended consequences.

    Build good practices in your selection and use of metrics:

    • Choose the metrics that are as close to measuring the desired outcome as possible.
    • Select the fewest metrics possible and ensure they are of the highest value to your team, the safest from gaming behaviors and unintended consequences, and the easiest to gather and report.
    • Never use metrics for reward or punishment; use them to develop your team.
    • Automate as much metrics gathering and reporting as possible.
    • Focus on trends rather than precise metrics values.
    • Review and change your metrics periodically.

    Phase 4

    Bridge the Gap Between Product Families and Delivery

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    4.1.1 Assess your organization’s readiness to deliver digital product families

    4.2.1 Consider pros and cons for each delivery model relative to how you wish to deliver

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    4.4.1 Discuss traditional vs. product-centric funding methods

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Assess the impacts of product-centric delivery on your teams and org design

    Product delivery can exist within any org structure or delivery model. However, when making the shift toward product management, consider optimizing your org design and product team structure to match your capacity and throughput needs.

    A flowchart is shown to see how the impacts of product-centric delivery can impact team and org designs.

    Info-Tech Note

    Realigning your delivery pipeline and org design takes significant effort and time. Although we won’t solve these questions here, it’s important to identify factors in your current or future models that improve value delivery.

    Step 4.1

    Assess your organization’s delivery readiness

    Activities

    4.1.1 Assess your organization’s readiness to deliver digital product families

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the group’s maturity level when it comes to product delivery

    Maturing product practices enables delivery of product families, not just products or projects

    A flowchart is shown to demonstrate the differences between project lifecycle, hybrid lifecycle, and product lifecycle.

    Just like product owners, product family owners are needed to develop long-term product value, strategy, and delivery. Projects can still be used as the source of funding and change management; however, the product family owner must manage product releases and operational support. The focus of this section will be on aligning product families to one or more releases.

    4.1.1 Assess your organization’s readiness to deliver digital product families

    30-60 minutes

    1. For each question in the Deliver Digital Products at Scale Readiness Assessment, ask yourself which of the five associated maturity statements most closely describes your organization.
    2. As a group, agree on your organization’s current readiness score for each of the six categories.

    A screenshot of the Deliver Digital Products at Scale Readiness Assessment is shown.

    Output

    • Product delivery readiness score

    Participants

    • Product managers
    • Product owners

    Download the Deliver Digital Products at Scale Readiness Assessment.

    Value realization is constrained by your product delivery pipeline

    Value is realized through changes made at the product level. Your pipeline dictates the rate, quality, and prioritization of your backlog delivery. This pipeline connects your roadmap goals to the value the goals are intended to provide.

    An example of a product roadmap is shown with the additional details of the product delivery pipeline being highlighted.

    Product delivery realizes value for your product family

    While planning and analysis are done at the family level, work and delivery are done at the individual product level.

    PRODUCT STRATEGY

    What are the artifacts?

    What are you saying?

    Defined at the family level?

    Defined at the product level?

    Vision

    I want to...

    Strategic focus

    Delivery focus

    Goals

    To get there we need to...

    Roadmap

    To achieve our goals, we’ll deliver...

    Backlog

    The work will be done in this order...

    Release Plan

    We will deliver in the following ways...

    Step 4.2

    Understand your delivery options

    Activities

    4.2.1 Consider pros and cons for each delivery model relative to how you wish to deliver

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the different team configuration options when it comes to delivery and their relevance to how you currently work

    Define the scope of your product delivery strategy

    The goal of your product delivery strategy is to establish streamlined, enforceable, and standardized product management and delivery capabilities that follow industry best practices. You will need to be strategic in how and where you implement your changes because this will set the stage for future adoption. Strategically select the most appropriate products, roles, and areas of your organization to implement your new or enhanced capabilities and establish a foundation for scaling.

    Successful product delivery requires people who are knowledgeable about the products they manage and have a broad perspective of the entire delivery process, from intake to delivery, and of the product portfolio. The right people also have influence with other teams and stakeholders who are directly or indirectly impacted by product decisions. Involve team members who have expertise in the development, maintenance, and management of your selected products and stakeholders who can facilitate and promote change.

    Learn about different patterns to structure and resource your product delivery teams

    The primary goal of any product delivery team is to improve the delivery of value for customers and the business based on your product definition and each product’s demand. Each organization will have different priorities and constraints, so your team structure may take on a combination of patterns or may take on one pattern and then transform into another.

    Delivery Team Structure Patterns

    How Are Resources and Work Allocated?

    Functional Roles

    Teams are divided by functional responsibilities (e.g. developers, testers, business analysts, operations, help desk) and arranged according to their placement in the software development lifecycle (SDLC).

    Completed work is handed off from team to team sequentially as outlined in the organization’s SDLC.

    Shared Service and Resource Pools

    Teams are created by pulling the necessary resources from pools (e.g. developers, testers, business analysts, operations, help desk).

    Resources are pulled whenever the work requires specific skills or pushed to areas where product demand is high.

    Product or System

    Teams are dedicated to the development, support, and management of specific products or systems.

    Work is directly sent to the teams who are directly managing the product or directly supporting the requester.

    Skills and Competencies

    Teams are grouped based on skills and competencies related to technology (e.g. Java, mobile, web) or familiarity with business capabilities (e.g. HR, finance).

    Work is directly sent to the teams who have the IT and business skills and competencies to complete the work.

    See the flow of work through each delivery team structure pattern

    Four delivery team structures are shown. The four are: functional roles, shared service and resource pools, product or system, and skills and competencies.

    Staffing models for product teams

    Functional Roles Shared Service and Resource Pools Product or System Skills and Competencies
    A screenshot of the functional roles from the flow of work example is shown. A screenshot of the shared service and resource pools from the flow of work example is shown. A screenshot of the product or system from the flow of work example is shown. A screenshot of skills and competencies from the flow of work example is shown.
    Pros
      ✓ Specialized resources are easier to staff

      ✓ Product knowledge is maintained

      ✓ Flexible demand/capacity management

      ✓ Supports full utilization of resources

      ✓ Teams are invested in the full life of the product

      ✓ Standing teams enable continuous improvement

      ✓ Teams are invested in the technology

      ✓ Standing teams enable continuous improvement

    Cons
      x Demand on specialists can create bottlenecks

      x Creates barriers to collaboration

      x Unavailability of resources can lead to delays

      x Product knowledge can be lost as resources move

      x Changes in demand can lead to downtime

      x Cross-functional skills make staffing a challenge

      x Technology bias can lead to the wrong solution

      x Resource contention when team supports multiple solutions

    Considerations
      ! Product owners must break requests down into very small components to support Agile delivery as mini-Waterfalls
      ! Product owners must identify specialist requirements in the roadmap to ensure resources are available
      ! Product owners must ensure that there is a sufficient backlog of valuable work ready to keep the team utilized
      ! Product owners must remain independent of technology to ensure the right solution is built
    Use Case
    • When you lack people with cross-functional skills
    • When you have specialists such as those skilled in security and operations who will not have full-time work on the product
    • When you have people with cross-functional skills who can self-organize around the request
    • When you have a significant investment in a specific technology stack

    4.2.1 Consider pros and cons for each delivery model relative to how you wish to deliver

    1. Document your current staffing model for your product delivery teams.
    2. Evaluate the pros and cons of each model, as specified on the previous slide, relative to how you currently work.
    3. What would be the ideal target state for your team? If one model does not completely fit, is there a hybrid option worth considering? For example: Product-Based combined with Shared Service/Resource Pools for specific roles.

    Functional Roles

    Teams are divided by functional responsibilities (e.g. developers, testers, business analysts, operations, help desk) and arranged according to their placement in the software development lifecycle (SDLC).

    Shared Service and Resource Pools

    Teams are created by pulling the necessary resources from pools (e.g. developers, testers, business analysts, operations, help desk).

    Product or System

    Teams are dedicated to the development, support, and management of specific products or systems.

    Skills and Competencies

    Teams are grouped based on skills and competencies related to technology (e.g. Java, mobile, web) or familiarity with business capabilities (e.g. HR, finance).

    Output

    • An understanding of pros and cons for each delivery model and the ideal target state for your team

    Participants

    • Product managers
    • Product owners

    Record the results in the Digital Product Family Strategy Playbook.

    Step 4.3

    Determine your operating model

    Activities

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the potential operating models and what will work best for your organization

    Reminder: Patterns for scaling products

    The alignment of your product families should be considered in your operating model.

    Value Stream Alignment

    Enterprise Applications

    Shared Services

    Technical

    Organizational Alignment

    • Business architecture
      • Value stream
      • Capability
      • Function
    • Market/customer segment
    • Line of business (LoB)
    • Example: Customer group > value stream > products
    • Enabling capabilities
    • Enterprise platforms
    • Supporting apps
    • Example: HR > Workday/Peoplesoft > ModulesSupporting: Job board, healthcare administrator
    • Organization of related services into service family
    • Direct hierarchy does not necessarily exist within the family
    • Examples: End-user support and ticketing, workflow and collaboration tools
    • Domain grouping of IT infrastructure, platforms, apps, skills, or languages
    • Often used in combination with Shared Services grouping or LoB-specific apps
    • Examples: Java, .NET, low-code, database, network
    • Used at higher levels of the organization where products are aligned under divisions
    • Separation of product managers from organizational structure no longer needed because the management team owns product management role

    Ensure consistency in the application of your design principles with a coherent operating model

    What is an operating model?

    An operating model is an abstract visualization, used like an architect’s blueprint, that depicts how structures and resources are aligned and integrated to deliver on the organization’s strategy. It ensures consistency of all elements in the organizational structure through a clear and coherent blueprint before embarking on detailed organizational design

    The visual should highlight which capabilities are critical to attaining strategic goals and clearly show the flow of work so that key stakeholders can understand where inputs flow in and outputs flow out of the IT organization.

    An example of an operating model is shown.

    For more information, see Redesign Your IT Organizational Structure.

    Weigh the pros and cons of IT operating models to find the best fit

    1. LoB/Product Aligned – Decentralized Model: Line of Business, Geographically, Product, or Functionally Aligned
    2. A decentralized IT operating model that embeds specific functions within LoBs/product teams and provides cross-organizational support for their initiatives.

    3. Hybrid Functional: Functional/Product Aligned
    4. A best-of-both-worlds model that balances the benefits of centralized and decentralized approaches to achieve both customer responsiveness and economies of scale.

    5. Hybrid Service Model: Product-Aligned Operating Model
    6. A model that supports what is commonly referred to as a matrix organization, organizing by highly related service categories and introducing the role of the service owner.

    7. Centralized: Plan-Build-Run
    8. A highly typical IT operating model that focuses on centralized strategic control and oversight in delivering cost-optimized and effective solutions.

    9. Centralized: Demand-Develop-Service
    10. A centralized IT operating model that lends well to more mature operating environments. Aimed at leveraging economies of scale in an end-to-end services delivery model.

    There are many different operating models. LoB/Product Aligned and Hybrid Functional align themselves most closely with how products and product families are typically delivered.

    Decentralized Model: Line of Business, Geographically, Product, or Functionally Aligned

    An example of a decentralized model is shown.

    BENEFITS

    DRAWBACKS

    • Organization around functions (FXN) allows for diversity in approach in how areas are run to best serve specific business units needs.
    • Each functional line exists largely independently, with full capacity and control to deliver service at the committed service level agreements.
    • Highly responsive to shifting needs and demands with direct connection to customers and all stages of the solution development lifecycle.
    • Accelerates decision making by delegating authority lower into the FXN.
    • Promotes a flatter organization with less hierarchy and more direct communication with the CIO.
    • Less synergy and integration across what different lines of business are doing can result in redundancies and unnecessary complexity.
    • Higher overall cost to the IT group due to role and technology duplication across different FXN.
    • Inexperience becomes an issue; requires more competent people to be distributed across the FXN.
    • Loss of sight of the big picture – difficult to enforce standards around people/process/technology with solution ownership within the FXN.

    For more information, see Redesign your IT Organizational Structure.

    Hybrid Model: Functional/Product Aligned

    An example of a hybrid model: functional/product aligned is shown.

    BENEFITS

    DRAWBACKS

    • Best of both worlds of centralization and decentralization; attempts to channel benefits from both centralized and decentralized models.
    • Embeds key IT functions that require business knowledge within functional areas, allowing for critical feedback.
    • Balances a holistic IT strategy and architecture with responsiveness to needs of the organization.
    • Achieves economies of scale where necessary through the delivery of shared services that can be requested by the function.
    • May result in excessive cost through role and system redundancies across different functions
    • Business units can have variable levels of IT competence; may result in different levels of effectiveness.
    • No guaranteed synergy and integration across functions; requires strong communication, collaboration, and steering.
    • Cannot meet every business unit’s needs – can cause tension from varying effectiveness of the IT functions placed within the functional areas.

    For more information, see Redesign your IT Organizational Structure.

    Hybrid Model: Product-Aligned Operating Model

    An example of a hybrid model: product-aligned operating model.

    BENEFITS

    DRAWBACKS

    • Focus is on the full lifecycle of a product – takes a strategic view of how technology enables the organization.
    • Promotes centralized backlog around a specific value creator, rather than traditional project focus, which is more transactional.
    • Dedicated teams around the product family ensure that you have all of the resources required to deliver on your product roadmap.
    • Reduces barriers between IT and business stakeholders, focuses on technology as a key strategic enabler.
    • Delivery is largely done through a DevOps methodology.
    • Significant business involvement is required for success within this model, with business stakeholders taking an active role in product governance and potentially product management as well.
    • Strong architecture standards and practices are required to make this successful because you need to ensure that product families are building in a consistent manner and limiting application sprawl.
    • Introduced the need for practice standards to drive consistency in quality of delivered services.
    • May result in increased cost through role redundancies across different squads.

    For more information, see Redesign your IT Organizational Structure.

    Centralized: Plan-Build-Run

    An example of a centralized: Plan-Build-Run is shown.

    BENEFITS

    DRAWBACKS

    • Effective at implementing long-term plans efficiently, separates maintenance and projects to allow each to have the appropriate focus.
    • More oversight over financials; better suited for fixed budgets.
    • Works across centralized technology domains to better align with the business's strategic objectives – allows for a top-down approach to decision making.
    • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
    • Well suited for a project-driven environment that employs Waterfall or a hybrid project management methodology that is less iterative.
    • Not optimized for unpredictable/shifting project demands, as decision making is centralized in the plan function.
    • Less agility to deliver new features or solutions to the customer in comparison to decentralized models.
    • Build (developers) and run (operations staff) are far removed from the business, resulting in lower understanding of business needs (as well as “passing the buck” – from development to operations).
    • Requires strong hand-off processes to be defined and strong knowledge transfer from build to run functions in order to be successful.

    For more information, see Redesign your IT Organizational Structure.

    Centralized: Demand-Develop-Service

    An example of a centralized: Demand-Develop-Service model is shown.

    BENEFITS

    DRAWBACKS

    • Aligns well with an end-to-end services model; constant attention to customer demand and service supply.
    • Centralizes service operations under one functional area to serve shared needs across lines of business.
    • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
    • Elevates sourcing and vendor management as its own strategic function; lends well to managed service and digital initiatives.
    • Development and operations housed together; lends well to DevOps-related initiatives.
    • Can be less responsive to business needs than decentralized models due to the need for portfolio steering to prioritize initiatives and solutions.
    • Requires a higher level of operational maturity to succeed; stable supply functions (service mgmt., operations mgmt., service desk, security, data) are critical to maintaining business satisfaction.
    • Requires highly effective governance around project portfolio, services, and integration capabilities.
    • Effective feedback loop highly dependent on accurate performance measures.

    For more information, see Redesign your IT Organizational Structure.

    Assess how your product scaling pattern impacts your resource delivery model

    Value Stream Alignment

    Enterprise Applications

    Shared Services

    Technical

    Plan-Build-Run:
    Centralized

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Can be used to align high-level families.

    Con: Lacks flexibility at the product level to address shifting priorities in product demand.

    Pro: Supports a factory model.

    Con: Lacks flexibility at the product level to address shifting priorities in product demand.

    Centralized Model 2:
    Demand-Develop-
    Service

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Supports established and stable families.

    Con: Command-and-control nature inhibits Agile DevOps and business agility.

    Pro: Recommended for aligning high-level service families based on user needs.

    Con: Reduces product empowerment, prioritizing demand. Slow.

    Pro: Supports factory models.

    Con: Reduces product empowerment, prioritizing demand. Slow.

    Decentralized Model:
    Line of Business, Product, Geographically, or

    Functionally Aligned

    Pro: Aligns product families to value streams, capabilities, and organizational structure.

    Con: Reduces shared solutions and may create duplicate apps and services.

    Pro: Enterprise apps treated as distinct LoB groups.

    Con: Reduces shared solutions and may create duplicate apps and services.

    Pro: Complements value stream alignment by consolidating shared apps and services.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Fits within other groupings where technical expertise is needed.

    Con: Creates redundancy between localized and shared technical teams.

    Hybrid Model:
    Functional/Product

    Aligned

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Creates redundancy between localized and shared technical teams.

    Hybrid Model:

    Product-Aligned Operating Model

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Requires additional effort to differentiate local vs. shared solutions.

    Pro: Supports multiple patterns of product grouping.

    Con: Creates redundancy between localized and shared technical teams.

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    30-60 minutes

    1. Discuss the intake sources of product work.
    2. Trace the flow of requests down to the functional roles of your delivery team (e.g., developer, QA, operations).
    3. Indicate where key deliverables are produced, particularly those that are built in collaboration.
    4. Discuss the five operating models relative to your current operating model choice. How aligned are you?
    5. Review Info-Tech’s recommendation on the best-aligned operating models for product family delivery. Do you agree or disagree?
    6. Evaluate recommendations against how you operate/work.

    Output

    • Understanding of the relationships between key groups
    • A preferred operating model

    Participants

    • Product owners
    • Product managers
    • Delivery managers

    Record the results in the Digital Product Family Strategy Playbook.

    4.3.1 Understand the relationships between product management, delivery teams, and stakeholders

    An example of activity 4.3.1 to understand the relationships between product management, delivery teams, and stakeholders is shown.

    Output

    • Understanding of the relationships between key groups
    • A preferred operating model

    Participants

    • Product owners
    • Product managers
    • Delivery managers

    Step 4.4

    Identify how to fund product family delivery

    Activities

    4.4.1 Discuss traditional vs. product-centric funding methods

    This step involves the following participants:

    • Product owners
    • Product managers
    • Portfolio managers
    • Delivery managers

    Outcomes of this step

    • An understanding of the differences between product-based and traditional funding methods

    Why is funding so problematic?

    We often still think about funding products like construction projects.

    Three models are shown on the various options to fund projects.

    These models require increasing accuracy throughout the project lifecycle to manage actuals vs. estimates.

    "Most IT funding depends on one-time expenditures or capital-funding mechanisms that are based on building-construction funding models predicated on a life expectancy of 20 years or more. Such models don’t provide the stability or flexibility needed for modern IT investments." – EDUCAUSE

    Reminder: Projects don’t go away. The center of the conversation changes.

    A flowchart is shown to demonstrate the difference between project lifecycle, hybrid lifecycle, and product lifecycle.

    Projects within products

    Regardless of whether you recognize yourself as a product-based or project-based shop, the same basic principles should apply.

    The purpose of projects is to deliver the scope of a product release. The shift to product delivery leverages a product roadmap and backlog as the mechanism for defining and managing the scope of the release.

    Eventually, teams progress to continuous integration/continuous delivery (CI/CD) where they can release on demand or as scheduled, requiring org change management.

    Planning and budgeting for products and families

    Reward for delivering outcomes, not features

    AutonomyFlexibilityAccountability
    Fund what delivers valueAllocate iterativelyMeasure and adjust

    Fund long-lived delivery of value through products (not projects).

    Give autonomy to the team to decide exactly what to build.

    Allocate to a pool based on higher-level business case.

    Provide funds in smaller amounts to different product teams and initiatives based on need.

    Product teams define metrics that contribute to given outcomes.

    Track progress and allocate more (or less) funds as appropriate.

    Info-Tech Insight

    Changes to funding require changes to product and Agile practices to ensure product ownership and accountability.

    The Lean Enterprise Funding Model is an example of a different approach

    An example of the lean enterprise funding model is shown.
    From: Implement Agile Practices That Work

    A flexible funding pool akin to venture capital models is maintained to support innovative ideas and fund proofs of concept for product and process improvements.

    Proofs of concept (POCs) are run by standing innovation teams or a reserve of resources not committed to existing products, projects, or services.

    Every product line has funding for all changes and ongoing operations and support.

    Teams are funded continuously so that they can learn and improve their practices as much as possible.

    Budgeting approaches must evolve as you mature your product operating environment

    TRADITIONAL PROJECTS WITH WATERFALL DELIVERY

    TRADITIONAL PROJECTS WITH AGILE DELIVERY

    PRODUCTS WITH AGILE PROJECT DELIVERY

    PRODUCTS WITH AGILE DELIVERY

    WHEN IS THE BUDGET TRACKED?

    Budget tracked by major phases

    Budget tracked by sprint and project

    Budget tracked by sprint and project

    Budget tracked by sprint and release

    HOW ARE CHANGES HANDLED?

    All change is by exception

    Scope change is routine, budget change is by exception

    Scope change is routine, budget change is by exception

    Budget change is expected on roadmap cadence

    WHEN ARE BENEFITS REALIZED?

    Benefits realization after project completion

    Benefits realization is ongoing throughout the life of the project

    Benefits realization is ongoing throughout the life of the product

    Benefits realization is ongoing throughout life of the product

    WHO “DRIVES”?

    Project Manager

    • Project team delivery role
    • Refines project scope, advocates for changes in the budget
    • Advocates for additional funding in the forecast

    Product Owner

    • Project team delivery role
    • Refines project scope, advocates for changes in the budget
    • Advocates for additional funding in the forecast

    Product Manager

    • Product portfolio team role
    • Forecasting new initiatives during delivery to continue to drive value throughout the life of the product

    Product Manager

  • Product family team role
  • Forecasting new initiatives during delivery to continue to drive value throughout the life of the product
  • Info-Tech Insight

    As you evolve your approach to product delivery, you will be decoupling the expected benefits, forecast, and budget. Managing them independently will improve your ability to adapt to change and drive the right outcomes!

    Your strategy must include the cost to build and operate

    Most investment happens after go-live, not in the initial build!

    An example strategy is displayed that incorporates the concepts of cost to build and operate.

    Adapted from: LookFar

    Info-Tech Insight

    While the exact balance point between development or implementation costs varies from application to application, over 80% of the cost is accrued after go-live.

    Traditional accounting leaves software development CapEx on the table

    Software development costs have traditionally been capitalized, while research and operations are operational expenditures.

    The challenge has always been the myth that operations are only bug fixes, upgrades, and other operational expenditures. Research shows that most post-release work on developed solutions is the development of new features and changes to support material changes in the business. While projects could bundle some of these changes into capital expenditure, much of the business-as-usual work that goes on leaves capital expenses on the table because the work is lumped together as maintenance-related OpEx.

    From “How to Stop Leaving Software CapEx on the Table With Agile and DevOps”

    4.4.1 Discuss traditional vs. product-centric funding methods

    30-60 minutes

    1. Discuss how products and product families are currently funded.
    2. Review how the Agile/product funding models differ from how you currently operate.
    3. What changes do you need to consider in order to support a product delivery model?
    4. For each change, identify the key stakeholders and list at least one action to take.
    5. Record the results in the Digital Product Family Strategy Playbook.

    Output

    • Understanding of funding principles and challenges

    Participants

    • Product owners
    • Product managers
    • Delivery managers

    Record the results in the Digital Product Family Strategy Playbook.

    Phase 5

    Build Your Transformation Roadmap and Communication Plan

    Phase 1Phase 2Phase 3Phase 4Phase 5

    1.1 Understand the organizational factors driving product-centric delivery

    1.2 Establish your organization’s product inventory

    2.1 Determine your approach to scale product families

    2.2 Define your product families

    3.1 Leverage product family roadmaps

    3.2 Use stakeholder management to improve roadmap communication

    3.3 Configure your product family roadmaps

    3.4 Confirm product family to product alignment

    4.1 Assess your organization’s delivery readiness

    4.2 Understand your delivery options

    4.3 Determine your operating model

    4.4 Identify how to fund product family delivery

    5.1 Learn how to introduce your digital product family strategy

    5.2 Communicate changes on updates to your strategy

    5.3 Determine your next steps

    This phase will walk you through the following activities:

    5.1.1 Introduce your digital product family strategy

    5.2.1 Define your communication cadence for your strategy updates

    5.2.2 Define your messaging for each stakeholder

    5.3.1 How do we get started?

    This phase involves the following participants:

    • Product owners
    • Product managers
    • Application leaders
    • Stakeholders

    Step 5.1

    Introduce your digital product family strategy

    Activities

    5.1.1 Introduce your digital product family strategy

    This step involves the following participants:

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Outcomes of this step

    • A completed executive summary presenting your digital product strategy

    Product decisions are traditionally made in silos with little to no cross-functional communication and strategic oversight

    Software delivery teams and stakeholders traditionally make plans, strategies, and releases within their silos and tailor their decisions based on their own priorities. Interactions are typically limited to hand-offs (such as feature requests) and routing of issues and defects back up the delivery pipeline. These silos likely came about through well-intentioned training, mandates, and processes, but they do not sufficiently support today’s need to rapidly release and change platforms.

    Siloed departments often have poor visibility into the activities of other silos, and they may not be aware of the ramifications their decisions have on teams and stakeholders outside of their silo.

    • Silos may make choices that are optimal largely for themselves without thinking of the holistic impact on a platform’s structure, strategy, use cases, and delivery.
    • The business may approve platform improvements without the consideration of the delivery team’s current capacity or the system’s complexity, resulting in unrealistic commitments.
    • Quality standards may be misinterpreted and inconsistently enforced across the entire delivery pipeline.

    In some cases, the only way to achieve greater visibility and communication for all roles across a platform’s lifecycle is implementing an overarching role or team.

    “The majority of our candid conversations with practitioners and project management offices indicate that the platform ownership role is poorly defined and poorly executed.”

    – Barry Cousins

    Practice Lead, Applications – Project & Portfolio Management

    Info-Tech Research Group

    Use stakeholder management and roadmap views to improve communication

    Proactive, clear communication with stakeholders, SMEs, and your product delivery team can significantly improve alignment and agreement with your roadmap, strategy, and vision.

    When building your communication strategy, revisit the work you completed in phase 3 developing your:

    • Roadmap types
    • Stakeholder strategy

    Type

    Quadrant

    Actions

    Players

    High influence, high interest – actively engage

    Keep them updated on the progress of the project. Continuously involve Players in the process and maintain their engagement and interest by demonstrating their value to its success.

    Mediators

    High influence, low interest – keep satisfied

    They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust and including them in important decision-making steps. In turn, they can help you influence other stakeholders.

    Noisemakers

    Low influence, high interest – keep informed

    Try to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using Mediators to help them.

    Spectators

    Low influence, low interest – monitor

    They are followers. Keep them in the loop by providing clarity on objectives and status updates.

    5.1.1 Introduce your digital product family strategy

    30-60 minutes

    This exercise is intended to help you lay out the framing of your strategy and the justification for the effort. A lot of these items can be pulled directly from the product canvas you created in phase 2. This is intended to be a single slide to frame your upcoming discussions.

    1. Update your vision, goals, and values on your product canvas. Determine which stakeholders may be impacted and what their concerns are. If you have many stakeholders, limit to Players and Influencers.
    2. Identify what you need from the stakeholders as a result of this communication.
    3. Keeping in mind the information gathered in steps 1 and 2, describe your product family strategy by answering three questions:
    1. Why do we need product families?
    2. What is in our way?
    3. Our first step will be... ?

    Output

    • An executive summary that introduces your product strategy

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    Example: Scaling delivery through product families

    Why do we need product families?

    • The growth of our product offerings and our company’s movement into new areas of growth mean we need to do a better job scaling our offerings to meet the needs of the organization.

    What is in our way?

    • Our existing applications and services are so dramatically different we are unsure how to bring them together.

    Our first step will be...

    • Taking a full inventory of our applications and services.

    Step 5.2

    Communicate changes on updates to your strategy

    Activities

    5.2.1 Define your communication cadence for your strategy updates

    5.2.2 Define your messaging for each stakeholder

    This step involves the following participants:

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Outcomes of this step

    • A communication plan for when strategy updates need to be given

    5.2.1 Define your communication cadence for your strategy updates

    30 minutes

    Remember the role of different artifacts when it comes to your strategy. The canvas contributes to the What, and the roadmap addresses the How. Any updates to the strategy are articulated and communicated through your roadmap.

    1. Review your currently defined roadmaps, their communication objectives, update frequency, and updates.
    2. Consider the impacted stakeholders and the strategies required to communicate with them.
    3. Fill in your communication cadence and communication method.

    EXAMPLE:

    Roadmap Name

    Audience/Stakeholders

    Communication Cadence

    External Customer Roadmap

    Customers and External Users

    Quarterly (Website)

    Product Delivery Roadmap

    Development Teams, Infrastructure, Architects

    Monthly (By Email)

    Technology Roadmap

    Development Teams, Infrastructure, Architects

    Biweekly (Website)

    Output

    • Clear communication cadence for your roadmaps

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    The “what” behind the communication

    Leaders of successful change spend considerable time developing a powerful change message, i.e. a compelling narrative that articulates the desired end state and makes the change concrete and meaningful to staff.

    The change message should:

    • Explain why the change is needed.
    • Summarize what will stay the same.
    • Highlight what will be left behind.
    • Emphasize what is being changed.
    • Explain how change will be implemented.
    • Address how change will affect various roles in the organization.
    • Discuss the staff’s role in making the change successful.

    Five elements of communicating change

    1. What is the change?
    2. Why are we doing it?
    3. How are we going to go about it?
    4. How long will it take us to do it?
    5. What is the role for each department and individual?

    Source: Cornelius & Associates

    How we engage with the message is just as important as the message itself

    Why are we here?

    Speak to what matters to them

    Sell the improvement

    Show real value

    Discuss potential fears

    Ask for their support

    Be gracious

    5.2.2 (Optional) Define your messaging for each stakeholder

    30 minutes

    It’s one thing to communicate the strategy, it’s another thing to send the right message to your stakeholders. Some of this will depend on the kind of news given, but the majority of this is dependent on the stakeholder and the cadence of communication.

    1. From exercise 5.2.1, take the information on the specific roadmaps, target audience, and communication cadence.
    2. Based on your understanding of the audience’s needs, what would the specific update try to get across?
    3. Pick a specific typical example of a change in strategy that you have gone through. (e.g. Product will be delayed by a quarter; key feature is being substituted for another.)

    EXAMPLE:

    Roadmap Name

    Audience/ Stakeholder

    Communication Cadence

    Messaging

    External Customer Roadmap

    Customers and External Users

    Quarterly (Website)

    Output

    • Messaging plan for each roadmap type

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    Step 5.3

    Determine your next steps

    Activities

    5.3.1 How do we get started?

    This step involves the following participants:

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Outcomes of this step

    • Understanding the steps to get started in your transformation

    Make a plan in order to make a plan!

    Consider some of the techniques you can use to validate your strategy.

    Learning Milestones

    Sprint Zero (AKA Project-before-the-project)

    The completion of a set of artifacts dedicated to validating business opportunities and hypotheses.

    Possible areas of focus:

    Align teams on product strategy prior to build

    Market research and analysis

    Dedicated feedback sessions

    Provide information on feature requirements

    The completion of a set of key planning activities, typically the first sprint.

    Possible areas of focus:

    Focus on technical verification to enable product development alignment

    Sign off on architectural questions or concerns

    An image showing the flowchart of continuous delivery of value is shown.

    Go to your backlog and prioritize the elements that need to be answered sooner rather than later.

    Possible areas of focus:

    Regulatory requirements or questions to answer around accessibility, security, privacy.

    Stress testing any new processes against situations that may occur.

    The “Now, Next, Later” roadmap

    Use this when deadlines and delivery dates are not strict. This is best suited for brainstorming a product plan when dependency mapping is not required.

    Now: What are you going to do now?

    Next: What are you going to do very soon?

    Later: What are you going to do in the future?

    An example of a now, next, later roadmap is shown.

    Source: “Tips for Agile product roadmaps & product roadmap examples,” Scrum.org, 2017

    5.3.1 How do we get started?

    30-60 minutes

    1. Identify what the critical steps are for the organization to embrace product-centric delivery.
    2. Group each critical step by how soon you need to address it:
    • Now: Let’s do this ASAP.
    • Next: Sometime very soon, let’s do these things.
    • Later: Much further off in the distance, let’s consider these things.
  • Record the group results in the Deliver Digital Products at Scale Workbook.
  • Record changes for your product and product family in the Digital Product Family Strategy Playbook.
  • An example of a now, next, later roadmap is shown.

    Source: “Tips for Agile product roadmaps & product roadmap examples,” Scrum.org, 2017

    Output

    • Product family transformation critical steps and basic roadmap

    Participants

    • Product owners and product managers
    • Application leaders
    • Stakeholders

    Record the results in the Digital Product Family Strategy Playbook.

    Record the results in the Deliver Digital Products at Scale Workbook.

    Summary of Accomplishment

    Problem Solved

    The journey to become a product-centric organization is not short or easy. Like with any improvement or innovation, teams need to continue to evolve and mature with changes in their operations, teams, tools, and user needs.You’ve taken a big step completing your product family alignment. This provides a backbone for aligning all aspects of your organization to your enterprise goals and strategy while empowering product teams to find solutions closer to the problem. Continue to refine your model and operations to improve value realization and your product delivery pipelines to embrace business agility. Organizations that are most responsive to change will continue to outperform command-and-control leadership.

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

    Contact your account representative for more information.

    workshops@infotech.com

    1-888-670-8889

    Research Contributors and Experts

    Photo of Emily Archer.

    Emily Archer

    Lead Business Analyst,

    Enterprise Consulting, authentic digital agency

    Emily Archer is a consultant currently working with Fortune 500 clients to ensure the delivery of successful projects, products, and processes. She helps increase the business value returned for organizations’ investments in designing and implementing enterprise content hubs and content operations, custom web applications, digital marketing, and e-commerce platforms.

    Photo of David Berg

    Founder & CTO

    Strainprint Technologies Inc.

    David Berg is a product commercialization expert that has spent the last 20 years of his career delivering product management and business development services across a broad range of industries. Early in his career, David worked with product management and engineering teams to build core network infrastructure products that secure and power the internet we benefit from today. David’s experience also includes working with clean technologies in the area of clean power generation, agritech, and Internet of Things infrastructure. Over the last five years, David has been focused on his latest venture, Strainprint Technologies, a data and analytics company focused on the medical cannabis industry. Strainprint has built the largest longitudinal medical cannabis dataset in the world with the goal to develop an understanding of treatment behavior, interactions, and chemical drivers to guide future product development.

    Kathy Borneman

    Digital Product Owner, SunTrust Bank

    Kathy Borneman is a senior product owner who helps people enjoy their jobs again by engaging others in end-to-end decision making to deliver software and operational solutions that enhance the client experience and allow people to think and act strategically.

    Photro of Charlie Campbell

    Charlie Campbell

    Product Owner, Merchant e-Solutions

    Charlie Campbell is an experienced problem solver with the ability to quickly dissect situations and recommend immediate actions to achieve resolution, liaise between technical and functional personnel to bridge the technology and communication gap, and work with diverse teams and resources to reach a common goal.

    Photo of Yarrow Diamond

    Yarrow Diamond

    Sr. Director, Business Architecture

    Financial Services

    Yarrow Diamond is an experienced professional with expertise in enterprise strategy development, project portfolio management, and business process reengineering across financial services, healthcare and insurance, hospitality, and real estate environments. She has a master’s in Enterprise Architecture from Penn State University, LSSMBB, PMP, CSM, ITILv3.

    Photo of Cari J. Faanes-Blakey

    Cari J. Faanes-Blakey, CBAP, PMI-PBA

    Enterprise Business Systems Analyst,

    Vertex, Inc.

    Cari J. Faanes-Blakey has a history in software development and implementation as a Business Analyst and Project Manager for financial and taxation software vendors. Active in the International Institute of Business Analysis (IIBA), Cari participated on the writing team for the BA Body of Knowledge 3.0 and the certification exam.

    Photo of Kieran Gobey

    Kieran Gobey

    Senior Consultant Professional Services

    Blueprint Software Systems

    Kieran Gobey is an IT professional with 24 years of experience, focused on business, technology, and systems analysis. He has split his career between external and internal customer-facing roles, and this has resulted in a true understanding of what is required to be a Professional Services Consultant. His problem-solving skills and ability to mentor others have resulted in successful software implementations. Kieran’s specialties include deep system troubleshooting and analysis skills, facilitating communications to bring together participants effectively, mentoring, leadership, and organizational skills.

    Photo of Rupert Kainzbauer

    Rupert Kainzbauer

    VP Product, Digital Wallets

    Paysafe Group

    Rupert Kainzbauer is an experienced senior leader with a passion for defining and delivering products that deliver real customer and commercial benefit. Together with a team of highly experienced and motivated product managers, he has successfully led highly complex, multi-stakeholder payments initiatives, from proposition development and solution design through to market delivery. Their domain experience is in building online payment products in high-risk and emerging markets, remittance, prepaid cards, and mobile applications.

    Photo of Saeed Khan

    Saeed Khan

    Founder,

    Transformation Labs

    Saeed Khan has been working in high tech for 30 years in both Canada and the US and has held a number of leadership roles in Product Management over that time. He speaks regularly at conferences and has been writing publicly about technology product management since 2005. Through Transformation Labs, Saeed helps companies accelerate product success by working with product teams to improve their skills, practices, and processes. He is a cofounder of ProductCamp Toronto and currently runs a Meetup group and global Slack community called Product Leaders; the only global community of senior level product executives.

    Photo of Hoi Kun Lo

    Hoi Kun Lo

    Product Owner

    Nielsen

    Hoi Kun Lo is an experienced change agent who can be found actively participating within the IIBA and WITI groups in Tampa, FL and a champion for Agile, architecture, diversity, and inclusion programs at Nielsen. She is currently a Product Owner in the Digital Strategy team within Nielsen Global Watch Technology.

    Photo of Abhishek Mathur

    Abhishek Mathur

    Sr Director, Product Management

    Kasisto, Inc.

    Abhishek Mathur is a product management leader, an artificial intelligence practitioner, and an educator. He has led product management and engineering teams at Clarifai, IBM, and Kasisto to build a variety of artificial intelligence applications within the space of computer vision, natural language processing, and recommendation systems. Abhishek enjoys having deep conversations about the future of technology and helping aspiring product managers enter and accelerate their careers.

    Photo of Jeff Meister

    Jeff Meister

    Technology Advisor and Product Leader

    Jeff Meister is a technology advisor and product leader. He has more than 20 years of experience building and operating software products and the teams that build them. He has built products across a wide range of industries and has built and led large engineering, design, and product organizations. Jeff most recently served as Senior Director of Product Management at Avanade, where he built and led the product management practice. This involved hiring and leading product managers, defining product management processes, solution shaping and engagement execution, and evangelizing the discipline through pitches, presentations, and speaking engagements. Jeff holds a Bachelor’s of Applied Science (Electrical Engineering) and a Bachelor’s of Arts from the University of Waterloo, an MBA from INSEAD (Strategy), and certifications in product management, project management, and design thinking.

    Photo of Vincent Mirabelli

    Vincent Mirabelli

    Principal,

    Global Project Synergy Group

    With over 10 years of experience in both the private and public sectors, Vincent Mirabelli possesses an impressive track record of improving, informing, and transforming business strategy and operations through process improvement, design and re-engineering, and the application of quality to business analysis, project management, and process improvement standards.

    Photo of Oz Nazili

    Oz Nazili

    VP, Product & Growth

    TWG

    Oz Nazili is a product leader with a decade of experience in both building products and product teams. Having spent time at funded startups and large enterprises, he thinks often about the most effective way to deliver value to users. His core areas of interest include Lean MVP development and data-driven product growth.

    Photo of Mark Pearson

    Mark Pearson

    Principal IT Architect, First Data Corporation

    Mark Pearson is an executive business leader grounded in the process, data, technology, and operations of software-driven business. He knows the enterprise software landscape and is skilled in product, technology, and operations design and delivery within information technology organizations, outsourcing firms, and software product companies.

    Photo of Brenda Peshak

    Brenda Peshak

    Product Owner,

    Widget Industries, LLC

    Brenda Peshak is skilled in business process, analytical skills, Microsoft Office Suite, communication, and customer relationship management (CRM). She is a strong product management professional with a Master’s focused in Business Leadership (MBL) from William Penn University.

    Photo of Mike Starkey

    Mike Starkey

    Director of Engineering

    W.W. Grainger

    Mike Starkey is a Director of Engineering at W.W. Grainger, currently focusing on operating model development, digital architecture, and building enterprise software. Prior to joining W.W. Grainger, Mike held a variety of technology consulting roles throughout the system delivery lifecycle spanning multiple industries such as healthcare, retail, manufacturing, and utilities with Fortune 500 companies.

    Photo of Anant Tailor

    Anant Tailor

    Cofounder & Head of Product

    Dream Payments Corp.

    Anant Tailor is a cofounder at Dream Payments where he currently serves as the COO and Head of Product, having responsibility for Product Strategy & Development, Client Delivery, Compliance, and Operations. He has 20+ years of experience building and operating organizations that deliver software products and solutions for consumers and businesses of varying sizes. Prior to founding Dream Payments, Anant was the COO and Director of Client Services at DonRiver Inc, a technology strategy and software consultancy that he helped to build and scale into a global company with 100+ employees operating in seven countries. Anant is a Professional Engineer with a Bachelor’s degree in Electrical Engineering from McMaster University and a certificate in Product Strategy & Management from the Kellogg School of Management at Northwestern University.

    Photo of Angela Weller

    Angela Weller

    Scrum Master, Businessolver

    Angela Weller is an experienced Agile business analyst who collaborates with key stakeholders to attain their goals and contributes to the achievement of the company’s strategic objectives to ensure a competitive advantage. She excels when mediating or facilitating teams.

    Related Info-Tech Research

    Product Delivery

    Deliver on Your Digital Product Vision

    • Build a product vision your organization can take from strategy through execution.

    Build a Better Product Owner

    • Strengthen the product owner role in your organization by focusing on core capabilities and proper alignment.

    Build Your Agile Acceleration Roadmap

    • Quickly assess the state of your Agile readiness and plan your path forward to higher value realization.

    Implement Agile Practices That Work

    • Improve collaboration and transparency with the business to minimize project failure.

    Implement DevOps Practices That Work

    • Streamline business value delivery through the strategic adoption of DevOps practices.

    Extend Agile Practices Beyond IT

    • Further the benefits of Agile by extending a scaled Agile framework to the business.

    Build Your BizDevOps Playbook

    • Embrace a team sport culture built around continuous business-IT collaboration to deliver great products.

    Embed Security Into the DevOps Pipeline

    • Shift security left to get into DevSecOps.

    Spread Best Practices With an Agile Center of Excellence

    • Facilitate ongoing alignment between Agile teams and the business with a set of targeted service offerings.

    Enable Organization-Wide Collaboration by Scaling Agile

    • Execute a disciplined approach to rolling out Agile methods in the organization.

    Application Portfolio Management

    APM Research Center

    • See an overview of the APM journey and how we can support the pieces in this journey.

    Application Portfolio Management for Small Enterprises

    • There is no one-size-fits-all rationalization. Tailor your framework to meet your goals.

    Streamline Application Maintenance

    • Effective maintenance ensures the long-term value of your applications.

    Build an Application Rationalization Framework

    • Manage your application portfolio to minimize risk and maximize value.

    Modernize Your Applications

    • Justify modernizing your application portfolio from both business and technical perspectives.

    Review Your Application Strategy

    • Ensure your applications enable your business strategy.

    Discover Your Applications

    • Most application strategies fail. Arm yourself with the necessary information and team structure for a successful application portfolio strategy.

    Streamline Application Management

    • Move beyond maintenance to ensuring exceptional value from your apps.

    Optimize Applications Release Management

    • Facilitate ongoing alignment between Agile teams and the business with a set of targeted service offerings.

    Embrace Business-Managed Applications

    • Empower the business to implement their own applications with a trusted business-IT relationship.

    Value, Delivery Metrics, Estimation

    Build a Value Measurement Framework

    • Focus product delivery on business value–driven outcomes.

    Select and Use SDLC Metrics Effectively

    • Be careful what you ask for, because you will probably get it.

    Application Portfolio Assessment: End User Feedback

    • Develop data-driven insights to help you decide which applications to retire, upgrade, re-train on, or maintain to meet the demands of the business.

    Create a Holistic IT Dashboard

    • Mature your IT department by measuring what matters.

    Refine Your Estimation Practices With Top-Down Allocations

    • Don’t let bad estimates ruin good work.

    Estimate Software Delivery With Confidence

    • Commit to achievable software releases by grounding realistic expectations.

    Reduce Time to Consensus With an Accelerated Business Case

    • Expand on the financial model to give your initiative momentum.

    Optimize Project Intake, Approval, and Prioritization

    • Deliver more projects by giving yourself the voice to say “no” or “not yet” to new projects.

    Enhance PPM Dashboards and Reports

    • Facilitate ongoing alignment between Agile teams and the business with a set of targeted service offerings.

    Org Design and Performance

    Redesign Your IT Organizational Structure

    • Focus product delivery on business value–driven outcomes.

    Build a Strategic Workforce Plan

    • Have the right people, in the right place, at the right time.

    Implement a New Organizational Structure

    • Reorganizations are inherently disruptive. Implement your new structure with minimal pain for staff while maintaining IT performance throughout the change.

    Improve Employee Engagement to Drive IT Performance

    • Don’t just measure engagement, act on it.

    Set Meaningful Employee Performance Measures

    • Set holistic measures to inspire employee performance.

    Master Organizational Change Management Practices

    • PMOs, if you don't know who is responsible for org change, it's you.

    Bibliography (Product Management)

    “12th Annual State of Agile Report.” VersionOne, 9 April 2018. Web.

    A, Karen. “20 Mental Models for Product Managers.” Product Management Insider, Medium, 2 Aug. 2018. Web.

    Adams, Paul. “Product Teams: How to Build & Structure Product Teams for Growth.” Inside Intercom, 30 Oct. 2019. Web.

    Agile Alliance. “Product Owner.” Agile Alliance. n.d. Web.

    Ambysoft. “2018 IT Project Success Rates Survey Results.” Ambysoft. 2018. Web.

    Banfield, Richard, et al. “On-Demand Webinar: Strategies for Scaling Your (Growing) Enterprise Product Team.” Pluralsight, 31 Jan. 2018. Web.

    Berez, Steve, et al. “How to Plan and budget for Agile at Scale.” Bain & Company, 08 Oct 2019. Web

    Blueprint. “10 Ways Requirements Can Sabotage Your Projects Right From the Start.” Blueprint. 2012. Web.

    Breddels, Dajo, and Paul Kuijten. “Product Owner Value Game.” Agile2015 Conference, Agile Alliance 2015. Web.

    Cagan, Martin. “Behind Every Great Product.” Silicon Valley Product Group. 2005. Web.

    Cohn, Mike. “What Is a Product?” Mountain Goat Software. 6 Sept. 2016. Web.

    Connellan, Thomas K. Inside the Magic Kingdom, Bard Press, 1997.

    Curphey, Mark. “Product Definition.” SlideShare, 25 Feb. 2007. Web.

    “Delegation Poker Product Image.” Management 3.0, n.d. Web.

    Distel, Dominic, et al. “Finding the sweet spot in product-portfolio management.’ McKinsey, 4 Dec. 2020. Web

    Eringa, Ron. “Evolution of the Product Owner.” RonEringa.com, 12 June 2016. Web.

    Fernandes, Thaisa. “Spotify Squad Framework - Part I.” PM101, Medium, 6 Mar. 2017. Web.

    Galen, Robert. “Measuring Product Ownership – What Does ‘Good’ Look Like?” RGalen Consulting, 5 Aug. 2015. Web.

    Halisky, Merland, and Luke Lackrone. “The Product Owner’s Universe.” Agile2016 Conference, Agile Alliance, 2016. Web.

    Kamer, Jurriaan. “How to Build Your Own ‘Spotify Model’.” The Ready, Medium, 9 Feb. 2018. Web.

    Kendis Team. “Exploring Key Elements of Spotify’s Agile Scaling Model.” Scaled Agile Framework, Medium, 23 Jul. 2018. Web.

    Lindstrom, Lowell. “7 Skills You Need to Be a Great Product Owner.” Scrum Alliance, n.d. Web.

    Lukassen, Chris. “The Five Belts Of The Product Owner.” Xebia.com, 20 Sept. 2016. Web.

    McCloskey, Heather. “Scaling Product Management: Secrets to Defeating Common Challenges.” ProductPlan, 12 July 2019. Web.

    McCloskey, Heather. “When and How to Scale Your Product Team.” UserVoice, 21 Feb. 2017. Web.

    Mironov, Rich. “Scaling Up Product Manager/Owner Teams.” Rich Mironov's Product Bytes, Mironov Consulting, 12 Apr. 2014 . Web.

    Overeem, Barry. “A Product Owner Self-Assessment.” Barry Overeem, 6 Mar. 2017. Web.

    Overeem, Barry. “Retrospective: Using the Team Radar.” Barry Overeem, 27 Feb. 2017. Web.

    Pichler, Roman. “How to Scale the Scrum Product Owner.” Roman Pichler, 28 June 2016 . Web.

    Pichler, Roman. “Product Management Framework.” Pichler Consulting Limited, 2014. Web.

    Pichler, Roman. “Sprint Planning Tips for Product Owners.” LinkedIn, 4 Sept. 2018. Web.

    Pichler, Roman. “What Is Product Management?” Pichler Consulting Limited, 26 Nov. 2014. Web.

    Radigan, Dan. “Putting the ‘Flow' Back in Workflow With WIP Limits.” Atlassian, n.d. Web.

    Rouse, Margaret. “Definition: product.” TechTarget, Sept. 2005. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on (Business) Value.” Scrum.org, 30 Nov. 2017. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on Agile Product Management.” Scrum.org, 28 Nov. 2017. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on Product Backlog Management.” Scrum.org, 5 Dec. 2017. Web.

    Schuurman, Robbin. “10 Tips for Product Owners on the Product Vision.” Scrum.org, 29 Nov. 2017. Web.

    Schuurman, Robbin. “Tips for Starting Product Owners.” Scrum.org, 27 Nov. 2017. Web.

    Sharma, Rohit. “Scaling Product Teams the Structured Way.” Monetary Musings, 28 Nov. 2016. Web.

    Shirazi, Reza. “Betsy Stockdale of Seilevel: Product Managers Are Not Afraid To Be Wrong.” Austin Voice of Product, 2 Oct. 2018. Web.

    Steiner, Anne. “Start to Scale Your Product Management: Multiple Teams Working on Single Product.” Cprime, 6 Aug. 2019. Web.

    “The Qualities of Leadership: Leading Change.” Cornelius & Associates, 2016. Web.

    “The Standish Group 2015 Chaos Report.” The Standish Group. 2015. Web.

    Theus, Andre. “When Should You Scale the Product Management Team?” ProductPlan, 7 May 2019. Web.

    Tolonen, Arto. “Scaling Product Management in a Single Product Company.” Smartly.io, 26 Apr. 2018. Web.

    Ulrich, Catherine. “The 6 Types of Product Managers. Which One Do You Need?” Medium, 19 Dec. 2017. Web.

    Verwijs, Christiaan. “Retrospective: Do The Team Radar.” The Liberators, Medium, 10 Feb. 2017. Web.

    Vlaanderen, Kevin. “Towards Agile Product and Portfolio Management”. Academia.edu. 2010. Web.

    Bibliography (Roadmap)

    Bastow, Janna. “Creating Agile Product roadmaps Everyone Understands.” ProdPad, 22 Mar. 2017. Accessed Sept. 2018.

    Bastow, Janna. “The Product Tree Game: Our Favorite Way To Prioritize Features.” ProdPad, 21 Feb. 2016. Accessed Sept. 2018.

    Chernak, Yuri. “Requirements Reuse: The State of the Practice.” 2012 IEEE International Conference, 12 June 2012, Herzliya, Israel. Web.

    Fowler, Martin. “Application Boundary.” MartinFowler.com, 11 Sept. 2003. Accessed 20 Nov. 2017.

    Harrin, Elizabeth. “Learn What a Project Milestone Is.” The Balance Careers, 10 May 2018. Accessed Sept. 2018.

    “How to create a product roadmap.” Roadmunk, n.d. Accessed Sept. 2018.

    Johnson, Steve. “How to Master the 3 Horizons of Product Strategy.” Aha!, 24 Sept. 2015. Accessed Sept. 2018.

    Johnson, Steve. “The Product Roadmap vs. the Technology Roadmap.” Aha!, 23 June 2016. Accessed Sept. 2018

    Juncal, Shaun. “How Should You Set Your Product Roadmap Timeframes?” ProductPlan, Web. Sept. 2018.

    Leffingwell, Dean. “SAFe 4.0.” Scaled Agile, 2017. Web.

    Maurya, Ash. “What is a Minimum Viable Product (MVP).” Leanstack, 12 June 2017. Accessed Sept. 2018.

    Pichler, Roman. “10 Tips for Creating an Agile Product Roadmap.” Roman Pichler, 20 July 2016. Accessed Sept. 2018.

    Pichler, Roman. Strategize: Product Strategy and Product Roadmap Practices for the Digital Age. Pichler Consulting, 2016.

    “Product Roadmap Contents: What Should You Include?” ProductPlan, n.d. Accessed 20 Nov. 2017.

    Saez, Andrea. “Why Your Roadmap Is Not a Release Plan.” ProdPad, 23 October 2015. Accessed Sept. 2018.

    Schuurman, Robbin. “Tips for Agile product roadmaps & product roadmap examples.” Scrum.org, 7 Dec. 2017. Accessed Sept. 2018.

    Bibliography (Vision and Canvas)

    Adams, Paul. “The Future Product Canvas.” Inside Intercom, 10 Jan. 2014. Web.

    “Aligning IT Funding Models to the Pace of Technology Change.” EDUCAUSE, 14 Dec. 2015. Web.

    Altman, Igor. “Metrics: Gone Bad.” OpenView, 10 Nov. 2009. Web.

    Barry, Richard. “The Product Vision Canvas – a Strategic Tool in Developing a Successful Business.” Polymorph, 2019. Web.

    “Business Canvas – Business Models & Value Propositions.” Strategyzer, 2019. Web.

    “Business Model Canvas.” Wikipedia: The Free Encyclopedia, 4 Aug. 2019. Web.

    Charak, Dinker. “Idea to Product: The Working Model.” ThoughtWorks, 13 July 2017. Web.

    Charak, Dinker. “Product Management Canvas - Product in a Snapshot.” Dinker Charak, 29 May 2017. Web.

    Chudley, James. “Practical Steps in Determining Your Product Vision (Product Tank Bristol, Oct. 2018).” LinkedIn SlideShare. Uploaded by cxpartners, 2 Nov. 2018. Web.

    Cowan, Alex. “The 20 Minute Business Plan: Business Model Canvas Made Easy.” COWAN+, 2019. Web.

    Craig, Desiree. “So You've Decided To Become A Product Manager.” Start it up, Medium, 2 June 2019. Web.

    Create an Aha! Business Model Canvas Strategic Model.” Aha! Support, 2019. Web.

    Eick, Stephen. “Does Code Decay? Assessing the Evidence from Change Management Data.” IEEE Transactions on Software Engineering, vol. 27, no. 1, Jan. 2001, pp. 1-12. Web.

    Eriksson, Martin. “The next Product Canvas.” Mind the Product, 22 Nov. 2013. Web.

    “Experience Canvas: a Lean Approach: Atlassian Team Playbook.” Atlassian, 2019. Web.

    Freeman, James. “How to Make a Product Canvas – Visualize Your Product Plan.” Edraw, 23 Dec. 2019. Web.

    Fuchs, Danny. “Measure What Matters: 5 Best Practices from Performance Management Leaders.” OpenGov, 8 Aug. 2018. Web.

    Gorisse, Willem. “A Practical Guide to the Product Canvas.” Mendix, 28 Mar. 2017. Web.

    Gothelf, Jeff. “The Lean UX Canvas.” Jeff Gothelf, 15 Dec. 2016. Web.

    Gottesdiener, Ellen. “Using the Product Canvas to Define Your Product: Getting Started.” EBG Consulting, 15 Jan. 2019. Web.

    Gottesdiener, Ellen. “Using the Product Canvas to Define Your Product's Core Requirements.” EBG Consulting, 4 Feb. 2019. Web.

    Gray, Mark Krishan. “Should I Use the Business Model Canvas or the Lean Canvas?” Emergn, 2019. Web.

    Hanby, Jeff. "Software Maintenance: Understanding and Estimating Costs." LookFar, 21 Oct. 2016. Web.

    “How do you define a product?” Scrum.org, 4 Apr 2017, Web

    Juncal, Shaun. “How to Build a Product Roadmap Based on a Business Model Canvas.” ProductPlan, 19 June 2019. Web.

    “Lean Canvas Intro - Uber Example.” YouTube, uploaded by Railsware Product Academy, 12 Oct. 2018. Web.

    “Lesson 6: Product Canvas.” ProdPad Help Center, 2019. Web.

    Lucero, Mario. “The Product Canvas.” Agilelucero.com, 22 June 2015. Web.

    Maurya, Ash. “Create a New Lean Canvas.” Canvanizer, 2019. Web.

    Maurya, Ash. “Don't Write a Business Plan. Create a Lean Canvas Instead.” LEANSTACK, 2019. Web.

    Maurya, Ash. “Why Lean Canvas vs Business Model Canvas?” Medium, 27 Feb. 2012. Web.

    Mirabelli, Vincent. “The Project Value Canvas.” Vincent Mirabelli, 2019. Web.

    Mishra, LN. “Business Analysis Canvas – The Ultimate Enterprise Architecture.” BA Times, 19 June 2019. Web.

    Muller. Jerry Z. “Why performance metrics isn’t always the best way to judge performance.” Fast Company, 3 April 2019. Web.

    Perri, Melissa. “What Is Good Product Strategy?” Melissa Perri, 14 July 2016. Web.

    Pichler, Roman. “A Product Canvas for Agile Product Management, Lean UX, Lean Startup.” Roman Pichler, 16 July 2012. Web.

    Pichler, Roman. “Introducing the Product Canvas.” JAXenter, 15 Jan. 2013. Web.

    Pichler, Roman. “Roman's Product Canvas: Introduction.” YouTube, uploaded by Roman Pichler, 3 Mar. 2017. Web.

    Pichler, Roman. “The Agile Vision Board: Vision and Product Strategy.” Roman Pichler, 10 May 2011. Web.

    Pichler, Roman. “The Product Canvas – Template.” Roman Pichler, 11 Oct. 2016. Web.

    Pichler, Roman. “The Product Canvas Tutorial V1.0.” LinkedIn SlideShare. Uploaded by Roman Pichler, 14 Feb. 2013. Web.

    Pichler, Roman. “The Product Vision Board: Introduction.” YouTube uploaded by Roman Pichler, 3 Mar. 2017. Web.

    “Product Canvas PowerPoint Template.” SlideModel, 2019. Web.

    Product Canvas.” SketchBubble, 2019, Web.

    “Product Canvas.” YouTube, uploaded by Wojciech Szramowski, 18 May 2016. Web.

    “Product Roadmap Software to Help You Plan, Visualize, and Share Your Product Roadmap.” Productboard, 2019. Web.

    Roggero, Giulio. “Product Canvas Step-by-Step.” LinkedIn SlideShare, uploaded by Giulio Roggero, 18 May 2013. Web.

    Royce, Dr. Winston W. “Managing the Development of Large Software Systems.” Scf.usc.edu, 1970. Web.

    Ryan, Dustin. “The Product Canvas.” Qdivision, Medium, 20 June 2017. Web.

    Snow, Darryl. “Product Vision Board.” Medium, 6 May 2017. Web.

    Stanislav, Shymansky. “Lean Canvas – a Tool Your Startup Needs Instead of a Business Plan.” Railsware, 12 Oct. 2018. Web.

    Stanislav, Shymansky. “Lean Canvas Examples of Multi-Billion Startups.” Railsware, 20 Feb. 2019. Web.

    “The Product Vision Canvas.” YouTube, Uploaded by Tom Miskin, 20 May 2019. Web.

    Tranter, Leon. “Agile Metrics: the Ultimate Guide.” Extreme Uncertainty, n.d. Web.

    “Using Business Model Canvas to Launch a Technology Startup or Improve Established Operating Model.” AltexSoft, 27 July 2018. Web.

    Veyrat, Pierre. “Lean Business Model Canvas: Examples + 3 Pillars + MVP + Agile.” HEFLO BPM, 10 Mar. 2017. Web.

    “What Are Software Metrics and How Can You Track Them?” Stackify, 16 Sept. 2017. Web

    “What Is a Product Vision?” Aha!, 2019. Web.

    Tell Your Story With Data Visualization

    • Buy Link or Shortcode: {j2store}364|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Business Intelligence Strategy
    • Parent Category Link: /business-intelligence-strategy

    Analysts do not feel empowered to challenge requirements to deliver a better outcome. This alongside underlying data quality issues prevents the creation of accurate and helpful information. Graphic representations do not provide meaningful and actionable insights.

    Our Advice

    Critical Insight

    As organizations strive to become more data-driven, good storytelling with data visualization supports growing corporate data literacy and helps analysts in providing insights that improves organization's decision-making and value-driving processes, which ultimately boosts business performance.

    Impact and Result

    Follow a step-by-step guide to address the business bias of tacet experience over data facts and increase audience's understanding and acceptance toward data solutions.

    Save the lost hours and remove the challenges of reports and dashboards being disregarded due to ineffective usage.

    Gain insights from data-driven recommendations and have decision support to make informed decisions.

    Tell Your Story With Data Visualization Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Tell Your Story With Data Visualization Deck – Solve challenging business problems more effectively and improve communication with audiences by demonstrating significant insights through data storytelling with impactful visuals.

    Here is our step-by-step process of getting value out of effective storytelling with data visualization:

  • Step 1: Frame the business problem and the outcomes required.
  • Step 2: Explore the potential drivers and formulate hypotheses to test.
  • Step 3: Construct a meaningful narrative which the data supports.
    • Tell Your Story With Data Visualization Storyboard

    2. Storytelling Whiteboard Canvas Template – Plan out storytelling using Info-Tech’s whiteboard canvas template.

    This storytelling whiteboard canvas is a template that will help you create your visualization story narrative by:

  • Identifying the problem space.
  • Finding logical relationships and data identification.
  • Reviewing analysis and initial insights.
  • Building the story and logical conclusion.
    • Storytelling Whiteboard Canvas Template
    [infographic]

    Further reading

    Tell Your Story With Data Visualization

    Build trust with your stakeholders.

    Analyst Perspective

    Build trust with your stakeholders.

    Data visualization refers to graphical representations of data which help an audience understand. Without good storytelling, however, these representations can distract an audience with enormous amounts of data or even lead them to incorrect conclusions.

    Good storytelling with data visualization involves identifying the business problem, exploring potential drivers, formulating a hypothesis, and creating meaningful narratives and powerful visuals that resonate with all audiences and ultimately lead to clear actionable insights.

    Follow Info-Tech's step-by-step approach to address the business bias of tacit experience over data facts, improve analysts' effectiveness and support better decision making.

    Ibrahim Abdel-Kader, Research Analyst

    Ibrahim Abdel-Kader
    Research Analyst,
    Data, Analytics, and Enterprise Architecture

    Nikitha Patel, Research Specialist

    Nikitha Patel
    Research Specialist,
    Data, Analytics, and Enterprise Architecture

    Ruyi Sun, Research Specialist

    Ruyi Sun
    Research Specialist,
    Data, Analytics, and Enterprise Architecture

    Our understanding of the problem

    This research is designed for

    • Business analysts, data analysts, or their equivalent who (in either a centralized or federated operating model) look to solve challenging business problems more effectively and improve communication with audiences by demonstrating significant insights through visual data storytelling.

    This research will also assist

    • A CIO or business unit (BU) leader looking to improve reporting and analytics, reduce time to information, and embrace decision making.

    This research will help you

    • Identify the business problem and root causes that you are looking to address for key stakeholders.
    • Improve business decision making through effective data storytelling.
    • Focus on insight generation rather than report production.
    • Apply design thinking principles to support the collection of different perspectives.

    This research will help them

    • Understand the report quickly and efficiently, regardless of their data literacy level.
    • Grasp the current situation of data within the organization.

    Executive Summary

    Your Challenge Common Obstacles Info-Tech's Approach
    As analysts, you may experience some critical challenges when presenting a data story.
    • The graphical representation does not provide meaningful or actionable insights.
    • Difficulty selecting the right visual tools or technologies to create visual impact.
    • Lack of empowerment, where analysts don't feel like they can challenge requirements.
    • Data quality issues that prevent the creation of accurate and helpful information.
    Some common roadblocks may prevent you from addressing these challenges.
    • Lack of skills and context to identify the root cause or the insight that adds the most value.
    • Lack of proper design or over-visualization of data will mislead/confuse the audience.
    • Business audience bias, leading them to ignore reliable insights presented.
    • Lack of the right access to obtain data could hinder the process.
    • Understand and dissect the business problem through Info-Tech's guidance on root cause analysis and design thinking process.
    • Explore each potential hypothesis and construct your story's narratives.
    • Manage data visualization using evolving tools and create visual impact.
    • Inform business owners how to proceed and collect feedback to achieve continuous improvement.

    Info-Tech Insight
    As organizations strive to become more data-driven, good storytelling with data visualization supports growing corporate data literacy and helps analysts provide insights that improve organizational decision-making and value-driving processes, which ultimately boosts business performance.

    Glossary

    • Data: Facts or figures, especially those stored in a computer, that can be used for calculating, reasoning, or planning. When data is processed, organized, structured, or presented in a given context to make it useful, it is called information. Data leaders are accountable for certain data domains and sets.
    • Data storytelling: The ability to create a narrative powered by data and analytics that supports the hypothesis and intent of the story. Narrators of the story should deliver a significant view of the message in a way easily understood by the target audience. Data visualization can be used as a tactic to enhance storytelling.
    • Data visualization: The ability to visually represent a complete story to the target audience powered by data & analytics, using data storytelling as an enabling mechanism to convey narratives. Typically, there are two types of visuals used as part of data visualization: explanatory/informative visuals (the entire story or specific aspects delivered to the audience) and exploratory visuals (the collected data used to clarify what questions must be answered).
    • Data literacy: The ability to read, work with, analyze, and argue with data. Easy access to data is essential to exercising these skills. All organizational employees involved with data-driven decisions should learn to think critically about the data they use for analytics and how they assess and interpret the results of their work.
    • Data quality: A measure of the condition of data based on factors such as accuracy, completeness, consistency, reliability, and being up-to-date. This is about how well-suited a data set is to serve its intended purpose, therefore business users and stakeholders set the standards for what is good enough. The governance function along with IT ensures that data quality measures are applied, and corrective actions taken.
    • Analytics/Business intelligence (BI): A technology-driven process for analyzing data and delivering actionable information that helps executives, managers, and workers make informed business decisions. As part of the BI process, organizations collect data from internal IT systems and external sources, prepare it for analysis, run queries against the data, and create data visualizations.
      Note: In some frameworks, analytics and BI refer to different types of analyses (i.e. analytics predict future outcomes, BI describes what is or has been).

    Getting value out of effective storytelling with data visualization

    Data storytelling is gaining wide recognition as a tool for supporting businesses in driving data insights and making better strategic decisions.

    92% of respondents agreed that data storytelling is an effective way of communicating or delivering data and analytics results.

    87% of respondents agreed that if insights were presented in a simpler/clearer manner, their organization's leadership team would make more data-driven decisions.

    93% of respondents agreed that decisions made based on successful data storytelling could potentially help increase revenue.

    Source: Exasol, 2021

    Despite organizations recognizing the value of data storytelling, issues remain which cannot be remedied solely with better technology.

    61% Top challenges of conveying important insights through dashboards are lack of context (61%), over-communication (54%), and inability to customize contents for intended audiences (46%).

    49% of respondents feel their organizations lack storytelling skills, regardless of whether employees are data literate.

    Source: Exasol, 2021

    Info-Tech Insight
    Storytelling is a key component of data literacy. Although enterprises are increasingly investing in data analytics software, only 21% of employees are confident with their data literacy skills. (Accenture, 2020)

    Prerequisite Checklist

    Before applying Info-Tech's storytelling methodology, you should have addressed the following criteria:

    • Select the right data visualization tools.
    • Have the necessary training in statistical analysis and data visualization technology.
    • Have competent levels of data literacy.
    • Good quality data founded on data governance and data architecture best practices.

    To get a complete view of the field you want to explore, please refer to the following Info-Tech resources:

    Select and Implement a Reporting and Analytics Solution

    Build a Data Architecture Roadmap

    Establish Data Governance

    Build Your Data Quality Program

    Foster Data-Driven Culture With Data Literacy

    Info-Tech's Storytelling With Data Visualization Framework

    Data Visualization Framework

    Info-Tech Insight
    As organizations strive to become more data-driven, good storytelling with data visualization supports growing corporate data literacy and helps analysts provide insights that improve organizational decision-making and value-driving processes, which ultimately boosts business performance.

    Research Benefits

    Member Benefits Business Benefits
    • Reduce time spent on getting your audience in the room and promote business involvement with the project.
    • Eliminate ineffectively used reports and dashboards being disregarded for lack of storytelling skills, resulting in real-time savings and monetary impact.
    • Example: A $50k reporting project has a 49% risk of the company being unable to communicate effective data stories (Exasol, 2021). Therefore, a $50k project has an approx. 50% chance of being wasted. Using Info-Tech's methodology, members can remove the risk, saving $25k and the time required to produce each report.
    • Address the common business bias of tacit experience over data-supported facts and increase audience understanding and acceptance of data-driven solutions.
    • Clear articulation of business context and problem.
    • High-level improvement objectives and return on investment (ROI).
    • Gain insights from data-driven recommendations to assist with making informed decisions.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit Guided Implementation Workshop Consulting
    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks are used throughout all four options.

    The State of Black Professionals in Tech

    • Buy Link or Shortcode: {j2store}550|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Engage
    • Parent Category Link: /engage
    • The experience of Black professionals in IT differs from their colleagues.
    • Job satisfaction is also lower for Black IT professionals.
    • For organizations to gain from the benefits of diversity, equity, and inclusion, they need to ensure they understand the landscape for many Black professionals.

    Our Advice

    Critical Insight

    • As an IT leader, you can make a positive difference in the working lives of your team; this is not just the domain of HR.
    • Employee goals can vary depending on the barriers that they encounter. IT leaders must ensure they have an understanding of unique employee needs to better support them, increasing their ability to recruit and retain.
    • Improve the experience of Black IT professionals by ensuring your organization has diversity in leadership and supports mentorship and sponsorship.

    Impact and Result

    • Use the data from Info-Tech’s analysis to inform your DEI strategy.
    • Learn about actions that IT leaders can take to improve the satisfaction and career advancement of their Black employees.

    The State of Black Professionals in Tech Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. The State of Black Professionals in Tech Report – A report providing you with advice on barriers and solutions for leaders of Black employees.

    IT leaders often realize that there are barriers impacting their employees but don’t know how to address them. This report provides insights on the barriers and actions that can help improve the lives of Black professionals in technology.

    • The State of Black Professionals in Tech Report

    Infographic

    Further reading

    The State of Black Professionals in Tech

    Keep inclusion at the forefront to gain the benefits from diversity.

    Analysts' Perspective

    The experience of Black professionals in technology is unique.

    Diversity in tech is not a new topic, and it's not a secret that technology organizations struggle to attract and retain Black employees. Ever since the early '90s, large tech organizations have been dealing with public critique of their lack of diversity. This topic is close to our hearts, but unfortunately while improvements have been made, progress is quite slow.

    In recent years, current events have once again brought diversity to the forefront for many organizations. In addition, the pandemic along with talent trends such as "the great resignation" and "quiet quitting" and preparations for a recession have not only impacted diversity at large but also Black professionals in technology. Our previous research has focused on the wider topic of Recruiting and Retaining People of Color in Tech, but we've found that the experiences of persons of color are not all the same.

    This study focuses on the unique experience of Black professionals in technology. Over 600 people were surveyed using an online tool; interviews provided additional insights. We're excited to share our findings with you.

    This is a picture of Allison Straker This is an image of Ugbad Farah

    Allison Straker
    Research Director
    Info-Tech Research Group

    Ugbad Farah
    Research Director
    Info-Tech Research Group

    Demographics

    In October 2021, we launched a survey to understand what the Black experience is like for people in technology. We wanted and received a variety of responses which would help us to understand how Black technology professionals experienced their working world. We received responses from 633 professionals, providing us with the data for this report.

    For more information on our survey demographics please see the appendix at this end of this report.

    A pie chart showing 26% black and 74% All Other

    26% of our respondents either identified as Black or felt the world sees them as Black.

    Professionals from various countries responded to the survey:

    • Most respondents were born in the US (52%), Canada (14%), India (14%), or Nigeria (4%).
    • Most respondents live in the US (56%), Canada (25%), Nigeria (2%), or the United Kingdom (2%).

    Companies with more diversity achieve more revenue from innovation

    Organizations do better and are more innovative when they have more diversity, a key ingredient in an organization's secret sauce.
    Organizations also benefit from engaged employees, yet we've seen that organizations struggle with both. Just having a certain number of diverse individuals is not enough. When it comes to reaping the benefits of diversity, organizations can flourish when employees feel safe bringing their whole selves to work.

    45% Innovation Revenue by Companies With Above-Average Diversity Scores
    26%

    Innovation Revenue by Companies With Below-Average Diversity Scores

    (Chart source: McKinsey, 2020)


    Companies with higher employee engagement experience 19.2% higher earnings.

    However, those with lower employee engagement experience 32.7% lower earnings.
    (DecisionWise, 2020)

    If your workforce doesn't reflect the community it serves, your business may be missing out on the chance to find great employees and break into new and growing markets, both locally and globally.
    Diversity makes good business sense.
    (Business Development Canada, 2023)

    A study about Black professionals

    Why is this about Black professionals and not other diverse groups?

    While there are a variety of diversity dimensions, it's important to understand what makes up a "multicultural workforce." There is more to diversity than gender, race, and ethnicity. Organizations need to understand that there is diversity within these groups and Black professionals have their own unique experience when it comes to entering and navigating tech that needs to be addressed.

    This image contains two bar graphs from the Brookfield Institute for Innovation and Entrepreneurship. They show the answers to two questions, sorted by the following categories: Black; Non-White; Asian; White. The questions are as follows: I feel comfortable to voice my opinion, even when it differs from the group opinion; I am part of the decision-making process at work.

    (Brookfield Institute for Innovation and Entrepreneurship, 2019)

    The solutions that apply to Black professionals are not only beneficial for Black employees but for all. While all demographics are unique, the solutions in this report can support many.

    Unsatisfied and underrepresented

    Less Black professionals responded as "satisfied" in their IT careers. The question is: How do we mend the Gap?

    Percentage of IT Professionals Who Reported Being Very Satisfied in Their Current Role

    • All Other Professionals: 34%
    • Black Professionals: 23%

    Black workers are underrepresented in most professional roles, especially computer and math Occupations

    A bar graph showing representation of black workers in the total workforce compared to computer and mathematical science occupations.

    The gap in satisfaction

    What's Important?

    Our research suggests that the differences in satisfaction among ethnic groups are related to differences in value systems. We asked respondents to rank what's important, and we explored why.

    Non-Black professionals rated autonomy and their manager working relationships as most important.

    For Black professionals, while those were important, #1 was promotion and growth opportunities, ranked #7 by all other professionals. This is a significant discrepancy.

    Recognition of my work/accomplishments also was viewed significantly differently, with Black professionals ranking it low on the list at #7 and all other professionals considering it very important at #3.

    All Other Professionals

    Black Professionals

    Two columns, containing metrics of satisfaction rated by Black Professionals, and All Other Professionals.

    Maslow's Hierarchy of Needs applies to job satisfaction

    In Maslow's hierarchy, it is necessary for people to achieve items lower on the hierarchy before they can successfully pursue the higher tiers.

    An image of Maslow's Hierarchy of Needs modified to apply to Job Satisfaction

    Too many Black professionals in tech are busy trying to achieve some of the lower parts of the hierarchy; it is stopping them from achieving elements higher up that can lead to job satisfaction.

    This can stop them from gaining esteem, importance, and ultimately, self-actualization. The barriers that impact safety and social belonging happen on a day-to-day basis, and so the day-to-day lives of Black professionals in tech can look very different from their counterparts.

    There are barriers that hinder and solutions that support employees

    An image showing barriers to success An image showing Actions for Success.
    There are various barriers that increase the likelihood for Black professionals to focus on the lower end of the needs hierarchy:

    These are among some of the solutions that, when layered, can support Black professionals in tech in moving up the needs hierarchy.

    Focusing on these actions can support Black professionals in achieving much needed job satisfaction.

    What does this mean?

    The minority experience is not a monolith

    The barriers that Black professionals encounter aren't limited to the same barriers as their colleagues, and too often this means that they aren't in a position to grow their careers in a way that leads to job satisfaction.

    There is a 11% gap between the satisfaction of Black professionals and their peers.

    Early Steps:
    Take time to understand the Black experience.

    As leaders, it's important to be aware that employee goals vary depending on the barriers they're battling with.

    Intermediate:
    If Black employees don't have strong relationships, networks, and mentorships it becomes increasingly difficult to navigate the path to upward mobility.

    As a leader, you can look for opportunities to bridge the gap on these types of conversations.

    Advanced:
    Black professionals in tech are not advancing like their counterparts.

    Creating clear career paths will not only benefit Black employees but also support your entire organization.

    Key metrics:

    • Engagement
    • Committed Executive Leadership
    • Development Opportunities
    • Organizational Programs

    Black respondents are significantly more likely to report barriers to their career advancement

    Common barriers

    Black professionals, like their colleagues, encounter barriers as they try to advance their careers. The barriers both groups encounter include microaggressions, racism, ageism, accessibility issues, sexual orientation, bias due to religion, lack of a career-supported network, gender bias, family status bias, and discrimination due to language/accents.

    What tops the list

    Microaggressions and racism are at the top of these barriers, but Black professionals also deal with other barriers that their colleagues may experience, such as gender-based bias, accessibility issues, religion, and more.

    One of these barriers alone can be difficult to deal with but when they are compounded it can be very difficult to navigate through the working environment in tech.

    A graph charting the impact of the common barriers

    What are microaggressions?

    Microaggression

    A statement, action, or incident regarded as an instance of indirect, subtle, or unintentional discrimination against members of a marginalized group such as a racial or ethnic minority.

    (Oxford Languages, 2023)

    Why are they significant?

    These things may seem innocent enough but the messaging that is received and the lasting impression is often far from it.

    Our research shows that racism and discrimination contribute to poor mental health among Black professionals.

    Examples

    • You're so articulate!
    • How do you always have different hair, can I touch it?
    • Where are you really from?
    • I don't see color.
    • I believe the most qualified person should get the job; everyone can succeed in this society if they work hard enough.

    "The experience of having to question whether something happened to you because of your race or constantly being on edge because your environment is hostile can often leave people feeling invisible, silenced, angry, and resentful."
    Dr. Joy Bradford,
    clinical Psychologist, qtd. In Pfizer

    It takes some time to get in the door

    For too many Black respondents, It took Longer than their peers to Find Technology Jobs.

    Both groups had some success finding jobs in "no time" – however, there was a difference. Thirty-four percent of "all others" found their jobs quickly, while the numbers were less for Black professionals, at 26%. There was also a difference at the opposite end of the spectrum. For 29% of Black professionals, it took seven months or longer to find their IT job, while that number is only 19% for their peers.

    .a graph showing time taken for respondents sorted by black; and all other.

    This points to the need for improvements in recruitment and career advancement.

    29% of Black respondents said that it took them 7 months or longer to find their technology job.

    Compared to 19% of all other professionals that selected the same response.

    And once they're in, it's difficult to advance

    Black Professionals are not Advancing as Quickly as their Colleagues. Especially when you look at their Experience.

    Our research shows that compared to all other ethnicities; Black participants were 55% more likely to report that they had no career advancement/promotion in their career. There is a bigger percentage of Black professionals who have never received a promotion; there's also a large number of Black professionals who have been working a significant amount time in the same role without a promotion.

    .Career Advancement

    A graph showing career advancement for the categories: Black and All Other.

    Black participants were 55% more likely to report that they had had no career advancement/promotion in their career.

    No advancement

    A graph showing the number of respondents who reported no career advancement over time, for the categories: Black; and All Other.

    There's a high cost to lack of engagement

    When employees feel disillusioned with things like career advancement and microaggressions, they often become disengaged. When you continuously have to steel yourself against microaggressions, racism, and other barriers, it prevents you from bringing your whole self to the office. The barriers can lead to what's been coined as "emotional tax." An emotional tax is the experience of feeling different from colleagues because of your inherent diversity and the associated negative effects on health, wellbeing, and the ability to thrive at work.

    Earnings of companies with higher employee engagement

    19.2%

    Earnings of companies with lower employee engagement

    -32.7%

    (DecisionWise, 2020)

    "I've conditioned myself for the corporate world, I don't bring my authentic self to work."
    Anonymous Interview Subject

    Lack of engagement also costs the organization in terms of turnover, something many organizations today are struggling with how to address. Organizations want to increase the ability of the workforce to remain in the organization. For Black employees, this gets harder when they're not engaged and they're the only one. When the emotional tax gets to be too much, this can lead to turnover. Turnover not only costs companies billions in profits, it also negatively impacts leadership diversity. It's difficult to imagine career growth when you don't see anyone that looks like you at the top. It is a challenge to see your future when there aren't others that you can relate to at top levels in the organization, leading to one of our interview subjects to muse, "How long can I last?"

    "Being Black in tech can be hard on your mental health. Your mind is constantly wondering, 'how long can I last?' "
    Anonymous Interview Subject

    Fewer Black professionals feel like they can be their authentic selves at work

    Authentic vs. Successes

    For many Black professionals, "code-switching," or altering the way one speaks and acts depending on context, becomes the norm to make others more comfortable. Many feel that being authentic and succeeding in the workplace are mutually exclusive.

    Programs and Resources

    We asked respondents "What's in place to build an inclusive culture at your company?" Most respondents (51% and 45%) reported that there were employee resource groups at their organizations.

    Do you feel you can be your authentic self at work?

    A bar graph showing 86% for All Other Professions, and 75% for Black Professionals

    A bar graph showing responses to the question What’s in place to build an inclusive culture at your company.

    What can be done?

    An image showing actions for success.

    There are various actions that organizations can take to help address barriers.

    It's important to ensure these are not put in as band-aid solutions but that they are carefully thought out and layered.

    Our findings demonstrate that remote work, career development, and DEI programs along with mentorship and diverse leadership are strong enablers of professional satisfaction. An unfortunate consequence, if professionals are not nurtured, is that we risk losing much needed talent to self-employment or to other organizations.

    There are several solutions

    Respondents were asked to distribute points across potential solutions that could lead to job satisfaction. The ratings showed that there were common solutions that could be leveraged across all groups.

    Respondents were asked what solutions were valuable for their career development.

    All groups were mostly aligned on the order of the solutions that would lead to career satisfaction; however, Black professionals rated the importance of employee resource groups as higher than their colleagues did.

    An image showing how respondents rate a number of categories, sorted into Ratings by Black Professionals, and Ratings by Other Professionals

    Mentorship and sponsorship are seen as key for all employees, as is of course training.

    However, employee resource groups (ERGs) were rated significantly higher for Black professionals and discussions around diversity were higher for their colleagues. This may be because other groups feel a need to learn more about diversity, whereas Black professionals live this experience on a day-to day basis, so it's not as critical for them.

    Double the number of satisfied Black professionals through mentorship and sponsorship

    a bar graph showing the number of very satisfied people with and without mentors/sponsors.

    Mentorship and sponsorship help to close the job satisfaction gap for Black IT professionals. The percentage of satisfied Black employees almost doubles when they have a mentor or sponsorship, moving the satisfaction rate to closer to all other colleagues.

    As leaders, you likely benefit from a few different advisors, and your staff should be able to benefit in the same way.

    They can have their own personal board of advisors, both inside and outside of your organization, helping them to navigate the working world in IT.

    To support your staff, provide guidance and coaching to internal mentors so that they can best support employees, and ensure that your organizational culture supports relationship building and trust.

    While all are critical, coaching, mentoring, and sponsorship are not the same

    Coaching

    Performance-driven guidance geared to support the employee with on-the-job performance. This could be a short-term relationship.

    Mentorship

    A relationship where the mentor provides guidance, information, and expertise to support the long-term career development of the mentee.

    Sponsorship

    The act of advocating on the behalf of another for a position, promotion, development opportunity, etc. over a longer period.

    For more information on setting up a mentorship program, see Optimize the Mentoring Program to Build a High Performing Learning Organization.

    On why mentorship and sponsorship are important:

    "With some degree of mentorship or sponsorship, it means that your ability to thrive or to have a positive experience in organizations increases substantially.

    Mentorship and sponsorship are very often the lynchpin of someone being successful and sticking with an organization.

    Sponsorship is an endorsement to other high-level stakeholders who very often are the gatekeepers of opportunity. Sponsors help to shepherd you through the gate."

    An Image of Carlos Thomas

    Carlos Thomas
    Executive Councilor, Info-Tech Research Group

    What is an employee resource group?

    IT Professionals rated ERGs as the third top driver of success at work

    Employee resource groups enable employees to connect in their workplace based on shared characteristics or life experiences.

    ERGs generally focus on providing support, enhancing career development, and contributing to personal development in the work environment. Some ERGs provide advice to the organization on how they can support their diverse employees.

    As leaders, you should support and encourage the formation of ERGs in your organization.

    What each ERG does will vary according to the needs of employees in your organization. Your role is to enable the ERGs as they are created and maintained.

    On setting up and leveraging employee resource groups:

    "Employee resource groups, when leveraged in an authentically intentional way, can be the some of the most impactful stakeholders in the development and implementation of the organizational diversity, equity, and inclusion strategy.

    ERGs are essential to the development of policies, programs, and initiatives that address the needs of equity-seeking groups and are key to driving organizational culture and employee wellbeing, in addition to hiring and recruitment.

    ERGs must be set up for success by having adequate resources to do the work, which includes adequate budgets, executive sponsorship, training, support, and capacity to do the work. According to a Great Place To Work survey (2021), 50% of ERGs identified the need for adequate resources as a challenge for carrying out the work.:"

    An image of Cinnamon Clark

    CINNAMON CLARK
    PRACTICE LEAD, DIVERSITY, EQUITY AND INCLUSION services, MCLEAN & CO

    There is a gap when it comes to diversity in leadership

    Representation at leadership levels is especially stagnant.

    Black Americans comprise 13.6% of the US population
    (2022 data from the US Census Bureau)

    And yet only 5.9% of the country's CEOs are Black, with only 6 (1%) at the top of Fortune 500 companies.
    (2021 data from the Bureau of Labor Statistics and Fortune.com)

    I've never worked for a company that has Black executives. It's difficult to envision long-term growth with an organization when you don't see yourself represented in leadership.
    – Anonymous Interview Subject

    Having diversity in your leadership team doubles satisfaction

    An image of a bar graph showing satisfaction for those who do, and do not see diversity in their company's leadership.

    Our research shows that Black professionals are more satisfied in their role when they see leaders that look like them.

    Satisfaction of other professionals is not as impacted by diversity in leadership as for Black professionals. Satisfaction doubles in organizations that have a diverse leadership team.

    To reap the benefits from diversity, we need to ensure diversity is not just in entry or mid-level positions and provide employees an opportunity to see diversity in their company's leadership.

    On the need for diversity in leadership:

    "As a Black professional leader, it's not lost on me that I have a responsibility. I have to demonstrate authenticity, professionalism, and exemplary behavior that others can mimic. And I must also showcase that there are possibilities for those coming up in their career. I feel very grateful that I can bestow onto others my knowledge, my experience, my journey, and the tips that I've used to help bring me to be where I am.
    (Having Black leaders in an organization) demonstrates that there is talent across the board, that there are all types of women and people with proficiencies. What it brings to the table is a difference in thoughts and experience.
    A person like myself, sitting at the table, can bring a unique perspective on employee behavior and employee impact. CCL is an organization focused on equity, diversity, and inclusion; for sure having me at the table and others that look like me at the table demonstrates to the public an organization that's practicing what it preaches."

    An image of C. Fara Francis

    C. Fara Francis
    CIO, Center for creative leadership

    Work from home

    While all groups have embraced the work-from-home movement, many Black professionals find it reduces the impact of racial incidents in the workplace.

    Percentage of employees who experienced positive changes in motivation after working remotely.

    Black: 43%; All Other: 43%

    I have to guard and protect myself from experiencing and witnessing racism every day. I am currently working remotely, and I can say for certain my mood and demeanor have improved. Not having to decide if I should address a racist comment or action has made my day easier.
    Source: Slate, 2022

    Remote work significantly led to feelings of better chances for career advancement

    Survey respondents were asked about the positive and negative changes they saw in their interactions and experiences with remote work. Black employees and their colleagues replied similarly, with mostly positive experiences.

    While both groups enjoyed better chances for career advancement, the difference was significantly higher for Black professionals.

    An image of a series of bar graphs showing the effects of remote work on a number of factors.

    Reasons for Self-Employment:

    More Black professionals have chosen self-employment than their colleagues.

    All Other: 26%; Black: 30%.

    A bar graph showing rankings for reasons for self employment, sorted by Black and All Other.

    The biggest reasons for both groups in choosing self-employment were for better pay, career growth, and work/life balance.

    While the desire for better pay was the highest reason for both groups, for engaged employees salary is a lower priority than other concerns (Adecco Group's Global Workforce of the Future report). Consider salary in conjunction with career growth, work/life balance, and the variety in the work that your employees have.

    A bar graph showing rankings for reasons for self employment, sorted by Black and All Other.

    If we don't consider our Black employees, not only do we risk them leaving the organization, but they may decide to just work for themselves.

    Most professionals believe their organizations are committed to diversity, equity, and inclusion

    38% of all respondents believe their organizations are very committed to DEI
    49% believe they are somewhat committed
    9% feel they are not committed
    4% are unsure

    Make sure supports are in place to help your employees grow in their careers:

    Leadership
    IT Leadership Career Planning Research Center

    Diversity and Inclusion Tactics
    IT Diversity & Inclusion Tactics

    Employee Development Planning
    Implement an IT Employee Development Plan

    Belief in your organization's diversity, equity, and inclusion efforts isn't consistent across groups: Make sure actions are seen as genuine

    While organization's efforts are acknowledged, Black professionals aren't as optimistic about the commitment as their peers. Make sure that your programs are reaching the various groups you want to impact, to increase the likelihood of satisfaction in their roles.

    SATISFACTION INCREASES IN BOTH BLACK AND NON-BLACK PROFESSIONALS

    When they believe in their company's commitment to diversity, equity. and inclusion.

    Of those who believe in their organization's commitment, 61% of Black professionals and 67% of non-Black professionals are very satisfied in their roles.

    BELIEVE THEIR ORGANIZATION IS NOT COMMITTED TO DEI

    BELIEVE THEIR ORGANIZATION IS VERY COMMITTED TO DEI

    NON-BLACK PROFESSIONALS

    8%

    41%

    BLACK PROFESSIONALS

    13%

    30%

    Recommendations

    It's important to understand the current landscape:

    • The barriers that Black employees often face.
    • The potential solutions that can help close the gap in employee satisfaction.

    We recognize that resolving this is not easy. Although senior executives are recognizing that a diverse set of experiences, perspectives, and backgrounds is crucial to fostering innovation and competing on the global stage, organizations often don't take the extra step to actively look for racialized talent, and many people still believe that race doesn't play an important part in an individual's ability to access opportunities.

    Look at a variety of solutions that you can implement within your organization; layering solutions is the key to driving business diversity. Always keep in mind that diversity is not a monolith, that the experiences of each demographic varies.

    Info-Tech resources

    Appendix

    About the research

    Diversity in tech survey

    As part of the research process for the State of Black Tech Report, Info-Tech Research Group conducted an open online survey among its membership and wider community of professionals. The survey was fielded from October 2021 to April 2022, collecting 633 responses.

    An image of Page 1 of the Appendix.

    Current Position

    An image of Page 2 of the Appendix.

    Education and Experience

    Education was fairly consistent across both groups, with a few exceptions: more Black professionals had secondary school (9% vs. 4%) and more Black professionals had Doctorate degrees (4% vs. 2%).

    We had more non-Black respondents with 20+ years of experience (31% vs. 19%) and more Black respondents with less than 1 year of experience (8% vs. 5%) – the rest of the years of experience were consistent across the two groups.

    An image of Page 3 of the Appendix.

    It is important to recognize that people are often seen by "the world" as belonging to a different race or set of races than what they personally identify as. Both aspects impact a professional's experience in the workplace.

    An image of Page 4 of the Appendix.

    Bibliography

    Barton, LeRon. “I’m Black. Remote Work Has Been Great for My Mental Health.” Slate, 15 July 2022.

    “Black or African American alone, percent.” U.S. Census Bureau QuickFacts: United States. Accessed 14 February 2023.

    Boyle, Matthew. “More Workers Ready to Quit Over ‘Window Dressing’ Racism Efforts.” Bloomberg.com, 9 June 2022.

    Boyle, Matthew. “Remote Work Has Vastly Improved the Black Worker Experience.” Bloomberg.com, 5 October 2021.

    Cooper, Frank, and Ranjay Gulati. “What Do Black Executives Really Want?” Harvard Business Review, 18 November 2021.

    “Emotional Tax.” Catalyst. Accessed 1 April 2022.

    “Employed Persons by Detailed Occupation, Sex, Race, and Hispanic or Latino Ethnicity” U.S. Bureau of Labor Statistics. Accessed February 14, 2023.

    “Equality in Tech Report - Welcome.” Dice, 9 March 2022. Accessed 23 March 2022.

    Erb, Marcus. "Leaders Are Missing the Promise and Problems of Employee Resource Groups." Great Place To Work, 30 June 2021.

    Gawlak, Emily, et al. “Key Findings - Being Black In Corporate America.” Coqual, Center for Talent Innovation (CTI), 2019.

    “Global Workforce of the Future Research.” Adecco, 2022. Accessed 4 February 2023.

    Gruman, Galen. “The State of Ethnic Minorities in U.S. Tech: 2020.” Computerworld, 21 September 2020. Accessed 31 May 2022.

    Hancock, Bryan, et al. “Black Workers in the US Private Sector.” McKinsey, 21 February 2021. Accessed 1 April 2022.

    “Hierarchy Of Needs Applied To Employee Engagement.” Proactive Insights, 12 February 2020.

    Hobbs, Cecyl. “Shaping the Future of Leadership for Black Tech Talent.” Russell Reynolds Associates, 27 January 2022. Accessed 3 August 2022.

    Hubbard, Lucas. “Race, Not Job, Predicts Economic Outcomes for Black Households.” Duke Today, 16 September 2021. Accessed 30 May 2022.

    Knight, Marcus. “How the Tech Industry Can Be More Inclusive to the Black Community.” Crunchbase, 23 February 2022.

    “Maslow’s Hierarchy of Needs in Employee Engagement (Pre and Post Covid 19).” Vantage Circle HR Blog, 30 May 2022.

    McDonald, Autumn. “The Racism of the ‘Hard-to-Find’ Qualified Black Candidate Trope (SSIR).” Stanford Social Innovation Review, 1 June 2021. Accessed 13 December 2021.

    McGlauflin, Paige. “The Fortune 500 Features 6 Black CEOs—and the First Black Founder Ever.” Fortune, 23 May 2022. Accessed 14 February 2023.

    “Microaggression." Oxford English Dictionary, Oxford Languages, 2023.

    Reed, Jordan. "Understanding Racial Microaggression and Its Effect on Mental Health." Pfizer, 26 August 2020.

    Shemla, Meir “Why Workplace Diversity Is So Important, And Why It’s So Hard To Achieve.” Forbes, 22 August 2018. Accessed 4 February 2023.

    “The State of Black Women in Corporate America.” Lean In and McKinsey & Company, 2020. Accessed 14 January 2022.

    Van Bommel, Tara. “The Power of Empathy in Times of Crisis and Beyond (Report).” Catalyst, 2021. Accessed 1 April 2022.

    Vu, Viet, Creig Lamb, and Asher Zafar. “Who Are Canada’s Tech Workers?” Brookfield Institute for Innovation and Entrepreneurship, January 2019. Accessed on Canadian Electronic Library, 2021. Web.

    Warner, Justin. “The ROI of Employee Engagement: Show Me the Money!” DecisionWise, 1 January 2020. Web.

    White, Sarah K. “5 Revealing Statistics about Career Challenges Black IT Pros Face.” CIO (blog), 9 February 2023. Accessed 5 July 2022.

    Williams, Joan C. “Stop Asking Women of Color to Do Unpaid Diversity Work.” Bloomberg.com, 14 April 2022.

    Williams, Joan C., Rachel Korn, and Asma Ghani. “A New Report Outlines Some of the Barriers Facing Asian Women in Tech.” Fast Company, 13 April 2022.

    Wilson, Valerie, Ethan Miller, and Melat Kassa. “Racial representation in professional occupations.” Economic Policy Institute, 8 June 2021.

    “Workplace Diversity: Why It’s Good for Business.” Business Development Canada (BDC.ca), 6 Feb. 2023. Accessed 4 February 2023.

    Position and Agree on ROI to Maximize the Impact of Data and Analytics

    • Buy Link or Shortcode: {j2store}341|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Data Management
    • Parent Category Link: /data-management
    • Because ROI is a financial concept, it can be difficult to apply ROI to anything that produces intangible value.
    • It is a lot harder to apply ROI to functions like data and analytics than it is to apply it to functions like sales without misrepresenting its true purpose.

    Our Advice

    Critical Insight

    • The standard ROI formula cannot be easily applied to data and analytics and other critical functions across the organization.
    • Data and analytics ROI strategy is based on the business problem being solved.
    • The ROI score itself doesn’t have to be perfect. Key decision makers need to agree on the parameters and measures of success.

    Impact and Result

    • Agreed-upon ROI parameters
    • Defined measures of success
    • Optimized ROI program effectiveness by establishing an appropriate cadence between key stakeholders

    Position and Agree on ROI to Maximize the Impact of Data and Analytics Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Data and Analytics ROI Strategy Deck – A guide for positioning ROI to maximize the value of data and analytics.

    This research is meant to ensure that data and analytics executives are aligned with the key business decision makers. Focus on the value you are trying to achieve rather than perfecting the ROI score.

    • Position and Agree on ROI to Maximize the Impact of Data and Analytics Storyboard

    2. Data and Analytics Service to Business ROI Map – An aligned ROI approach between key decision makers and data and analytics.

    A tool to be used by business and data and analytics decision makers to facilitate discussions about how to approach ROI for data and analytics.

    • Data and Analytics Service to Business ROI Map
    [infographic]

    Further reading

    Position and Agree on ROI to Maximize the Impact of Data and Analytics

    Data and analytics ROI strategy is based on the business problem being solved and agreed-upon value being generated.

    Analyst Perspective

    Missing out on a significant opportunity for returns could be the biggest cost to the project and its sponsor.

    This research is directed to the key decision makers tasked with addressing business problems. It also informs stakeholders that have any interest in ROI, especially when applying it to a data and analytics platform and practice.

    While organizations typically use ROI to measure the performance of their investments, the key to determining what investment makes sense is opportunity cost. Missing out on a significant opportunity for return could be the biggest cost to the project and its sponsor. By making sure you appropriately estimate costs and value returned for all data and analytics activities, you can prioritize the ones that bring in the greatest returns.

    Ibrahim Abdel-Kader
    Research Analyst,
    Data & Analytics Practice
    Info-Tech Research Group
    Ben Abrishami-Shirazi
    Technical Counselor
    Info-Tech Research Group

    Executive Summary – ROI on Data and Analytics

    Your Challenge

    Common Obstacles

    Info-Tech’s Approach

    Return on investment (ROI) is a financial term, making it difficult to articulate value when trying to incorporate anything that produces something intangible.

    The more financial aspects there are to a professional function (e.g. sales and commodity-related functions), the easier it is to properly assess the ROI.

    However, for functions that primarily enable or support business functions (such as IT and data and analytics), it is a lot harder to apply ROI without misrepresenting its true purpose.

    • Apples and oranges – There is no simple way to apply the standard ROI formula to data and analytics among other critical functions across the organization.
    • Boiling the ocean – Obsession with finding a way to calculate a perfect ROI on data and analytics.
    • Not getting the big picture – Data and analytics teams suffer a skill set deficit when it comes to commercial acumen.
    • Not seeing eye to eye – ROI does not account for time in its calculation, making it prone to misalignment between stakeholders.

    Approach ROI for data and analytics appropriately:

    • Answer the following questions:
      • What is the business problem?
      • Whose business problem is it?
      • What is the objective?
    • Define measures of success based on the answers to the questions above.
    • Determine an appropriate cadence to continuously optimize the ROI program for data and analytics in collaboration with business problem owners.

    Info-Tech Insight

    ROI doesn’t have to be perfect. Parameters and measures of success need to be agreed upon with the key decision makers.

    Glossary

    Return on Investment (ROI): A financial term used to determine how much value has been or will be gained or lost based on the total cost of investment. It is typically expressed as a percentage and is supported by the following formula:

    Payback: How quickly money is paid back (or returned) on the initial investment.
    Business Problem Owner (BPO): A leader in the organization who is accountable and is the key decision maker tasked with addressing a business problem through a series of investments. BPOs may use ROI as a reference for how their financial investments have performed and to influence future investment decisions.
    Problem Solver: A key stakeholder tasked with collaborating with the BPO in addressing the business problem at hand. One of the problem solver’s responsibilities is to ensure that there is an improved return on the BPO’s investments.
    Return Enhancers: A category for capabilities that directly or indirectly enhance the return of an investment.
    Cost Savers: A category for capabilities that directly or indirectly save costs in relation of an investment.
    Investment Opportunity Enablers: A category for capabilities that create or enable a new investment opportunity that may yield a potential return.
    Game Changing Components: The components of a capability that directly yield value in solving a business problem.

    ROI strategy on data and analytics

    The image contains a screenshot of a diagram that demonstrates the ROI strategy on data and analytics.

    ROI roles

    Typical roles involved in the ROI strategy across the organization

    CDOs and CAOs typically have their budget allocated from both IT and business units.

    This is evidenced by the “State of the CIO Survey 2023” reporting that up to 63% of CDOs and CAOs have some budget allocated from within IT; therefore, up to 37% of budgets are entirely funded by business executives.

    This signifies the need to be aligned with peer executives and to use mechanisms like ROI to maximize the performance of investments.

    Source: Foundry, “State of the CIO Survey 2023.”

    Integrate Physical Security and Information Security

    • Buy Link or Shortcode: {j2store}383|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations

    Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Integrating physical and information security introduces challenges in:

    • Understanding the value proposition of investment in governing and managing integrated systems, including migration costs, compared to separated security systems.
    • Addressing complex risks and vulnerabilities of an integrated security system.
    • Operationalizing enhanced capabilities created by adoption of emerging and disruptive technologies.

    Our Advice

    Critical Insight

    • Integrate security in people, process, and technology to improve your overall security posture. Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.
    • Plan and engage stakeholders. Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.
    • Enhance strategy and risk management. Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.

    Impact and Result

    Info-Tech's approach is a modular, incremental, and repeatable process to integrate physical and information security to:

    • Ensure the integration will meet the business' needs and determine effort and technical requirements.
    • Establish GRC processes that include integrated risk management and compliance.
    • Design and deploy an integrated security architecture.
    • Establish security metrics of effectiveness and efficiency for senior management and leadership.

    Integrate Physical Security and Information Security Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Integrate Physical Security and Information Security Storyboard – A step-by-step document that walks you through how to integrate physical security and information security.

    Info-Tech provides a three-phased framework for integrating physical security and information security: Plan, Enhance, and Monitor & Optimize.

    • Integrate Physical Security and Information Security Storyboard

    2. Integrate Physical Security and Information Security Requirements Gathering Tool – A tool to map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals.

    This tool serves as a repository for information about security integration elements, compliance, and other factors that will influence your integration of physical security and information security.

    • Integrate Physical Security and Information Security Requirements Gathering Tool

    3. Integrate Physical Security and Information Security RACI Chart Tool – A tool to identify and understand the owners of various security integration stakeholders across the organization.

    Populating a RACI chart (Responsible, Accountable, Consulted, and Informed) is a critical step that will assist you in organizing roles for carrying out integration steps. Complete this tool to assign tasks to suitable roles.

    • Integrate Physical Security and Information Security RACI Chart Tool

    4. Integrate Physical Security and Information Security Communication Deck – A tool to present your findings in a prepopulated document that summarizes the work you have completed.

    Complete this template to effectively communicate your integrated security plan to stakeholders.

    • Integrate Physical Security and Information Security Communication Deck
    [infographic]

    Further reading

    Integrate Physical Security and Information Security

    Securing information security, physical security, or personnel security in silos may not secure much

    Analyst Perspective

    Ensure integrated security success with close and continual collaboration

    From physical access control systems (PACS) such as electronic locks and fingerprint biometrics to video surveillance systems (VSS) such as IP cameras to perimeter intrusion detection and prevention to fire and life safety and beyond: physical security systems pose unique challenges to overall security. Additionally, digital transformation of physical security to the cloud and the convergence of operational technology (OT), internet of things (IoT), and industrial IoT (IIoT) increase both the volume and frequency of security threats.

    These threats can be safety, such as the health impact when a gunfire attack downed wastewater pumps at Duke Energy Substation, North Carolina, US, in 2022. The threats can also be economic, such as theft of copper wire, or they can be reliability, such as when a sniper attack on Pacific Gas & Electric’s Metcalf Substation in California, US, damaged 17 out of 21 power transformers in 2013.

    Considering the security risks organizations face, many are unifying physical, cyber, and information security systems to gain the long-term overall benefits a consolidated security strategy provides.

    Ida Siahaan
    Ida Siahaan

    Research Director, Security and Privacy Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Meanwhile, integrating physical and information security introduces challenges in:

    • Value proposition of investment in governing and managing integrated systems including the migration costs compared to separated security systems.
    • Addressing complex risks and vulnerabilities of an integrated security system.
    • Operationalizing on enhanced capabilities created by adoption of emerging and disruptive technologies.

    Common Obstacles

    Physical security systems integration is complex due to various components such as proprietary devices and protocols and hybrid systems of analog and digital technology. Thus, open architecture with comprehensive planning and design is important.

    However, territorial protection by existing IT and physical security managers may limit security visibility and hinder security integration.

    Additionally, integration poses challenges in staffing, training and awareness programs, and dependency on third-party technologies and their migration plans.

    Info-Tech's Approach

    Info-Tech’s approach is a modular, incremental, and repeatable process to integrate physical and information security that enables organizations to:

    • Determine effort and technical requirements to ensure the integration will meet the business needs.
    • Establish GRC processes including integrated risk management and compliance.
    • Design and deploy integrated security architecture.
    • Establish metrics to monitor the effectiveness and efficiency of the security program.

    Info-Tech Insight

    An integrated security architecture, including people, process, and technology, will improve your overall security posture. These benefits are leading many organizations to consolidate their siloed systems into a single platform across physical security, cybersecurity, HR, legal, and compliance.

    Existing information security models are not comprehensive

    Current security models do not cover all areas of security, especially if physical systems and personnel are involved and safety is also an important property required.

    • The CIA triad (confidentiality, integrity, availability) is a well-known information security model that focuses on technical policies related to technology for protecting information assets.
    • The US Government’s Five Pillars of Information Assurance includes CIA, authentication, and non-repudiation, but it does not cover people and processes comprehensively.
    • The AAA model, created by the American Accounting Association, has properties of authentication, authorization, and accounting but focuses only on access control.
    • Donn Parker expanded the CIA model with three more properties: possession, authenticity, and utility. This model, which includes people and processes, is known as the Parkerian hexad. However, it does not cover physical and personnel security.

    CIA Triad

    The CIA Triad for Information Security: Confidentiality, Integrity, Availability


    Parkerian Hexad

    The Parkerian Hexad for Security: Confidentiality, Possession, Utility, Availability, Authenticity and Integrity

    Sources: Parker, 1998; Pender-Bey, 2012; Cherdantseva and Hilton, 2015

    Adopt an integrated security model

    Adopt an integrated security model which consists of information security, physical security, personnel security, and organizational security.

    The security ecosystem is shifting from segregation to integration

    Security ecosystem is shifting from the past proprietary model to open interfaces and future open architecture

    Sources: Cisco, n.d.; Preparing for Technology Convergence in Manufacturing, Info-Tech Research Group, 2018

    Physical security includes:

    • Securing physical access,
      e.g. facility access control, alarms, surveillance cameras
    • Securing physical operations
      (operational technology – OT), e.g. programmable logic controllers (PLCs), SCADA

    Info-Tech Insight

    Why is integrating physical and information security gaining more and more traction? Because the supporting technologies are becoming more matured. This includes, for example, migration of physical security devices to IP-based network and open architecture.

    Reactive responses to physical security incidents

    April 1995

    Target: Alfred P. Murrah Federal Building, Oklahoma, US. Method: Bombing. Impact: Destroyed structure of 17 federal agencies, 168 casualties, over 800 injuries. Result: Creation of Interagency Security Committee (ISC) in Executive Order 12977 and “Vulnerability Assessment of Federal Facilities” standard.
    (Source: Office of Research Services, 2017)

    April 2013

    Target: Pacific Gas & Electric’s Metcalf Substation, California, US. Method: Sniper attack. Impact: Out of 21 power transformers, 17 were damaged. Result: Creation of Senate Bill No. 699 and NERC- CIP-014 standard.
    (Source: T&D World, 2023)

    Sep. 2022

    Target: Nord Stream gas pipelines connecting Russia to Germany, Baltic sea. Method: Detonations. Impact: Methane leaks (~300,000 tons) at four exclusive economic zones (two in Denmark and two in Sweden). Result: Sweden’s Security Service investigation.
    (Source: CNBC News, 2022)

    Dec. 2022

    Target: Duke Energy Substation, North Carolina, US. Method: Gunfire. Impact: Power outages of ~40,000 customers and wastewater pumps in sewer lift stations down. Result: State of emergency was declared.
    (Source: CBS News, 2022)

    Info-Tech Insight

    When it comes to physical security, we have been mostly reactive. Typically the pattern starts with physical attacks. Next, the impacted organization mitigates the incidents. Finally, new government regulatory measures or private sector or professional association standards are put in place. We must strive to change our pattern to become more proactive.

    Physical security market forecast and top physical security challenges

    Physical security market forecast
    (in billions USD)

    A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.

    A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.

    Source: MarketsandMarkets, 2022

    Top physical security challenges

    An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.

    An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.

    Source: Ontic Center for Protective Intelligence, 2022

    Info-Tech Insight

    The physical security market is growing in systems and services, especially the integration of threat data management with cybersecurity.

    Top physical security initiatives and operations integration investments

    We know the physical security challenges and how the physical security market is growing, but what initiatives are driving this growth? These are the top physical security initiatives and top investments for physical security operations integration:

    Top physical security initiatives

    The number one physical security initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration

    A survey by Brivo asked 700 security professionals about their top physical security initiatives. The number one initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration.

    Source: Brivo, 2022

    Top investments for physical security operations integration

    The number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.

    An Ontic survey (N=359) on areas of investment for physical security operations integration shows the number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.

    Source: Ontic Center for Protective Intelligence, 2022

    Evaluate security integration opportunities with these guiding principles

    Opportunity focus

    • Identify the security integration problems to solve with visible improvement possibilities
    • Don’t choose technology for technology’s sake
    • Keep an eye to the future
    • Use strategic foresight

    Piece by piece

    • Avoid taking a big bang approach
    • Test technologies in multiple conditions
    • Run inexpensive pilots
    • Increase flexibility
    • Build a technology ecosystem

    Buy-in

    • Collaborate with stakeholders
    • Gain and sustain support
    • Maintain transparency
    • Increase uptake of open architecture

    Key Recommendations:

    Focus on your master plan

    Build a technology ecosystem

    Engage stakeholders

    Info-Tech Insight

    When looking for a quick win, consider learning the best internal or external practice. For example, in 1994 IBM reorganized its security operation by bringing security professionals and non-security professionals in one single structure, which reduced costs by approximately 30% in two years.

    Sources: Create and Implement an IoT Strategy, Info-Tech Research Group, 2022; Baker and Benny, 2013; Erich Krueger, Omaha Public Power District (contributor); Doery Abdou, March Networks Corporate (contributor)

    Case Study

    4Wall Entertainment – Asset Owner

    Industry: Architecture & Engineering
    Source: Interview

    4Wall Entertainment is quite mature in integrating its physical and information security; physical security has always been under IT as a core competency.

    4Wall Entertainment is a provider of entertainment lighting and equipment to event venues, production companies, lighting designers, and others, with a presence in 18 US and UK locations.

    After many acquisitions, 4Wall Entertainment needed to standardize its various acquired systems, including physical security systems such as access control. In its integrated security approach, IT owns the integrated security, but they interface with related entities such as HR, finance, and facilities management in every location. This allows them to obtain information such as holidays, office hours, and what doors need to be accessed as inputs to the security system and to get sponsorship in budgeting.

    In the past, 4Wall Entertainment tried delegating specific physical security to other divisions, such as facilities management and HR. This approach was unsuccessful, so IT took back the responsibility and accountability.

    Currently, 4Wall Entertainment works with local vendors, and its biggest challenge is finding third-party vendors that can provide nationwide support.

    In the future, 4Wall Entertainment envisions physical security modernization such as camera systems that allow more network accessibility, with one central system to manage and IoT device integration with SIEM and MDR.

    Results

    Lessons learned in integrating security from 4Wall Entertainment include:

    • Start with forming relationships with related divisions such as HR, finance, and facilities management to build trust and encourage sponsorship across management.
    • Create policies, procedures, and standards to deploy in various systems, especially when acquiring companies with low maturity in security.
    • Select third-party providers that offer the required functionalities, good customer support, and standard systems interoperability.
    • Close skill gaps by developing training and awareness programs for users, especially for newly acquired systems and legacy systems, or by acquiring expertise from consulting services.
    • Complete cost-benefit analysis for solutions on legacy systems to determine whether to keep them and create interfacing with other systems, upgrade them, or replace them entirely with newer systems.
    • Delegate maintenance of specific highly regulated systems, such as fire alarms and water sprinklers, to facilities management.
    Integration of Physical and Information Security Framework. Inputs: Integrated Items, Stakeholders, and Security Components. Phases, Outcomes and Benefits: Plan, Enhance and Monitor & Optimize.

    Tracking progress of physical and information security integration

    Physical security is often part of facilities management. As a result, there are interdependencies with both internal departments (such as IT, information security, and facilities) and external parties (such as third-party vendors). IT leaders, security leaders, and operational leaders should keep the big picture in mind when designing and implementing integration of physical and information security. Use this checklist as a tool to track your security integration journey.

    Plan

    • Engage stakeholders and justify value for the business.
    • Define roles and responsibilities.
    • Establish/update governance for integrated security.
    • Identify integrated elements and compliance obligations.

    Enhance

    • Determine the level of security maturity and update security strategy for integrated security.
    • Assess and treat risks of integrated security.
    • Establish/update integrated physical and information security policies and procedures.
    • Update incident response, disaster recovery, and business continuity plan.

    Monitor & Optimize

    • Identify skill requirements and close skill gaps for integrating physical and information security.
    • Design and deploy integrated security architecture and controls.
    • Establish, monitor, and report integrated security metrics on effectiveness and efficiency.

    Benefits of the security integration framework

    Today’s matured technology makes security integration possible. However, the governance and management of single integrated security presents challenges. These can be overcome using a multi-phased framework that enables a modular, incremental, and repeatable integration process, starting with planning to justify the value of investment, then enhancing the integrated security based on risks and open architecture. This is followed by using metrics for monitoring and optimization.

    1. Modular

      • Implementing a consolidated security strategy is complex and involves the integration of process, software, data, hardware, and network and infrastructure.
      • A modular framework will help to drive value while putting in appropriate guardrails.
    2. Incremental

      • Integration of physical security and information security involves many components such as security strategy, risk management, and security policies.
      • An incremental framework will help track, manage, and maintain each step while providing appropriate structure.
    3. Repeatable

      • Integration of physical security and information security is a journey that can be approached with a pilot program to evaluate effectiveness.
      • A repeatable framework will help to ensure quick time to value and enable immediate implementation of controls to meet operational and security requirements.

    Potential risks of the security integration framework

    Just as medicine often comes with side effects, our Integration of Physical and Information Security Framework may introduce risks too. However, as John F. Kennedy, thirty-fifth president of the United States, once said, "There are risks and costs to a program of action — but they are far less than the long-range cost of comfortable inaction."

    Plan Phase

    • Lack of transparency in the integration process can lead to lack of trust among stakeholders.
    • Lack of support from leadership results in unclear governance or lack of budget or human resources.
    • Key stakeholders leave the organization during the engagement and their replacements do not understand the organization’s operation yet.

    Enhance Phase

    • The risk assessment conducted focuses too much on IT risk, which may not always be applicable to physical security systems nor OT systems.
    • The integrated security does not comply with policies and regulations.

    Monitor and Optimize Phase

    • Lack of knowledge, training, and awareness.
    • Different testing versus production environments.
    • Lack of collected or shared security metrics.

    Data

    • Data quality issues and inadequate data from physical security, information security, and other systems, e.g. OT, IoT.
    • Too much data from too many tools are complex and time consuming to process.

    Develop an integration of information security, physical security, and personnel security that meets your organization’s needs

    Integrate security in people, process, and technology to improve your overall security posture

    Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.

    Plan and engage stakeholders

    Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.

    Enhance strategy and risk management

    Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.

    Monitor and optimize

    Find the most optimized architecture that is strategic, realistic, and based on risk. Next, perform an evaluation of the security systems and program by understanding what, where, when, and how to measure and to report the relevant metrics.

    Focus on master plan

    Identify the security integration problems to solve with visible improvement possibilities, and don’t choose technology for technology’s sake. Design first, then conduct market research by comparing products or services from vendors or manufacturers.

    Build a technology ecosystem

    Avoid a big bang approach and test technologies in multiple conditions. Run inexpensive pilots and increase flexibility to build a technology ecosystem.

    Deliverables

    Each step of this framework is accompanied by supporting deliverables to help you accomplish your goals:

    Integrate Physical Security and Information Security Requirements Gathering Tool

    Map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals. Identify your security integration elements and compliance.

    Integrate Physical Security and Information Security RACI Chart Tool

    Identify various security integration stakeholders across the organization and assign tasks to suitable roles.

    Key deliverable:

    Integrate Physical Security and Information Security Communication Deck

    Present your findings in a prepopulated document that summarizes the work you have completed.

    Plan

    Planning is foundational to engage stakeholders. Start with justifying the value of investment, then define roles and responsibilities, update governance, and finally identify integrated elements and compliance obligations.

    Plan

    Engage stakeholders

    • To initiate communication between the physical and information security teams and other related divisions, it is important to identify the entities that would be affected by the security integration and involve them in the process to gain support from planning to delivery and maintenance.
    • Possible stakeholders:
      • Executive leadership, Facilities Management leader and team, IT leader, Security & Privacy leader, compliance officer, Legal, Risk Management, HR, Finance, OT leader (if applicable)
    • A successful security integration depends on aligning your security integration initiatives and migration plan to the organization’s objectives by engaging the right people to communicate and collaborate.

    Info-Tech Insight

    It is important to speak the same language. Physical security concerns safety and availability, while information security concerns confidentiality and integrity. Thus, the two systems have different goals and require alignment.

    Similarly, taxonomy of terminologies needs to be managed,1 e.g. facility management with an emergency management background may have a different understanding from a CISO with an information security background when discussing the same term. For example:

    In emergency management prevention means “actions taken to eliminate the impact of disasters in order to protect lives, property and the environment, and to avoid economic disruption.”2

    In information security prevention is “preventing the threats by understanding the threat environment and the attack surfaces, the risks, the assets, and by maintaining a secure system.”3

    Sources: 1 Owen Yardley, Omaha Public Power District (contributor); 2 Translation Bureau, Government of Canada, n.d.; 3 Security Intelligence, 2020


    Map organizational goals to integrated security goals

    Input

    • Corporate, IT, and Facilities strategies

    Output

    • Your goals for the integrated security strategy

    Materials

    • Integrate Physical Security and Information Security Requirements Gathering Tool

    Participants

    • Executive leadership
    • Facilities Management leader and team
    • IT leader
    • Security & Privacy leader
    • Compliance officer
    • Legal
    • Risk Management
    • HR & Finance
    • OT leader (if applicable)
    1. As a group, brainstorm organization goals.
      • Review relevant corporate, IT, and facilities strategies.
    2. Record the most important business goals in the “Goals Cascade” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool. Try to limit the number of business goals to no more than ten goals. This limitation will be critical to helping focus on your integrated security goals.
    3. For each goal, identify one to two security alignment goals. These should be objectives for the security strategy that will support the identified organization goals.

    Download the Integrate Physical Security and Information Security Requirements Gathering Tool.

    Record organizational goals

    A table to identify Organization, IT, OT(if applicable), Facilities, and Security Goals Definitions.

    Refer to the Integration of Physical and Information Security Framework when filling in the table.

    1. Record your identified organizational goals in the “Goals Cascade” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
    2. For each organizational goal, identify IT alignment goals.
    3. For each organizational goal, identify OT alignment goals (if applicable).
    4. For each organizational goal, identify Facilities alignment goals.
    5. For each organizational goal, select an integrated security goal from the drop-down menu.

    Justify value for the business

    Facilities in most cases have a team that is responsible for physical security installations such as access key controllers. Whenever there is an issue, they contact the provider to fix the error. However, with smart buildings and smart devices, the threat surface grows to include information security threats, and Facilities may not possess the knowledge and skills required to deal with them. At the same time, delegating physical security to IT may add more tasks to their already-too-long list of responsibilities. Consolidating security to a focused security team that covers both physical and information security can help.1 We need to develop the security integration business case beyond physical security "gates, guns, and guards" mentality.2

    An example of a cost-benefit analysis for security integration:

    Benefits

    Metrics

    Operational Efficiency and Cost Savings

    • Reduction in deployment, maintenance, and staff time in manual operations of physical security devices such as logs collection from analog cameras to be automated into digital.
    • Reduction in staffing costs by bringing physical security SOC and information security SOC in one single structure.

    Reliability Improvements

    • Reduction in field crew time by identifying hardware that can be virtualized to have a centralized remote control.
    • Improvement of operating reliability through continuous and real-time monitoring of equipment such as door access control systems and camera surveillance systems.

    Customers & Users Benefits

    • Improvement of customer safety for essential services such as access to critical locations only by authorized personnel.
    • Improvement of reliability of services and address human factor in adoption of change by introducing change as a friendly activity.

    Cost

    Metrics

    Equipment and Infrastructure

    • Upgrade of existing physical security equipment, e.g. replacement of separated access control, video management system (VMS), and physical access control system (PACS) with a unified security platform.
    • Implementation of communication network equipment and labor to install, configure, and maintain the new network component.

    Software and Commission

    • The software and maintenance fee as well as upgrade implementation project cost.
    • Labor cost of field commissioning and troubleshooting.
    • Integration with security systems, e.g. event and log management, continuous monitoring, and investigation.

    Support and Resources

    • Cost to hire/outsource security FTEs for ongoing management and operation of security devices, e.g. SOC, MSSP.
    • Cost to hire/outsource FTEs to analyze, design, and deploy the integrated security architecture, e.g. consulting fee.

    Sources: 1 Andrew Amaro, KLAVAN Security Services (contributor); 2 Baker and Benny, 2013;
    Industrial Control System Modernization, Info-Tech Research Group, 2023; Lawrence Berkeley National Laboratory, 2021

    Plan

    Define roles and responsibilities

    Input

    • List of relevant stakeholders

    Output

    • Roles and responsibilities for the integration of physical and information security program

    Materials

    • Integrate Physical Security and Information Security RACI Chart Tool

    Participants

    • Executive leadership
    • Facilities Management leader and team
    • HR & Finance
    • IT leader and team
    • OT leader and team
    • Security & Privacy leader and team

    Many factors impact an organization’s level of effectiveness as it relates to integration of physical and information security. How the team interacts, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, we need to identify stakeholders that are:

    • Responsible: The person(s) who does the work to accomplish the activity; they have been tasked with completing the activity and/or getting a decision made.
    • Accountable: The person(s) who is accountable for the completion of the activity. Ideally, this is a single person and is often an executive or program sponsor.
    • Consulted: The person(s) who provides information. This is usually several people, typically called subject matter experts (SMEs).
    • Informed: The person(s) who is updated on progress. These are resources that are affected by the outcome of the activities and need to be kept up to date.

    Download the Integrate Physical Security and Information Security RACI Chart Tool

    Define RACI chart

    Define Responsible, Accountable, Consulted, Informed (RACI) stakeholders.

    1. Customize the Work Units to best reflect your operation with applicable stakeholders.
    2. Customize the Action rows as required.

    Integrate Physical Security and Information Security RACI Chart

    Sources: ISC, 2015; ISC, 2021

    Info-Tech Insight

    The roles and responsibilities should be clearly defined. For example, IT Security should be responsible for the installation and configuration of all physical access controllers and devices, and facility managers should be responsible for the physical maintenance including malfunctioning such as access device jammed or physically broken.

    Plan

    Establish/update governance for integrated security

    HR & Finance

    HR provides information such as new hires and office hours as input to the security system. Finance assists in budgeting.

    Security & Privacy

    The security and privacy team will need to evaluate solutions and enforce standards on various physical and information security systems and to protect data privacy.

    Business Leaders

    Business stakeholders will provide clarity for their strategy and provide input into how they envision security furthering those goals.

    IT Executives

    IT stakeholders will be a driving force, ensuring all necessary resources are available and funded.

    Facilities/ Operations

    Operational plans will include asset management, monitoring, and support to meet functional goals and manage throughout the asset lifecycle.

    Infrastructure & Enterprise Architects

    Each solution added to the environment will need to be chosen and architected to meet business goals and security functions.

    Info-Tech Insight

    Assemble the right team to ensure the success of your integrated security ecosystem and decide the governance model, e.g. security steering committee (SSC) or a centralized single structure.

    Adapted from Create and Implement an IoT Strategy, Info-Tech Research Group, 2022

    What does the SSC do?

    Ensuring proper governance over your security program is a complex task that requires ongoing care and feeding from executive management to succeed.

    Your SSC should aim to provide the following core governance functions for your security program:

    1. Define Clarity of Intent and Direction

      How does the organization’s security strategy support the attainment of the business, IT, facilities management, and physical and information security strategies? The SSC should clearly define and communicate strategic linkage and provide direction for aligning security initiatives with desired outcomes.
    2. Establish Clear Lines of Authority

      Security programs contain many important elements that need to be coordinated. There must be clear and unambiguous authority, accountability, and responsibility defined for each element so lines of reporting/escalation are clear and conflicting objectives can be mediated.
    3. Provide Unbiased Oversight

      The SSC should vet the organization’s systematic monitoring processes to ensure there is adherence to defined risk tolerance levels and that monitoring is appropriately independent from the personnel responsible for implementing and managing the security program.
    4. Optimize Security Value Delivery

      Optimized value delivery occurs when strategic objectives for security are achieved and the organization’s acceptable risk posture is attained at the lowest possible cost. This requires constant attention to ensure controls are commensurate with any changes in risk level or appetite.

    Adapted from Improve Security Governance With a Security Steering Committee , Info-Tech Research Group, 2018

    Plan

    Identify integrated elements and compliance obligations

    To determine what elements need to be integrated, it’s important to scope the security integration program and to identify the consequences of integration for compliance obligations.

    INTEGRATED ELEMENTS

    What are my concerns?

    Process integrations

    Determine which processes need to be integrated and how

    • Examples: Security prevention, detection, and response; risk assessment

    Software and data integration

    Determine which software and data need to be integrated and how

    • Examples: Threat management tools, SIEM, IDPS, security event logs

    Hardware integration

    Determine which hardware needs to be integrated and how

    • Examples: Sensors, alarms, cameras, keys, locks, combinations, and card readers

    Network and infrastructure

    Determine which network and infrastructure components need to be integrated and how

    • Example: Network segmentation for physical access controllers.

    COMPLIANCE

    How can I address my concerns?

    Regulations

    Adhere to mandatory laws, directives, industry standards, specific contractual obligations, etc.

    • Examples: NERC CIP (North American Utilities), Network and Information Security (NIS) Directive (EU), Health and Safety at Work etc Act 1974 (UK), Occupational Safety and Health Act, 1970 (US), Emergency Management Act, 2007 (Canada)

    Standards

    Adhere to voluntary standards and obligations

    • Examples: NIST Cybersecurity Framework (CSF), The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard (US), Cybersecurity Maturity Model Certification (CMMC), Service Organization Control (SOC 1 and 2)

    Guidelines

    Adopt guidelines that can improve the integrated security program

    • Examples: Best Practices for Planning and Managing Physical Security Resources (US Interagency Security Committee), Information Security Manual - Guidelines for Physical Security (Australian Cyber Security Centre), 1402-2021-Guide for Physical Security of Electric Power Substations (IEEE)

    Record integrated elements

    Scope and Boundaries from the Integrate Physical Security and Information Security Requirements Gathering Tool.

    Refer to the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool when filling in the following elements.

    1. Record your integrated elements, i.e. process integration, software and data integration, hardware integration, network and infrastructure, and physical scope of your security integration, in the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
    2. For each of your scoping give the rationale for including them in the Comments column. Careful attention should be paid to any elements that are not in scope.

    Record your compliance obligations

    Refer to the “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.

    1. Identify your compliance obligations. These can include both mandatory and voluntary obligations. Mandatory obligations include:
      • Laws
      • Government regulations
      • Industry standards
      • Contractual agreements
      Voluntary obligations include standards that the organization has chosen to follow for best practices and any obligations that are required to maintain certifications. Organizations will have many different compliance obligations. For the purposes of your integrated security, include those that include physical security requirements.
    2. Record your compliance obligations, along with any notes, in your copy of the Integrate Physical Security and Information Security Requirements Gathering Tool.
    3. Refer to the “Compliance DB” tab for lists of standards/regulations/ guidelines.
    The “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.

    Remediate third-party compliance gaps

    If you have third-party compliance gaps, there are four primary ways to eliminate them:

    1. Find a New, Compliant Partner

      Terminate existing contract and find another organization to partner with.
    2. Bring the Capability In-House

      Expense permitting, this may be the best way to protect yourself.
    3. Demand Compliance

      Tell the third party they must become compliant. Make sure you set a deadline.
    4. Accept Noncompliance and Assume the Risk

      Sometimes remediation just isn’t cost effective and you have no choice.

    Follow Contracting Best Practices to Mitigate the Risk of Future Third-Party Compliance Gaps

    1. Perform Initial Due Diligence: Request proof of third-party compliance prior to entering into a contract.
    2. Perform Ongoing Due Diligence: Request proof of third-party contractor compliance annually.
    3. Contract Negotiation: Insert clauses requesting periodic assertions of compliance.

    View a sample contract provided by the US Department of Health and Human Services.

    Source: Take Control of Compliance Improvement to Conquer Every Audit, Info-Tech Research Group, 2015

    Pitfalls to avoid when planning security integration

    • No Resources Lineups

      Integration of security needs support from leadership, proper planning, and clear and consistent communication across the organization.
    • Not Addressing Holistic Security

      Create policies and procedures and follow standards that are holistic and based on threats and risks, e.g. consolidated access control policies.
    • Lack of Governance

      While the IT department is a critical partner in cybersecurity, the ownership of such a role sits squarely in the organizational C-suite, with regular reporting to the board of directors (if applicable).
    • Overlooking Business Continuity Effort

      IT and physical security are integral to business continuity and disaster recovery strategies.
    • Not Having Relevant Training and Awareness

      Provide a training and awareness program based on relevant attack vectors. Trained employees are key assets to the development of a safe and secure environment. They must form the base of your security culture.
    • Overbuilding or Underbuilding

      Select third-party providers that offer systems interoperability with other security tools. The intent is to promote a unified approach to security to avoid a cumbersome tooling zoo.

    Sources: Real Time Networks, 2022; Andrew Amaro, KLAVAN Security Services (contributor)

    Enhance

    Enhancing is the development of an integrated security strategy, policies, procedures, BCP, DR, and IR based on the organization’s risks.

    Enhance

    Determine the level of security maturity and update the security strategy

    • Before updating your security strategies, you need to understand the organization’s business strategies, IT strategies, facilities strategies, and physical and information security strategies. The goal is to align your integrated security strategies to contribute to your organization’s success.
    • The integrated security leaders need to understand the direction of the organization. For example:
      • Growth expectation
      • Expansions or mergers anticipation
      • Product or service changes
      • Regulatory requirements
    • Wise security investments depend on aligning your security initiatives to the organization’s objectives by supporting operational performance and ensuring brand protection and shareholder values.
    Integrated security strategies. Consists of an organization’s business strategies, IT strategies, facilities strategies, and physical and information security strategies.

    Sources: Amy L. Meger, Platte River Power Authority (contributor); Baker and Benny, 2013; IFSEC Global, 2023; Security Priorities 2023, Info-Tech Research Group, 2023; Build an Information Security Strategy, Info-Tech Research Group, 2020; ISC, n.d.

    Understanding security maturity

    Maturity models are very effective for determining security states. This table provides examples of general descriptions for physical and information security maturity levels.

    Determine which framework is suitable and select the description that most accurately reflects the ideal state for security in your organization.

    Level 1

    Level 2

    Level 3

    Level 4

    Level 5

    Minimum security with simple physical barriers. Low-level security to prevent and detect some unauthorized external activity. Medium security to prevent, detect, and assess most unauthorized external activity and some unauthorized internal activity. High-level security to prevent, detect, and assess most unauthorized external and internal activity. Maximum security to prevent, detect, assess, and neutralize all unauthorized external and internal activity.

    Physical security maturity level1

    Initial/Ad hoc security programs are reactive. Developing security programs can be effective at what they do but are not holistic. A defined security program is holistic, documented, and proactive. Managed security programs have robust governance and metrics processes. An optimized security program is based on strong risk management practices, including the production of key risk indicators (KRIs).

    Information security maturity level2

    Sources: 1 Fennelly, 2013; 2 Build an Information Security Strategy, Info-Tech Research Group, 2020

    Enhance

    Assess and treat integrated security risks

    The risk assessment conducted consists of analyzing existing inherent risks, existing pressure to the risks such as health and safety laws and codes of practice, new risks from the integration process, risk tolerance, and countermeasures.

    • Some organizations already integrate security into corporate security that consists of risk management, compliance, governance, information security, personnel security, and physical security. However, some organizations are still separating security components, especially physical security and information security, which limits security visibility and the organization’s ability to complete a comprehensive risks assessment.
    • Many vendors are also segregating physical security and information security solutions because their tools do well only on certain aspects. This forces organizations to combine multiple tools, creating a complex environment.
    • Additionally, risks related to people such as mental health issues must be addressed properly. The prevalence of hybrid work post-pandemic makes this aspect especially important.
    • Assess and treat risks based on the organization’s requirements, including its environments. For example, the US federal facility security organization is required to conduct risk assessments at least every five years for Level I (lowest risk) and Level II facilities and at least every three years for Level III, IV, and V (highest risk) facilities.

    Sources: EPA, n.d.; America's Water Infrastructure Act (AWIA), 2018; ISC, 2021

    “In 2022, 95% of US companies are consolidating into a single platform across physical security, cybersecurity, HR, legal and compliance.”

    Source: Ontic Center for Protective Intelligence, 2022; N=359

    Example risk levels

    The risk assessment conducted is based on a combination of physical and information security factors such as certain facilities factors. The risk level can be used to determine the baseline level of protection (LOP). Next, the baseline LOP is customized to the achievable LOP. The following is an example for federal facilities determined by Interagency Security Committee (ISC).

    Risk factor, points and score. Facility security level (FSL), level of risk, and baseline level of protection.

    Source: ISC, 2021

    Example assets

    It is important to identify the organization’s requirements, including its environments (IT, IoT, OT, facilities, etc.), and to measure and evaluate its risks and threats using an appropriate risk framework and tools with the critical step of identifying assets prior to acquiring solutions.

    Organizational requirements including its environments(IT, loT, OT, facilities, etc.)

    Info-Tech Insight

    Certain exceptions must be identified in risk assessment. Usually physical barriers such as gates and intrusion detection sensors are considered as countermeasures,1 however, under certain assessment, e.g. America's Water Infrastructure Act (AWIA),2 physical barriers are also considered assets and as such must also be assessed.

    Compromising a fingerprint scanner

    An anecdotal example of why physical security alone is not sufficient.

    Biometrics: secure access and data security.

    Image by Rawpixel.com on Freepik

    Lessons learned from using fingerprints for authentication:

    • Fingerprint scanners can be physically circumvented by making a copy an authorized user’s fingerprint with 3D printing or even by forcefully amputating an authorized user’s finger.
    • Authorized users may not be given access when the fingerprint cannot be recognized, e.g. if the finger is covered by bandage due to injury.
    • Integration with information security may help detect unauthorized access, e.g. a fingerprint being scanned in a Canadian office when the same user was scanned at a close time interval from an IP in Europe will trigger an alert of a possible incident.

    Info-Tech Insight

    In an ideal world, we want a physical security system that is interoperable with all technologies, flexible with minimal customization, functional, and integrated. In the real world, we may have physical systems with proprietary configurations that are not easily customized and siloed.

    Source: Robert Dang, Info-Tech Research Group

    Use case: Microchip implant

    Microchip implants can be used instead of physical devices such as key cards for digital identity and access management. Risks can be assessed using quantitative or qualitative approaches. In this use case a qualitative approach is applied to impact and likelihood, and a quantitative approach is applied to revenue and cost.

    Asset: Microchip implant

    Benefits

    Impact

    • Improve user satisfaction by removing the need to carry key cards, IDs, etc.
    • Improve operating reliability by reducing the likelihood of losing physical devices such as key cards.
    • Improve reliability of services through continuous and real-time connection with other systems such as payment system.

    Likelihood

    • Improve user satisfaction: High
    • Improve operating reliability: High
    • Improve reliability of services: High

    Revenue

    • Acquire new customers or retain existing customers by making daily lives easier with no need to carry key cards, IDs, etc.
    • Cost reduction in staffing of security personnel, e.g. reducing the staffing of building guards or receptionist.

    Risks

    Impact

    • Security: issues such as biohacking of wearable technology and interconnected devices.
    • Safety: issues such as infections or reactions in the body's immune system.
    • Privacy: issues such as unauthorized surveillance and tracking of activities.

    Likelihood

    • Biohacking: Medium
    • Infections: Low
    • Surveillance: High

    Cost

    • Installation costs and hardware costs.
    • Overall lifecycle cost including estimated software and maintenance costs.
    • Estimated cost of training and estimated increase in productivity.

    Sources: Business Insider, 2018; BBC News, 2022; ISC, 2015

    Enhance

    Update integrated security policies and procedures

    Global policies with local implementation

    This model works for corporate groups with a parent company. In this model, global security policies are developed by a parent company and local policies are applied to the unique business that is not supported by the parent company.

    Update of existing security policies

    This model works for organizations with sufficient resources. In this model, integrated security policies are derived from various policies. For example, physical security in smart buildings/devices (sensors, automated meters, HVAC, etc.) and OT systems (SCADA, PLCs, RTUs, etc.) introduce unique risk exposures, necessitating updates to security policies.

    Customization of information security policies

    This model works for smaller organizations with limited resources. In this model, integrated security policies are derived from information security policies. The issue is when these policies are not applicable to physical security systems or other environments, e.g. OT systems.

    Sources: Kris Krishan, Waymo (contributor); Isabelle Hertanto, Info-Tech Research Group (contributor); Physical and Environmental Security Policy Template, Info-Tech Research Group, 2022.

    Enhance

    Update BCP, DR, IR

    • Physical threats such as theft of material, vandalism, loitering, and the like are also part of business continuity threats.
    • These threats can be carried out by various means such as vehicles breaching perimeter security, bolt cutters used for cutting wire and cable, and ballistic attack.
    • Issues may occur when security operations are owned separately by physical security or information security, thus lacking consistent application of best practices.
    • To overcome this issue, organizations need to update BCP, DR, and IR holistically based on a cost-benefit analysis and the level of security maturity, which can be defined based on the suitable framework.

    Sources: IEEE, 2021; ISC, 2021

    “The best way to get management excited about a disaster plan is to burn down the building across the street.”

    Source: Dan Erwin, Security Officer, Dow Chemical Co., in Computerworld, 2022

    Optimize

    Optimizing means working to make the most effective and efficient use of resources, starting with identifying skill requirements and closing skill gaps, followed by designing and deploying integrated security architecture and controls, and finally monitoring and reporting integrated security metrics.

    Optimize

    Identify skill requirements and close skill gaps

    • The pandemic changed how people work and where they choose to work, and most people still want a hybrid work model. Our survey in July 2022 (N=516) found that 55.8% of employees have the option to work offsite 2-3 days per week, 21.0% can work offsite 1 day per week, and 17.8% can work offsite 4 days per week.
    • The investment (e.g. on infrastructure and networks) to initiate remote work was huge, and the costs didn’t end there; organizations needed to maintain the secure remote work infrastructure to facilitate the hybrid work model.
    • Moreover, roles are evolving due to convergence and modernization. These new roles require an integrative skill set. For example, the grid security and ops team might consist of an IT security specialist, a SCADA technician/engineer, and an OT/IIOT security specialist, where OT/IIOT security specialist is a new role.
    Identify skill gaps that hinder the successful execution of the hybrid work security strategy. Use the identified skill gaps to define the technical skill requirements for current and future work roles. Conduct a skills assessment on your current workforce to identify employee skill gaps. Decide whether to train (including certification), hire, contract, or outsource to close each skill gap.

    Strategic investment in internal security team

    Internal security governance and management using in-house developed tools or off-the-shelf solutions, e.g. security information and event management (SIEM).

    Security management using third parties

    Internal security management using third-party security services, e.g. managed security service providers (MSSPs).

    Outsourcing security management

    Outsourcing the entire security functions, e.g. using managed detection and response (MDR).

    Sources: Info-Tech Research Group’s Security Priorities 2023, Close the InfoSec Skills Gap, Build an IT Employee Engagement Program, and Grid Modernization

    Select the right certifications

    What are the options?

    • One issue in security certification is the complexity of relevancy in topics with respect to roles and levels.
    • The European Union Agency for Cybersecurity (ENISA) takes the approach of analyzing existing certifications of ICS/SCADA professionals' cybersecurity skills by orientation, scope, and supporting bodies that are grouped into specific certifications, relevant certifications, and safety certifications (ENISA, 2015).
    • This approach can also be applied to integrated security certifications.

    Physical security certification

    • Examples: Industrial Security Professional Certification (NCMS-ISP); Physical Security Professional (ASIS-PSP); Physical Security Certification (CDSE-PSC); ISC I-100, I-200, I-300, and I-400

    Cyber physical system security certification

    • Examples: Certified SCADA Security Architect (CSSA), EC-Council ICS/SCADA Cybersecurity Training Course

    Information security certification

    • Examples: Network and Information Security (NIS) Driving License, ISA/IEC 62443 Cybersecurity Certificate Program, GIAC Global Industrial Cyber Security Professional (GICSP)

    Safety Certifications

    • Examples: Board of Certified Safety Professionals (BCSP), European Network of Safety and Health Professional Organizations (ENSHPO)
    Table showing options for Certification orientation, scope and supporting bodies.

    Optimize

    Design and deploy integrated security architecture and controls

    • A survey by Brivo found that 38% of respondents have partly centralized security platforms, 25% have decentralized platforms, and 36% have centralized platforms (Brivo, 2022; N=700).
    • If your organization’s security program is still decentralized or partly centralized and your organization is planning to establish an integrated security program, then the recommendation is to perform a holistic risk assessment based on probability and impact assessments on threats and vulnerabilities.
    • The impacted factors, for example, are customers served, criticality of services, equipment present inside the building, personnel response time for operational recovery and the mitigation of hazards, and costs.
    • Frameworks such as Sherwood Applied Business Security Architecture (SABSA), Control Objectives for Information and Related Technologies (COBIT), and The Open Group Architecture Framework (TOGAF) can be used to build security architecture that aligns security goals with business goals.
    • Finally, analyze the security design against the design criteria.

    Sources: ISA and Honeywell Integrated Security Technology Lab, n.d.; IEEE, 2021

    “As long as organizations treat their physical and cyber domains as separate, there is little hope of securing either one.”

    Source: FedTech magazine, 2009

    Analyze architecture design

    Cloud, on-premises, or hybrid? During the pandemic, many enterprises were under tight deadlines to migrate to the cloud. Many did not refactor data and applications correctly for cloud platforms during migration, with the consequence of high cloud bills. This happened because the migrated applications cannot take advantage of on-premises capabilities such as autoscaling. Thus, in 2023, it is plausible that enterprises will bring applications and data back on-premises.

    Below is an example of a security design analysis of platform architecture. Design can be assessed using quantitative or qualitative approaches. In this example, a qualitative approach is applied using high-level advantages and disadvantages.

    Design criteria

    Cloud

    Hybrid

    On-premises

    Effort

    Consumer effort is within a range, e.g. < 60%

    Consumer effort is within a range e.g. < 80%

    100% organization

    Reliability

    High reliability

    High reliability

    Medium reliability that depends on data centers

    Cost

    High cost when data and applications are not correctly designed for cloud

    Optimized cost when data and applications are correctly designed either for cloud or native

    Medium cost when data and applications take advantage of on-prem capabilities

    Info-Tech Insight

    It is important for organizations to find the most optimized architecture to support them, for example, a hybrid architecture of cloud and on-premises based on operations and cost-effectiveness. To help design a security architecture that is strategic, realistic, and based on risk, see Info-Tech’s Identify the Components of Your Cloud Security Architecture research.

    Sources: InfoWorld, 2023; Identify the Components of Your Cloud Security Architecture , Info-Tech Research Group, 2021

    Analyze equipment design

    Below is an example case of a security design analysis of electronic security systems. Design can be assessed using quantitative or qualitative approaches. In this example a qualitative approach is applied using advantages and disadvantages.

    Surveillance design criteria

    Video camera

    Motion detector

    Theft of security system equipment

    Higher economic loss Lower economic loss

    Reliability

    Positive detection of intrusion Spurious indication and lower reliability

    Energy savings and bandwidth

    Only record when motion is detected Detect and process all movement

    Info-Tech Insight

    Once the design has been analyzed, the next step is to conduct market research to analyze the solutions landscape, e.g. to compare products or services from vendors or manufacturers.

    Sources: IEEE, 202; IEC, n.d.; IEC, 2013

    Analyze off-the-shelf solutions

    Criteria to consider when comparing solutions:

    Criteria to consider when comparing solutions: 1 - Visibility and asset management. 2 - Threat detection, mitigation and response. 3 - Risk assessment and vulnerability management. 4 - Usability, architecture, Cost.

    Visibility and Asset Management

    Passively monitoring data using various protocol layers, actively sending queries to devices, or parsing configuration files of physical security devices, OT, IoT, and IT environments on assets, processes, and connectivity paths.

    Threat Detection, Mitigation, and Response (+ Hunting)

    Automation of threat analysis (signature-based, specification-based, anomaly-based, flow-based, content-based, sandboxing) not only in IT but also in relevant environments, e.g. physical, IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.

    Risk Assessment and Vulnerability Management

    Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.

    Usability, Architecture, Cost

    The user and administrative experience, multiple deployment options, extensive integration capabilities, and affordability.

    Source: Secure IT/OT Convergence, Info-Tech Research Group, 2022

    Optimize

    Establish, monitor, and report integrated security metrics

    Security metrics serve various functions in a security program.1 For example:

    • As audit requirements. For integrated security, the requirements are derived from mandatory or voluntary compliance, e.g. NERC CIP.
    • As an indicator of maturity level. For integrated security, maturity level is used to measure the state of security, e.g. C2M2, CMMC.
    • As a measurement of effectiveness and efficiency. Security metrics consist of operational metrics, financial metrics, etc.

    Safety

    Physical security interfaces with the physical world. Thus, metrics based on risks related to safety are crucial. These metrics motivate personnel by making clear why they should care about security.
    Source: EPRI, 2017

    Business Performance

    The impact of security on the business can be measured with various metrics such as operational metrics, service level agreements (SLAs), and financial metrics.
    Source: BMC, 2022

    Technology Performance

    Early detection leads to faster remediation and less damage. Metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability.
    Source: Dark Reading, 2022

    Security Culture

    Measure the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.

    Info-Tech Insight

    Security failure can be avoided by evaluating the security systems and program. Security evaluation requires understanding what, where, when, and how to measure and to report the relevant metrics.

    Related Info-Tech Research

    Secure IT/OT Convergence

    The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.

    Hence, IT and OT need to collaborate, starting with communication to build trust and to overcome their differences and followed by negotiation on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.

    Preparing for Technology Convergence in Manufacturing

    Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.

    Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.

    Build an Information Security Strategy

    Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.

    This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.

    Bibliography

    "1402-2021 - IEEE Guide for Physical Security of Electric Power Substations." IEEE, 2021. Accessed 25 Jan. 2023.

    "2022 State of Protective Intelligence Report." Ontic Center for Protective Intelligence, 2022. Accessed 16 Jan. 2023.

    "8 Staggering Statistics: Physical Security Technology Adoption." Brivo, 2022. Accessed 5 Jan. 2023.

    "America's Water Infrastructure Act of 2018." The United States' Congress, 2018. Accessed 19 Jan. 2023.

    Baker, Paul and Daniel Benny. The Complete Guide to Physical Security. Auerbach Publications. 2013

    Bennett, Steve. "Physical Security Statistics 2022 - Everything You Need to Know." WebinarCare, 4 Dec. 2022. Accessed 30 Dec. 2022.

    "Best Practices for Planning and Managing Physical Security Resources: An Interagency Security Committee Guide." Interagency Security Committee (ISC), Dec. 2015. Accessed 23 Jan. 2023.

    Black, Daniel. "Improve Security Governance With a Security Steering Committee." Info-Tech Research Group, 23 Nov. 2018. Accessed 30 Jan. 2023.

    Borg, Scott. "Don't Put Up Walls Between Your Security People." FedTech Magazine, 17 Feb. 2009. Accessed 15 Dec. 2022.

    Burwash, John. “Preparing for Technology Convergence in Manufacturing.” Info-Tech Research Group, 12 Dec. 2018. Accessed 7 Dec. 2022.

    Carney, John. "Why Integrate Physical and Logical Security?" Cisco. Accessed 19 Jan. 2023.

    "Certification of Cyber Security Skills of ICS/SCADA Professionals." European Union Agency for Cybersecurity (ENISA), 2015. Accessed 27 Sep. 2022.

    Cherdantseva, Yulia and Jeremy Hilton. "Information Security and Information Assurance. The Discussion about the Meaning, Scope and Goals." Organizational, Legal, and Technological Dimensions of IS Administrator, Almeida F., Portela, I. (eds.), pp. 1204-1235. IGI Global Publishing, 2013.

    Cobb, Michael. "Physical security." TechTarget. Accessed 8 Dec. 2022.

    “Conduct a Drinking Water or Wastewater Utility Risk Assessment.” United States Environmental Protection Agency (EPA), n.d. Web.

    Conrad, Sandi. "Create and Implement an IoT Strategy." Info-Tech Research Group, 28 July 2022. Accessed 7 Dec. 2022.

    Cooksley, Mark. "The IEC 62443 Series of Standards: A Product Manufacturer's Perspective." YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.

    "Cyber and physical security must validate their value in 2023." IFSEC Global, 12 Jan. 2023. Accessed 20 Jan. 2023.

    "Cybersecurity Evaluation Tool (CSET®)." Cybersecurity and Infrastructure Security Agency (CISA). Accessed 23 Jan. 2023.

    "Cybersecurity Maturity Model Certification (CMMC) 2.0." The United States' Department of Defense (DOD), 2021. Accessed 29 Dec. 2022.

    “Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.

    Czachor, Emily. "Mass power outage in North Carolina caused by gunfire, repairs could take days." CBS News, 5 Dec. 2022. Accessed 20 Jan. 2023.

    Dang, Robert, et al. “Secure IT/OT Convergence.” Info-Tech Research Group, 9 Dec. 2022. Web.

    "Emergency Management Act (S.C. 2007, c. 15)." The Government of Canada, 2007. Accessed 19 Jan. 2023.

    "Emergency management vocabulary." Translation Bureau, Government of Canada. Accessed 19 Jan. 2023.

    Fennelly, Lawrence. Effective physical security. Butterworth-Heinemann, 2013.

    Ghaznavi-Zadeh, Rassoul. "Enterprise Security Architecture - A Top-down Approach." The Information Systems Audit and Control Association (ISACA). Accessed 25 Jan. 2023.

    "Good Practices for Security of Internet of Things." European Union Agency for Cybersecurity (ENISA), 2018. Accessed 27 Sep. 2022.

    "Health and Safety at Work etc Act 1974." The United Kingdom Parliament. Accessed 23 Jan. 2023.

    Hébert, Michel, et al. “Security Priorities 2023.” Info-Tech Research Group, 1 Feb. 2023. Web.

    "History and Initial Formation of Physical Security and the Origin of Authority." Office of Research Services (ORS), National Institutes of Health (NIH). March 3, 2017. Accessed 19 Jan. 2023.

    "IEC 62676-1-1:2013 Video surveillance systems for use in security applications - Part 1-1: System requirements - General." International Electrotechnical Commission (IEC), 2013. Accessed 9 Dec. 2022.

    "Incident Command System (ICS)." ICS Canada. Accessed 17 Jan. 2023.

    "Information Security Manual - Guidelines for Physical Security." The Australian Cyber Security Centre (ACSC), Dec. 2022. Accessed 13 Jan. 2023.

    "Integrated Physical Security Framework." Anixter. Accessed 8 Dec. 2022.

    "Integrating Risk and Security within a TOGAF® Enterprise Architecture." TOGAF 10, The Open Group. Accessed 11 Jan. 2023.

    Latham, Katherine. "The microchip implants that let you pay with your hand." BBC News, 11 Apr. 2022. Accessed 12 Jan. 2023.

    Linthicum, David. "2023 could be the year of public cloud repatriation." InfoWorld, 3 Jan. 2023. Accessed 10 Jan. 2023.

    Ma, Alexandra. "Thousands of people in Sweden are embedding microchips under their skin to replace ID cards." Business Insider, 14 May 2018. Accessed 12 Jan. 2023.

    Mendelssohn, Josh and Dana Tessler. "Take Control of Compliance Improvement to Conquer Every Audit." Info-Tech Research Group, 25 March 2015. Accessed 27 Jan. 2023.

    Meredith, Sam. "All you need to know about the Nord Stream gas leaks - and why Europe suspects 'gross sabotage'." CNBC, 11 Oct. 2022. Accessed 20 Jan. 2023.

    Nicaise, Vincent. "EU NIS2 Directive: what’s changing?" Stormshield, 20 Oct. 2022. Accessed 17 Nov. 2022.

    "NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations." The National Institute of Standards and Technology (NIST), 13 Jul. 2022. Accessed 27 Jan. 2023.

    "North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) Series." NERC. Accessed 23 Jan. 2023.

    "North America Physical Security Market - Global Forecast to 2026." MarketsandMarkets, June 2021. Accessed 30 Dec. 2022.

    "NSTISSI No. 4011 National Training Standard For Information Systems Security (InfoSec) Professionals." The United States Committee on National Security Systems (CNSS), 20 Jun. 1994. Accessed 23 Jan. 2023.

    "Occupational Safety and Health Administration (OSH) Act of 1970." The United States Department of Labor. Accessed 23 Jan. 2023.

    Palter, Jay. "10 Mistakes Made in Designing a Physical Security Program." Real Time Networks, 7 Sep. 2022. Accessed 6 Jan. 2023.

    Parker, Donn. Fighting Computer Crime. John Wiley & Sons, 1998.

    Pathak, Parag. "What Is Threat Management? Common Challenges and Best Practices." Security Intelligence, 2020. Accessed 5 Jan. 2023.

    Pender-Bey, Georgie. "The Parkerian Hexad." Lewis University, 2012. Accessed 24 Jan. 2023.

    Philippou, Oliver. "2023 Trends to Watch: Physical Security Technologies." Omdia. Accessed 20 Jan. 2023.

    Phinney, Tom. "IEC 62443: Industrial Network and System Security." ISA and Honeywell Integrated Security Technology Lab. Accessed 30 Jan. 2023.

    "Physical Security Market, with COVID-19 Impact Analysis - Global Forecast to 2026." MarketsandMarkets, Jan. 2022. Accessed 30 Dec. 2022.

    "Physical Security Professional (PSP)" ASIS International. Accessed 17 Jan. 2023.

    "Physical Security Systems (PSS) Assessment Guide" The United States' Department of Energy (DOE), Dec. 2016. Accessed 23 Jan. 2023.

    "Policies, Standards, Best Practices, Guidance, and White Papers." Interagency Security Committee (ISC). Accessed 23 Jan. 2023.

    "Profiles, Add-ons and Specifications." ONVIF. Accessed 9 Dec. 2022.

    "Protective Security Policy Framework (PSPF)." The Australian Attorney-General's Department (AGD). Accessed 13 Jan. 2023.

    "Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.

    ""Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.

    Satgunananthan, Niru. "Challenges in Security Convergence?" LinkedIn, 8 Jan. 2022. Accessed 20 Dec. 2022.

    Sooknanan, Shastri and Isaac Kinsella. "Identify the Components of Your Cloud Security Architecture." Info-Tech Research Group, 12 March 2021. Accessed 26 Jan. 2023.

    "TC 79 Alarm and electronic security systems." International Electrotechnical Commission (IEC), n.d. Accessed 9 Dec. 2022.

    "The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard." Interagency Security Committee (ISC), 2021. Accessed 26 Jan. 2023.

    "The Short Guide to Why Security Programs Can Fail." CyberTalk, 23 Sep. 2021. Accessed 30 Dec. 2022.

    Verton, Dan. "Companies Aim to Build Security Awareness." Computerworld, 27 Nov. 2022. Accessed 26 Jan. 2023.

    "Vulnerability Assessment of Federal Facilities." The United States' Department of Justice, 28 Jun. 1995. Accessed 19 Jan. 2023.

    "What is IEC 61508?" 61508 Association. Accessed 23 Jan. 2023.

    Wolf, Gene. "Better Include Physical Security With Cybersecurity." T&D World 5 Jan. 2023. Accessed 19 Jan. 2023.

    Wood, Kate, and Isaac Kinsella. “Build an Information Security Strategy.” Info-Tech Research Group, 9 Sept. 2020. Web.

    Woolf, Tim, et al. "Benefit-Cost Analysis for Utility-Facing Grid Modernization Investments: Trends, Challenges, and Considerations." Lawrence Berkeley National Laboratory, Feb. 2021. Accessed 15 Nov. 2022.

    "Work Health and Safety Act 2011." The Australian Government. Accessed 13 Jan. 2023.

    Wu, Jing. “Industrial Control System Modernization: Unlock the Value of Automation in Utilities.” Info-Tech Research Group, 6 April 2023. Web.

    Research Contributors and Experts

    Amy L. Meger, IGP

    Information and Cyber Governance Manager
    Platte River Power Authority

    Andrew Amaro

    Chief Security Officer (CSO) & Founder
    KLAVAN Security

    Bilson Perez

    IT Security Manager
    4Wall Entertainment

    Dan Adams

    VP of Information Technology
    4Wall Entertainment

    Doery Abdou

    Senior Manager
    March Networks Corporate

    Erich Krueger

    Manager of Security Engineering
    Omaha Public Power District

    Kris Krishan

    Head of IT
    Waymo

    Owen Yardley

    Director, Facilities Security Preparedness
    Omaha Public Power District

    Your Company is an Economy: Why This is Your Secret Weapon for Resilience

    • Large vertical image:
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    IT specialists often instinctively focus on technical issues, such as server failures or network problems, because they are trained to address the broken parts. However, it's important to consider the context in which these occur. But what if the real problem isn't just the part but the entire system it operates in?

    I want you to take a step back and to stop thinking about your company as a collection of departments and IT systems. Start seeing it for what it truly is: a complex, living, breathing economic system. This isn't some academic analogy. It’s a powerful model that will change how you approach resilience.

    An economic system involves production, resource allocation, and distribution of goods and services, which parallels how a company operates internally. It includes the combination of various departments, the people doing things, the business units, and even the decision-making steps that make up the economic structure of your company. Once you see this, you can never unsee it.

    What is an economic system?

    Let’s quickly demystify this. Forget textbooks and complex theories for a moment. Think about a national economy. It does three basic things:

    1. Production: It makes things. Factories build cars, farms grow food, and programmers write software. This is the creation of value.

    2. Resource Allocation: This process decides who gets what to make those things. Who gets the steel for the cars? The land for the farms? The funding for the software developers? These are all decisions about how to use scarce resources. 

    3. Distribution: This process gets the finished products to the people who need them. Cars go to importers, then dealerships then the customers, food goes to grocery stores, and software gets deployed to servers and then used by clients (in the general sense).

    That's it. Production, allocation, distribution. Every economy, from a simple bartering tribe to the global financial market, operates on these principles. And so does your company.

    So, how is your company an economy?

    Your company doesn't just “do work.” It produces, allocates, and distributes services in its own internal market (and eventually sells outside, otherwise… trouble).

    The production is everywhere. The human resources department produces a “payroll service.” The sales department produces “revenue contracts.” And the IT department? It produces a vast array of services: “compute cycles,” “data storage,” “network connectivity,” and “application uptime.” These are the goods and services that every other part of the company consumes to do their jobs.

    Resource allocation is the lifeblood of your corporate economy. It's the annual budgeting process, the project prioritization meetings, and the daily decisions managers make about where to assign their people. In IT, you are equally part of the allocation process. Most people get to decide at least what they will give priority to that day. Perhaps via the daily scrum or stand-up meetings. Perhaps during the review process. As a manager, when you approve a request for a new high-powered virtual machine for one team, you are making an economic choice. You are allocating a scarce resource that another team can no longer use. As a developer, when you decide that task X is now a higher priority than task Y, you make an economic decision to allocate yourself to task X. It's important to understand that there is an opportunity cost to every decision, whether you label it that way or not. 

    And distribution? That's how these services get to their “consumers.” It’s the internal platforms, the APIs that connect applications, the service desk that fulfills requests, the operations teams that update data via forms into databases, and even the reporting dashboards that deliver information. These are the supply chains and logistics networks of your company’s economy. The consumers are your clients, of course, but also every department that uses a service provided by another department.

    The IT department plays a central role in the company's economy, akin to a central bank and infrastructure provider, by managing essential digital resources like compute, storage, and bandwidth. You control its supply and, through your decisions, influence its value. You also build and maintain the “roads” and “power grid”—the networks and platforms—that the entire corporate economy depends on to function.

    Why This Perspective Is Important for Resilience

    This is where I feel it gets fascinating. When you start seeing your company as an economic system, your understanding of resilience deepens dramatically. You move beyond simply fixing broken things and start thinking about stabilizing a complex, interconnected market.

    It helps you understand true systemic risk.

    When a core database goes down, an engineer sees a technical failure. An economist sees a supply chain collapse. That database isn't just a box with blinking lights; it's a critical supplier of a raw material, namely data. Every single business process, application, and team that creates, updates or consumes that data is now starved of a resource they need to produce their own services. The failure cascades not just through technical dependencies but through economic dependencies. Seeing it this way forces you to ask better questions: Who are the biggest “consumers” of this data supplier? What is the total economic impact of this outage, not just the technical impact? This changes the incident's priority and your response strategy.

    You move beyond simple redundancy.

    The traditional engineering approach to resilience is redundancy. If one server is important, have two. This is like a town having two power plants. It's a good start, but it's not true economic resilience. An economist would ask different questions. Can we diversify our suppliers? Can we re-route via another path? If our primary database provider fails, can we switch to a secondary one, even if it's slower or pricier for a short time? This is the principle of substitution. Can a business process continue to function in a degraded mode, producing a lower-quality “good” for a while instead of stopping completely? This is about economic adaptability, not just technical duplication.

    You could take this even further and move into the realm of business continuity. Can your process work when your primary resource (the database) is not available? How would you redesign your process to work with an alternative solution? This thinking is at the heart of modern operational resilience regulations worldwide. Authorities are no longer just asking if your backups work; they're asking if your firm can fulfill its economic function in the face of severe adversity. They demand a clear grasp of your entire supply chain and a testable exit plan for critical suppliers, including cloud providers.

    You see that this goes way beyond a failing-part view. It goes to the heart of the economic function of your company.

    Incident response becomes economic intervention.

    During a major incident, the incident commander is now no longer just a technical coordinator. You are the head of the “central bank” during a "market crash". Your job is to prevent a localized failure from causing a full-blown corporate recession. Think about your actions:

    • You allocate scarce capital (your top engineers' time) to the most critical problem. The economic cost is the non-delivery of any other product by those people.

    • You implement fiscal policy by prioritizing certain fixes over others to stimulate the quickest “economic” recovery.

    • You manage market confidence through clear, calm, and regular communication to stakeholders, preventing panic from spreading.

    Each decision is an economic intervention designed to restore stability to the system. (If that is not the job description of a central banker, then I eat my hat.)

    Side Note: I often see teams who are obsessed with their own service's uptime, their own local metrics. They proudly report “five nines” of availability, but they do not report on how their service is actually consumed or how critical it is to the company's overall economic output. They've optimized their own factory but don't disclose their output's need level to the company or that their occasional one-hour outage brings the entire company's main assembly line to a halt. Resilience is not about local optimization; it is about the stability of the entire economic system. A dashboard that lists teams in order of availability or whatever other metric is fine, but these numbers must be mapped against their economic relevance. Without the economic relevance weighting, you may be misallocating resources in areas that are not critical or sufficiently important.

    How to Start Thinking Like an Economist in Your Resilience Practice

    This isn't just a theoretical exercise. You can apply this model today to make your organization stronger and yourself more effective to any employer or client.

    First, map your economic flows. Go beyond standard architecture diagrams. Create maps that show how value and services are produced, distributed, and consumed across departments. Identify your most important “supply chains.” Ask business units what IT services are essential for their “production lines” and what the financial impact is when those services are unavailable. This gives you a heat map of economic risk.

    Second, identify your single points of economic failure. In every economy, there are institutions that are “too big to fail.” What are yours? Is it a single authentication service? A legacy mainframe? A specific team of two people who know how a critical system works? These are the areas where a failure will cause a systemic crisis. They require more than just technical redundancy; they need deep, thoughtful resilience planning, including succession plans for people and substitution options for technology.

    Finally, reframe your post-incident reviews. Stop just asking, “What broke and why?” Start asking, “Which economic activity was disrupted?” and “How did the disruption flow through the system?” This shifts the conversation from blaming a component or a team to understanding systemic weaknesses in your company's economy. The goal is not to find a guilty party but to identify where your internal market is fragile and how you can strengthen it with better “monetary policy” (resource allocation) or “infrastructure” (more robust platforms).

    The vicious cycle of a failing economy

    In another article, I mentioned that resilience is a mindset.
     Resilience mindset graphic 

    So what happens when this economic system becomes unstable?

    These issues are typically considered failures and they manifest as irritations, perceived slowness and bugs, all the way to (regular) failures of a process or whole system.

    If this broken economic system is allowed to remain unstable, people will adopt negative behaviors.

    When “the government” (IT) fails to deliver, business teams take matters into their hands and start shadow IT. They may even purchase their own subscriptions.

    In a stable economy, participants trust that resources will be available when needed, but in a broken system, that trust is gone and leads to the hoarding of assets. This may be visible in the requested need for time or even budget allocation. And that leads into protectionism where teams build walls around their data and systems.

    When failures are common, the focus shifts from resolving the systemic problems to assigning blame for the specific symptom. This is akin to the breakdown of trade relations. The applications team blames the infrastructure team for slow servers. The infrastructure team blames the network team for latency. The network team blames the applications team for inefficient code. And around we go.

    Taking it just that little step further: If people live in a failing state long enough, they lose hope. This is learned helplessness. Your most valuable “citizens”—your engineers and business users—become disengaged. They stop reporting bugs because they assume they will never be fixed. They stop suggesting process improvements because they believe their voice doesn't matter.

    And lastly: In a functional system, there are clear processes for requesting services. In your broken economy, these official channels are considered worthless. The only way to get anything done is to generate a crisis. Escalation becomes the primary currency. People learn to bypass the ticketing system and send direct messages to senior leaders because they perceive that's the only way to get a response.

    How to Break the Cycle: Start Small

    To break this cycle, you need to start small and use mechanisms that turn the negative effects of problems into positive effects, like seeing opportunities.

    • Opportunities to correct irritations
    • Opportunities to enhance processes
    • Opportunities to perhaps redesign a service

    Proposing a grand vision will get you polite nods and zero action. I recommend you pick one irritation and fix it. Repeat multiple times until staff starts to perceive a change. Don't try to move the mountain. Remove the first obstacle and make your way up from there. This can be solving an issue, reducing an uncertainty, or actually spotting a way forward. 

    It will go easier as you continue this. Accept that on day one, your credibility is zero. It doesn’t matter whether you're a new manager or a seasoned expert. Trust is earned on the factory floor. Fix one small, nagging irritation for one person. Then another. This is how you build the political and social capital needed to tackle the mountain. It takes time.

    But what will happen next is crucial. There will be a reduction of the negative behaviors. And when you work it efficiently with enough time, you will eliminate those behaviors. And yes, there will be many ifs and buts, and each of the broken elements of a larger chain may require their own solutions. But it is this act of seeing the bigger picture through the constituent parts that will allow you to assign priorities and move closer to the solution in a structural way.
    Seeing step by step results feeds positivism and higher stability. Which in turn again feeds more positivism. 

     

    When you view your company through the lens of an economic system, it elevates the practice of resilience from a purely technical discipline to a value function. It gives you a language to communicate impact and risk to leadership in terms they understand: production, supply, and cost.

    It forces you to see the interconnectedness of everything you do and to appreciate that the failure of a single, seemingly minor component can have large, cascading effects across the entire organization. By thinking like an economist, you stop being just a firefighter, putting out isolated blazes. You become the architect of a more stable, more robust, and ultimately more resilient economy.

    You become the architect of a more stable, more robust, and ultimately more resilient economy. Now, go manage it.

    Always ready for a chat.

    Foster Data-Driven Culture With Data Literacy

    • Buy Link or Shortcode: {j2store}132|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $12,999 Average $ Saved
    • member rating average days saved: 115 Average Days Saved
    • Parent Category Name: Data Management
    • Parent Category Link: /data-management

    Organizations are joining the wave and adopting machine learning and artificial intelligence (AI) to unlock the value in their data and power their competitive advantage. But to succeed with these complex analytics programs, they need to begin by looking at their data – empowering their people to realize and embrace the valuable insights within the organization’s data.

    The key to achieve becoming a data-driven organization is to foster a strong data culture and equip employees with data skills through an organization-wide data literacy program.

    Our Advice

    Critical Insight

    • Start with real business problems in a hands-on format to demonstrate the value of data.
    • Use a formalized organization-wide approach to data literacy program to bridge the data skills gap.
    • Provide relevant and practical training programs tailored to different learning styles and tenures (e.g. onboarding, development plan).

    Impact and Result

    Data literacy is critical to the success of digital transformation and AI analytics. Info-Tech’s approach to creating a sustainable and effective data literacy program is recognizing it is:

    • More than just technical training. A data literacy program isn’t just about data; it encompasses aspects of business, IT, and data.
    • More than a one-off exercise. To keep the literacy skills alive the program must be regular, sustainable, and tailored to different needs across all levels of the organization.
    • More than one delivery format. Different delivery methods need to be considered to suit various learning styles to ensure an effective delivery.

    Foster Data-Driven Culture With Data Literacy Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Foster Data-Driven Culture With Data Literacy Storyboard – A step-by-step guide to help organizations build an effective and sustainable data literacy program that benefits all employees who work with data.

    Data literacy as part of the data governance strategic program should be launched to all levels of employees that will help your organization bridge the data knowledge gap at all levels of the organization. This research recommends approaches to different learning styles to address data skill needs and helps members create a practical and sustainable data literacy program.

    • Foster Data-Driven Culture With Data Literacy Storyboard

    2. Fundamental Data Literacy Program Template – A document that provides an example of a fundamental data literacy program.

    Kick off a data awareness program that explains the fundamental understanding of data and its lifecycle. Explore ways to create or mature the data literacy program with smaller amounts of information on a more frequent basis.

    • Fundamental Data Literacy Program Template
    [infographic]

    Further reading

    Foster Data-Driven Culture With Data Literacy

    Data literacy is an essential part of a data-driven culture, bridging the data knowledge gaps across all levels of the organization.

    Analyst Perspective

    Data literacy is the missing link to becoming a data-driven organization.

    “Digital transformation” and “data driven” are two terms that are inseparable. With organizations accelerating in their digital transformation roadmap implementation, organizations need to invest in developing data skills with their people. Talent is scarce and the demand for data skills is huge, with 70% of employees expected to work heavily with data by 2025. There is no time like the present to launch an organization-wide data literacy program to bridge the data knowledge gap and foster a data-driven culture.

    Data literacy training is as important as your cybersecurity training. It impacts all levels of the organization. Data literacy is critical to success with digital transformation and AI analytics.

    Annabel Lui

    Principal Advisory Director, Data & Analytics Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Organizations are joining the wave and adopting machine learning (ML) and artificial intelligence (AI) to unlock the value in their data and power their competitive advantage. But to succeed with these complex analytics programs, they need to begin by empowering their people to realize and embrace the valuable insights within the organization’s data.

    The key to becoming a data-driven organization is to foster a strong data culture and equip people with data skills through an organization-wide data literacy program.

    Common Obstacles

    Challenges the data leadership is likely to face as digital transformation initiatives drive intensified competition:

    • Resistance to change
    • Technological distractions
    • “Shadow data”
    • Difficulty securing resources and skilled data professionals
    • Inability to appreciate the value of data and its meaning for users – even fear of it

    Info-Tech's Approach

    We interviewed data leaders and instructors to gather insights about investing in data:

    • Start with real business problems in a hands-on format to demonstrate the value of data.
    • Implement a formalized organization-wide approach to data literacy program to bridge the data skill gap.
    • Provide relevant and practical training programs tailored to different learning styles and tenures (e.g. onboarding,development plan).

    Info-Tech Insight

    By thoughtfully designing a data literacy training program for the audience's own experience, maturity level, and learning style, organizations build the data-driven and engaged culture that helps them to unlock their data's full potential and outperform other organizations.

    Your Challenge

    Data literacy is the missing link to drive business outcomes from data.

    • Having a data-driven culture as an organization’s mission statement without implementing a data literacy program is like making an empty promise and leaving the value unrealized and unattainable.
    • A study conducted by the Data Literacy Project clearly indicates that organizations with aggressive data literacy programs will outperform those who do not have such programs. By 2030, data literacy will be one of the most sought-after skill sets. All employees require data literacy skills.
    • Everyone has a role in data. From employees who are actively involved in data collection to operational teams who create reports with analytics tools and finally to executives who use data to make business decisions – they all require continuous data literacy training in a data-driven organization. Because of differences in maturity, data literacy strategies cannot be one-size-fits-all.

    “Data literacy is the ability to read, work with, analyze, and communicate with data. It's a skill that empowers all levels of workers to ask the right questions of data and machines, build knowledge, make decisions, and communicate meaning to others.” – Qlik, n.d.

    75% of organizational employees have access to data tools – only 21% demonstrated confidence in their data skills.

    Source: Accenture, 2020.

    89% of C-level executives expect team members to explain how data has informed their decisions, but only 11% employees are fully confident in their ability to read, analyze, work with, and communicate with data

    Source: Qlik, 2022.

    Data debt or data asset?

    Manage your data as strategic assets.

    “[Data debt is] when you have undocumented, unused, incomplete, and inconsistent data,” according to Secoda (2023). “When … data debt is not solved, data teams could risk wasting time managing reports no one uses and producing data that no one understands.”

    Signs of data debt when considering investing in data literacy:

    • Lack of definition and understanding of data terms, therefore they don’t speak the same language. Without data literacy, an organization will not succeed in becoming a data-driven organization.
    • Putting data literacy as a low priority. Organization sees this as “another” training to put on the list and keeps it on the back burner.
    • Data literacy is not seen as the number one skill set needed in the organization. However, anyone who works with data requires data skills.
    • End users are not trained on self-serve features and tools.
    • Focusing on a minority group of people rather than everyone in the organization or seeing it as a one-off exercise.
    • Delays or failure to deliver digital transformation projects due to lack of data skills and data access issues.

    66%

    of organizations say a backlog of data debt is impacting new data management initiatives.

    40%

    of organizations say individuals within the business do not trust data insights.

    30%

    of organizations are unable to become data-driven.

    Source: Experian, 2020

    Info-Tech’s Approach

    Data literacy is critical to success with digital transformation and AI analytics.

    Diagram showing components of Data literacy: 1 - Data: understand your data, 2 - Business: define the purpose, 3 - IT: Introduce new ways of working

    The Info-Tech difference:

    1. More than just technical training. Data literacy program isn’t just about data but rather encompasses aspects of business, IT, and data.
    2. More than a one-off exercise. To keep literacy skills alive, the program must be routine and sustainable, tailored to different needs across all levels of the organization.
    3. More than one delivery format. Different delivery methods need to be considered to suit various learning styles.

    Data needs to be processed

    Data – facts – are organized, processed, and given meaning to become insights.

    Data, information, knowledge, insight, wisdom

    Image source: Welocalize, 2020.

    Data represents a discrete fact or event without relation to other things (e.g. it is raining). Data is unorganized and not useful on its own.

    Information organizes and structures data so that it is meaningful and valuable for a specific purpose (i.e. it answers questions). Information is a refined form of data.

    When information is combined with experience and intuition, it results in knowledge. It is our personal map/model of the world.

    Knowledge set with context generates insight. We become knowledgeable as a result of reading, researching, and memorizing (i.e. accumulating information).

    Wisdom means the ability to make sound judgments. Wisdom synthesizes knowledge and experiences into insights.

    Investment in data literacy is a game changer.

    Data literacy is the ability to collect, manage, evaluate, and apply data in a critical manner.

    A data-driven culture is “an operating environment that seeks to leverage data whenever and wherever possible to enhance business efficiency and effectiveness” (Forbes).

    Info-Tech Insight

    Data-driven culture refers to a workplace where decisions are made based on data evidence, not on gut instinct.

    Info-Tech’s methodology for building a data literacy program

    Phase Steps

    1. Define Data Literacy Objectives

    1.1 Understand organization’s needs

    1.2 Create vision and objective for data literacy program

    2. Assess Learning Style and Align to Program Design

    2.1 Create persona and identify audience

    2.2 Assess learning style and align to program design

    2.3 Determine the right delivery method

    3. Socialize Roadmap and Milestones

    3.1 Establish a roadmap

    3.2 Set key performance metrics and milestones

    Phase Outcomes

    Identify key objectives to establish and grow the data literacy program by articulating the problem and solutions proposed.

    Assess each audience’s learning style and adapt the program to their unique needs.

    Show a roadmap with key performance indicators to track each milestone and tell a data story.

    Insight Summary

    “In a world of more data, the companies with more data-literate people are the ones that are going to win.”

    – Miro Kazakoff, senior lecturer, MIT Sloan, in MIT Sloan School of Management, 2021

    Overarching insight

    By thoughtfully designing a data literacy training program personalized to each audience's maturity level, learning style, and experience, organizations can develop and grow a data-driven culture that unlocks the data's full potential for competitive differentiation.

    Module 1 insight

    We can learn a lot from each other. Literacy works both ways – business data stewards learn to “speak data” while IT data custodians understand the business context and value. Everyone should strive to exchange knowledge.

    Module 2 insight

    Avoid traditional classroom teaching – create a data literacy program that is learner-centric to allow participants to learn and experiment with data.

    Aligning program design to those learning styles will make participants more likely to be receptive to learning a new skill.

    Module 3 insight

    A data literacy program isn’t just about data but rather encompasses aspects of business, IT, and data. With executive support and partnership with business, running a data literacy program means that it won’t end up being just another technical training. The program needs to address why, what, how questions.

    Tactical insight

    A lot of programs don’t include the fundamentals. To get data concepts to stick, focus on socializing the data/information/knowledge/wisdom foundation.

    Tactical insight

    Many programs speak in abstract terms. We present case studies and tangible use cases to personalize training to the audience’s world and showcase opportunities enabled through data.

    Key performance indicators (KPIs) for your data literacy program

    How do you know if your data literacy program is successful? Here are some useful KPIs:

    Program Adoption Metrics

    • Percentage of employees attending data literacy training
    • Percentage of participants who report gains in data management knowledge after training sessions
    • Maturity assessment result
    • Survey and diagnostic feedback before and after training
    • Trend analysis of overall data literacy program

    Operational Metrics

    • Number of requests for analytics/reporting services
    • Number of reports created by users
    • Speed and quality of business decisions
    • User satisfaction with reports and analytics services
    • Improved business performance (customer satisfaction)
    • Improved valuation of organization data

    A data-driven culture builds tools and skills, builds users’ trust in the quality of data across sources, and raises the skills and understanding among the frontlines by encouraging everyone to leverage data for critical thinking and innovation.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

    Guided Implementation

    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

    Workshop

    "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

    Consulting

    "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of the project."

    Diagnostics and consistent frameworks are used throughout all four options.

    Workshop Overview

    Contact your account representative for more information.
    workshops@infotech.com 1-888-670-8889

    Session 1

    Session 2

    Session 3

    Session 4

    Activities

    Define Data Literacy Objectives

    1.1 Review Data Culture Diagnostic results

    1.2 Identify business context: business goals, initiatives

    1.3 Create vision and objective for data literacy program

    Assess Learning Style and Align to Program Design

    2.1 Identify audience

    2.2 Assess learning style and align to program design

    2.3 Determine the right delivery method

    Build a Data Literacy Roadmap and Milestones

    3.1 Identify program initiatives and topics

    3.2 Determine delivery methods

    3.3 Build the data literacy roadmap

    Operational Strategy to implement Data Literacy

    4.1 Identify key performance metrics

    4.2 Identify owners and document RACI matrix

    4.3 Discuss next steps and wrap up.

    Deliverables

    1. Diagnostics reports (data culture survey)
    2. Vision and value statement
    1. Assessment of audience covering all levels of organization
    1. List of key program initiatives and topics
    2. Allocation of delivery methods
    3. Roadmap
    1. Data literacy metrics
    2. List of owners and roles and responsibilities
    3. Next step and implementation schedule

    Phase 1

    Define Data Literacy Objectives

    Phase 1: step 1 - Understand organization's needs, step 2 - Create vision and objective for data literacy program.

    Foster Data-Driven Culture With Data Literacy

    This phase will walk you through the following activities:

    • Understand the organization’s needs.
    • Create vision and objective for data literacy program.

    This phase involves the following participants:

    • Data governance sponsor
    • Data owners
    • Data stewards
    • Data custodians

    1.1 Gauge your organization’s current data culture

    Conduct data culture survey or diagnostic.

    1. Identify members of the data user base, data consumers, and other key stakeholders for surveying.
    2. Conduct an information session to introduce Info-Tech’s Data Culture Diagnostic survey. Explain the objective and importance of the survey and its role in helping to understand the organization’s current data culture and inform the improvement of that culture.
    3. Roll out the Info-Tech Data Culture Diagnostic survey to the identified users and stakeholders.
    4. Debrief and document the results and scorecard in the Data Strategy Stakeholder Interview Guide and Findings document.

    Input

    • Email addresses of participants in your organization who should receive the survey

    Output

    • Your organization’s Data Culture Scorecard for understanding current data culture as it relates to the use and consumption of data
    • An understanding of whether data is currently perceived to be an asset to the organization

    Materials

    • Info-Tech’s Data Culture Diagnostic service

    Participants

    • Participants include those at the senior leadership level through to middle management, as well as other business stakeholders at varying levels across the organization
    • Data owners, stewards, and custodians
    • Core data users and consumers

    Contact your Info-Tech Account Representative for details on launching a Data Culture Diagnostic.

    1.2 Define data literacy objectives

    1. Understand the organization’s needs by identifying opportunities and challenges relating to data. Document the described real-life examples.
    2. Categorize the list and identify areas where data literacy can address the business problem.
    3. Create a vision statement for the data literacy program, ensuring that it covers all levels of the organization.
    4. Articulate the intended targets and goals in planning for a data literacy program.

    Input

    • List of opportunities and challenges relating to data
    • Relevant business real-life examples

    Output

    • Categorized list of data literacy needs
    • Vision for literacy program
    • Targets and goals

    Materials

    • Whiteboard/flip charts
    • Sticky notes

    Participants

    • CDO or sponsor
    • Key business stakeholders
    • Data stewards
    • Data custodians
    • Data governance working group

    Quick wins for improving data literacy

    Data collected through Info-Tech’s Data Culture Diagnostic suggests three ways to improve data literacy:

    87%

    think more can be done to define and document commonly used terms with methods such as a business data glossary.

    68%

    think they can have a better understanding of the meaning of all data elements that are being captured or managed.

    86%

    feel that they can have more training in terms of tools as well as on what data is available at the organization.

    Source: Info-Tech Research Group's Data Culture Diagnostic, 2022; N=2,652

    Quick Wins

    • Create a business data glossary to document and define common terms.
    • Provide easy access to the business data glossary and procedures on how data is captured and managed.
    • Launch an organization-wide data literacy program.

    Delivering value is a means and the goal

    Start with real business problems in a hands-on format to demonstrate the value of data.

    Identify business problem:

    • Business decisions without facts are just guesses.
    • Management spends a lot of time finding and fixing data.
    • Unknown challenges on data assets and risk.
    • Incomplete view of customer/client and industry.
    • Not ready for modern data opportunities (e.g. artificial intelligence).

    Create an objective

    Treat data as a strategic asset to gain insight into our customers for all levels of organization.

    The solution: Data-driven culture powered by people who speak data.

    • Data dictionary
    • Data literacy
    • Trusted single source
    • Access to analytics tools
    • Decision making

    "According to Forrester, 91% of organizations find it challenging to improve the use of data insights for decision-making – even though 90% see it as a priority. Why the disconnect? A lack of data literacy."

    – Alation, 2020

    Fundamental data literacy

    Data literacy is more than just a technical training or a one-off exercise.

    Info-Tech provides various topics suited for a data literacy program that can accommodate different data skill requirements and encompasses relevant aspects of business, IT, and data.

    Info-Tech Research Group’s Data Literacy Program

    Use discovery and diagnostics to understand users’ comfort level and maturity with data.

    Data lunch 'n' learn

    • The power and value of data
    • Everyone is a data steward
    • Becoming data literate
    • Data 101
    • The future is data
    1 hour
    For: General audience, senior leadership, data leads, change management

    Speak data

    • What is data
    • Meet the data team
    • Day in the life of a steward
    • How data impacts you
    • Tools of the trade
    1/2 day
    For: New stewards, data owners, pre-data strategy workshop

    Your data story

    • Ask the right questions
    • Find the top five data elements
    • Understand your data
    • Present your data story
    • Lessons from COVID-19
    1/2 day
    For: New stewards, business data owners, pre-BI/analytics workshop

    Phase 2

    Assess Learning Style and Align to Program Design

    Phase 2: step 1 - Identify audience, step 2 - Access learning style and align to program design, step 3 - Determine the right delivery method.

    Foster Data-Driven Culture With Data Literacy

    This phase will walk you through the following activities:

    • Identify your audience.
    • Assess learning styles and align them to the data program design.
    • Determine the right delivery method.

    This phase involves the following participants:

    • Data governance sponsor
    • Data owners
    • Data stewards
    • Data custodians

    Avoid common pitfalls

    75%

    feel that training was too long to remember or to apply in their day-to-day work.

    21%

    find training had insufficient follow-up to help them apply on the job.

    Source: Grovo, 2018.

    1. Information Overload

      Trying to cover too much useful information results in overwhelm and does not deliver on key training objectives.
    2. Limited Implementation

      Learning is only the beginning. The real results are obtained when learning is followed by practice, which turns new knowledge into reliable habits.
    3. Lack of Organizational Alignment

      Implementing training without a clear link to organizational objectives leaves you unable to clearly communicate its value, undermines your ability to secure buy-in from attendees and executives, and leaves you unable to verify that the training is actually improving effectiveness.

    2.1 Understand learning style

    1. Create persona and identify the audiences and their roles in data across all levels of the organization.
    2. Identify the data program initiatives and assign the best delivery method to each initiative.
    3. Assign participants to each program initiative based on their skill gap and learning style.

    Input

    • List of audiences, their roles, and tenures
    • Data skill gap assessment
    • List of literacy program initiatives/topics

    Output

    • Target audience grouping
    • List of program initiatives with assigned groups

    Materials

    • Whiteboard/flip charts
    • Sticky notes

    Participants

    • CDO or sponsor
    • Key business stakeholders
    • Data stewards
    • Data custodians
    • Data governance working group

    You and data

    Is data an integral part of your work?

    Do you feel comfortable finding and using data in your organization?

    • Many people feel intimidated by data and therefore miss out on what data can do for them.
    • Often the obstacle is language. If you don’t understand the semantics around data, you will not feel confident to contribute to discussions around data.
    • You use data every day but need additional vocabulary to understand how to handle it properly.
    • Data literacy is the ability to “speak data” and to understand what data means (i.e. how to read charts and graphs, draw valid conclusions, and recognize when data is misinterpreted or used inappropriately to be misleading).
    • The business often doesn’t understand its role in data governance and how it informs and assists IT in responsible data management.

    Info-Tech Insight

    IT and data professionals need to understand the business as much as business needs to talk about data. Bidirectional learning and feedback improves the synergy between business and IT.

    Create personas

    Persona creation is a way to brainstorm ideas for the data literacy program.

    Choose a data role (e.g. data steward, data owner, data scientist).

    Describe the persona based on goals, priorities, tenures, preferred learning style, type of work with data.

    Identify data skill and level of skills required.

    Persona 1: Denise - Manager, People and Culture. Goals, priorities, tenure, data role, learning style, skill level

    Consider these other ways to brainstorm:

    • Review current in-flight projects.
    • Analyze types of data requests.
    • Understand needs by department.
    • Share learnings in a community of practice.

    Program design

    Categorize into six data skill areas

    Not everyone needs the same level of skill sets

    Bullseye board with skill levels (Innermost going outward): Expert, advanced, intermediate and Basic. The six data skill areas: 1. Understanding Data, 2. Find and Obtain Data, 3. Read, Interpret and Evaluate Data, 4. Manage Data, 5. Create and Use Data, 6. Tell a Story and Share Data are placed equally around in sections.

    Map the personas to the program

    Bridging the data knowledge gap.

    • Each component will promote the value of data to all levels of employees when demonstrating the right way for data to be understood, managed, and consumed in the organization.
    • Categorizing the data literacy program into six areas and levels of skill sets will provide clarity into which areas to focus on.
    • The program is intended to be implemented in stages, allowing the audience to learn and adopt the new skills. Leveraging in-flight projects for rolling out training will have a higher success because the need is already built into the project.
    Personas are placed at different points in the data skill area and skill level.

    Align program design to learning styles

    The four methods (Discussion, Information, Coaching, and Self-Discovery) are based on learner-centered model design rather than the traditional teacher-centered model.

    Info-Tech Insight

    Tailor your data literacy program to meet your organization’s needs, filling your range of knowledge gaps and catering to different levels of users.

    When it comes to rolling out a data literacy program, there is no one-size-fits-all solution. Your data literacy program is intended to spread knowledge throughout your organization. It should target everyone from executive leadership to management to subject matter experts across all functions of the business.

    Discussion method

    Delivery Method

    • Interactive format between instructor and learner
    • Instructor empowers and motivates learner through dialogues and exercises

    The imaginative learner

    The imaginative learner group likes to engage in feelings and spend time on reflection. This type of learner desires personal meaning and involvement. They focus on personal values for themselves and others and make connections quickly.

    For this group of learners, their question is: why should I learn this?

    Learning characteristics

    • Seek meaning
    • Need to be personally involved
    • Learn by listening and sharing ideas
    • Function through social interaction

    Information method

    Delivery Method

    • Instructor does most of the talking in the training
    • Instructor is teaching the content, delivering the training content, and demonstrating

    Analytical learner

    The analytical learner group likes to listen, to think about information, and to come up with ideas. They are interested in acquiring facts and delving into concepts and processes. They can learn effectively and enjoy doing independent research.

    For this group of learners, their question is: what should I learn?

    Learning characteristics

    • Seek and examine the facts
    • Need to know what experts think
    • Interested in ideas and concepts
    • Critique information and collect data
    • Function by adapting to experts

    Coaching method

    Delivery Method

    • Learning has on-the-job training or learning through role-play exercises
    • Instructor is coaching and facilitating learner

    Common sense learner

    The common sense learner group likes thinking and doing. They are satisfied when they can carry out experiments, build and design, and create usability. They like tinkering and applying useful ideas.

    For this group of learners, their question is: how should I learn?

    Learning characteristics

    • Seek usability
    • Need to know how things work
    • Learn by testing theories using practical methods
    • Use factual data to build concepts
    • Enjoy hands-on experience

    Self-discovery method

    Delivery Method

    • Interactive format between instructor and learner
    • Instructor provides evaluation and remedial instruction

    Common sense learner

    The dynamic learner group learns through doing and experiencing. They are continually looking for hidden possibilities and researching ideas to make original adjustments. They learn through trial and error and self-discovery.

    For this group of learners, their question is: what if I learn this?

    Learning characteristics

    • Seek hidden possibilities
    • Need to know what can be done with things
    • Learn by trial and error
    • Enjoy variety and excel in being flexible

    Delivery method considerations

    There are four common ways to learn a new skill: by watching, conceptualizing, doing, and experiencing. The following are some suggestions on ways to implement your data literacy program through different delivery methods.

    There are four common ways to learn a new skill: by watching, conceptualizing, doing, and experiencing. The following are some suggestions on ways to implement your data literacy program through different delivery methods.

    Phase 3

    Map Out Data Literacy Roadmap and Milestones

    Phase 3: step 1 - Roadmap exercise, step 2 - Set key performance metrics and milestones.

    Foster Data-Driven Culture With Data Literacy

    This phase will walk you through the following activities:

    • Complete a roadmap exercise.
    • Set key performance metrics and milestones.

    This phase involves the following participants:

    • Data governance sponsor
    • Data owners
    • Data stewards
    • Data custodians

    3.1 Build the data literacy roadmap and milestones

    1-3 hours
    1. Gather the data literacy objectives and list of program initiatives with their assigned groups.
    2. Discuss each program initiative with the data literacy creation team, assigning content owners and estimating effort required to build the content.

    For the Gantt chart:

    • Input the roadmap start year.
    • List each data literacy topic and delivery method.
    • Populate the planned start and end dates for the prepopulated list of program initiatives.

    Input

    • List of data literacy topics with assigned groups
    • Vision statement of data literacy program
    • Data literacy objectives

    Output

    • Roadmap Gantt chart
    • List of program initiatives with start and end date
    • Content owner assignment

    Materials

    • Whiteboard/flip charts
    • Sticky notes
    • MS Projects/Excel

    Participants

    • CDO or sponsor
    • Key business stakeholders
    • Data stewards
    • Data custodians
    • Data governance working group

    Data literacy journey mapping

    Making it sustainable

    • Deliver the literacy program in stages to make it easier for the audience to consume the content.
    • Allow opportunities to apply the learnings at work.
    • Map out the data literacy trainings as they get delivered and identify gaps, if any. Continue to refine and adjust the program and delivery method for better outcome.
    • Set clear goals and KPIs measurement up front.
    • Conduct Info-Tech Research Group’s Data Culture Diagnostics to set the baseline and repeat the assessment in 12 to 18 months.
    • Assign champions to lead change and influence end users to adopt better processes.
    Data Literacy journey mapping. Different departments need different skills in data literacy.

    Research contributors

    Name

    Position

    Andrea Malick Advisory Director, Info-Tech Research Group
    Andy Neill AVP, Data and Analytics, Chief Enterprise Architect, Info-Tech Research Group
    Crystal Singh Research Director, Info-Tech Research Group
    Imad Jawadi Senior Manager, Consulting Advisory, Info-Tech Research Group
    Irina Sedenko Research Director, Info-Tech Research Group
    Reddy Doddipalli Senior Workshop Director, Info-Tech Research Group
    Sherwick Min Technical Counselor, Info-Tech Research Group
    Wayne Cain Principal Advisory Director, Info-Tech Research Group

    Info-Tech’s Data Literacy Program

    Contact your account representative for more information.
    workshops@infotech.com 1-888-670-8889

    Session 1

    Session 2

    Session 3

    Session 4

    Activities

    Understand the WHY and Value of Data

    1.1 Business context, business objectives, and goals

    1.2 You and data

    1.3 Data journey from data to insights

    1.4 Speak data – common terminology

    Learn about the WHAT Through Data Flow

    2.1 Data creation

    2.2 Data ingestion

    2.3 Data accumulation

    2.4 Data augmentation

    2.5 Data delivery

    2.6 Data consumption

    Explore the HOW Through Data Visualization Training

    3.1 Ask the right questions

    3.2 Find the top five data elements

    3.3 Understand your data

    3.4 Present your data story

    3.5 Sharing of lessons learned

    Put Them All Together Through Data Governance Awareness

    4.1 Data governance framework

    4.2 Data roles and responsibilities

    4.3 Data domain and owners

    Deliverables

    1. Learning material for understanding the data fundamental and its terminology
    1. Learning material for data flow elements
    1. Learning material for data visualization
    1. Learning material for data governance awareness program

    Related Info-Tech Research

    Establish Data Governance

    Deliver measurable business value.

    Build a Robust and Comprehensive Data Strategy

    Key to building and fostering a data-driven culture.

    Create a Data Management Roadmap

    Streamline your data management program with our simplified framework.

    Bibliography

    About Learning. “4MAT overview.” About Learning., 16 Aug. 2001. Web.

    Accenture. “The Human Impact of Data Literacy,” Accenture, 2020. Web.

    Anand, Shivani. “IDC Reveals India Data and Content Technologies Predictions for 2022 and onwards; Focus on Data Literacy for an Elevated data Culture.” IDC, 14 Mar. 2022. Web.

    Belissent, Jennifer, and Aaron Kalb. “Data Literacy: The Key to Data-Driven Decision Making.” Alation, April 2020. Web.

    Brown, Sara. “How to build data literacy in your company.” MIT Sloan School of Management, 9 Feb 2021. Web.

    ---. “How to build a data-driven company.” MIT Sloan School of Management, 24 Sept. 2020. Web.

    Domo. “Data Never Sleeps 9.0.” Domo, 2021. Web.

    Dykes, Brent. “Creating A Data-Driven Culture: Why Leading By Example Is Essential.” Forbes, 26 Oct. 2017. Web.

    Experian. “10 signs you are sitting on a pile of data debt.” Experian, 2020. Accessed 25 June 2021. Web.

    Experian. “2019 Global Data Management Research.” Experian, 2019. Web.

    Knight, Michelle. “Data Literacy Trends in 2023: Formalizing Programs.” Dataversity, 3 Jan. 2023. Web.

    Ghosh, Paramita. “Data Literacy Skills Every Organization Should Build.” Dataversity, 2 Nov. 2022. Web.

    Johnson, A., et al., “How to Build a Strategy in a Digital World,” Compact, 2018, vol. 2. Web.

    LifeTrain. “Learning Style Quiz.” EMTrain, Web.

    Lambers, E., et al. “How to become data literate and support a data-drive culture.” Compact, 2018, vol. 4. Web.

    Marr, Benard. “Why is data literacy important for any business?” Bernard Marr & Co., 16 Aug. 2022. Web.

    Marr, Benard. “8 simple ways to enhance your data literacy skills.” Bernard Marr & Co., 16 Aug. 2022. Web/

    Mendoza, N.F. “Data literacy: Time to cure data phobia” Tech Republic, 27 Sept. 2022. Web.

    Mizrahi, Etai. “How to stay ahead of data debt and downtime?” Secoda, 17 April 2023. Web.

    Needham, Mass., “IDC FutureScape: Top 10 Predictions for the Future of Intelligence.” IDC, 5 Dec. 2022. Web.

    Paton, J., and M.A.P. op het Veld. “Trusted Analytics.” Compact, 2017, vol. 2. Web.

    Qlik. “Data Literacy to be Most In-Demand Skill by 2030 as AI Transforms Global Workplaces.” Qlik., 16 Mar 2022. Web.

    Qlik. “What is data literacy?” Qlik, n.d. Web.

    Reed, David. Becoming Data Literate. Harriman House Publishing, 1 Sept. 2021. Print.

    Salomonsen, Summer. “Grovo’s First-Time Manager Microlearning® Program Will Help Your New Managers Thrive in 2018.” Grovos Blog, 5 Dec. 2018. Web.

    Webb, Ryan. “More Than Just Reporting: Uncovering Actionable Insights From Data.” Welocalize, 1 Sept. 2020. Web.

    Kick-Start IT-Led Business Innovation

    • Buy Link or Shortcode: {j2store}87|cart{/j2store}
    • member rating overall impact: 9.2/10 Overall Impact
    • member rating average dollars saved: $38,844 Average $ Saved
    • member rating average days saved: 8 Average Days Saved
    • Parent Category Name: Innovation
    • Parent Category Link: /innovation
    • The CIO is not considered a strategic partner. The business may be satisfied with IT services, but no one is looking to IT to solve business problems or drive the enterprise forward.
    • Even if IT staff do generate ideas that will improve operational efficiency or enable the business, few are ever assessed or executed upon.

    Our Advice

    Critical Insight

    • Business demand for new technology is creating added pressure to innovate and executive stakeholders expect more from IT. If IT is not viewed as a source of innovation, its perceived value will decrease and the threat of shadow IT will grow. Do not wait to start finding and capitalizing on opportunities for IT-led innovation.

    Impact and Result

    • Start innovating right away. All you need are business pains and people willing to ideate around them.
    • Assemble a small team and arm them with proven techniques for identifying unique opportunities for innovation, developing impactful solutions, and prototyping quickly and effectively. Incubate a reservoir of ideas, both big and small, so that you are ready to execute on innovative projects when the timing is right.
    • Once you have demonstrated IT’s ability to innovate, mature your capability with a permanent innovation process and program.

    Kick-Start IT-Led Business Innovation Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should create innovation processes, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Launch innovation

    Sponsor a mandate for innovation and assemble a small team to start sourcing ideas with IT staff.

    • Kick-Start IT-Led Business Innovation – Phase 1: Launch Innovation
    • Innovation Working Group Charter

    2. Ideate

    Identify critical opportunities for innovation and brainstorm effective solutions.

    • Kick-Start IT-Led Business Innovation – Phase 2: Ideate
    • Idea Document
    • Idea Reservoir Tool

    3. Prototype

    Prototype ideas rapidly to gain user feedback, refine solutions, and make a compelling case for project investment.

    • Kick-Start IT-Led Business Innovation – Phase 3: Prototype
    • Prototyping Workbook
    • Prototype Assessment

    4. Mature innovation capability

    Formalize the innovation process and implement a program to create a strong culture of innovation in IT.

    • Kick-Start IT-Led Business Innovation – Phase 4: Mature Innovation Capability

    Infographic

    Workshop: Kick-Start IT-Led Business Innovation

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Launch Innovation

    The Purpose

    Introduce innovation.

    Assess overall IT maturity to understand what you want to achieve with innovation.

    Define the innovation mandate.

    Introduce ideation.

    Key Benefits Achieved

    A set of shared objectives for innovation will be defined.

    A mandate will be created to help focus innovation efforts on what is most critical to the advancement of IT's maturity.

    The group will be introduced to ideation and prepared to begin addressing critical IT or business pains.

    Activities

    1.1 Define workshop goals and objectives.

    1.2 Introduce innovation.

    1.3 Assess IT maturity.

    1.4 Define the innovation mandate.

    1.5 Introduce ideation.

    Outputs

    Workshop goals and objectives.

    An understanding of innovation.

    IT maturity assessment.

    Sponsored innovation mandate.

    An understanding of ideation.

    2 Ideate, Part I

    The Purpose

    Identify and prioritize opportunities for IT-led innovation.

    Map critical processes to identify the pains that should be ideated around.

    Brainstorm potential solutions.

    Assess, pitch, and prioritize ideas that should be investigated further.

    Key Benefits Achieved

    The team will learn best practices for ideation.

    Critical pain points that might be addressed through innovation will be identified and well understood.

    A number of ideas will be generated that can solve identified pains and potentially feed the project pipeline.

    The team will prioritize the ideas that should be investigated further and prototyped after the workshop.

    Activities

    2.1 Identify processes that present opportunities for IT-led innovation.

    2.2 Map selected processes.

    2.3 Finalize problem statements.

    2.4 Generate ideas.

    2.5 Assess ideas.

    2.6 Pitch and prioritize ideas.

    Outputs

    A list of processes with high opportunity for IT-enablement.

    Detailed process maps that highlight pain points and stakeholder needs.

    Problem statements to ideate around.

    A long list of ideas to address pain points.

    Detailed idea documents.

    A shortlist of prioritized ideas to investigate further.

    3 Ideate, Part II

    The Purpose

    Ideate around a more complex problem that presents opportunity for IT-led innovation.

    Map the associated process to define pain points and stakeholder needs in detail.

    Brainstorm potential solutions.

    Assess, pitch, and prioritize ideas that should be investigated further.

    Introduce prototyping.

    Map the user journey for prioritized ideas.

    Key Benefits Achieved

    The team will be ready to facilitate ideation independently with other staff after the workshop.

    A critical problem that might be addressed through innovation will be defined and well understood.

    A number of innovative ideas will be generated that can solve this problem and help IT position itself as a source of innovative projects.

    Ideas will be assessed and prioritized for further investigation and prototyping after the workshop.

    The team will learn best practices for prototyping.

    The team will identify the assumptions that need to be tested when top ideas are prototyped.

    Activities

    3.1 Select an urgent opportunity for IT-led innovation.

    3.2 Map the associated process.

    3.3 Finalize the problem statement.

    3.4 Generate ideas.

    3.5 Assess ideas.

    3.6 Pitch and prioritize ideas.

    3.7 Introduce prototyping.

    3.8 Map the user journey for top ideas.

    Outputs

    Selection of a process which presents a critical opportunity for IT-enablement.

    Detailed process map that highlights pain points and stakeholder needs.

    Problem statement to ideate around.

    A long list of ideas to solve the problem.

    Detailed idea documents.

    A shortlist of prioritized ideas to investigate further.

    An understanding of effective prototyping techniques.

    A user journey for at least one of the top ideas.

    4 Implement an Innovation Process and Program

    The Purpose

    Establish a process for generating, managing, prototyping, prioritizing, and approving new ideas.

    Create an action plan to operationalize your new process.

    Develop a program to help support the innovation process and nurture your innovators.

    Create an action plan to implement your innovation program.

    Decide how innovation success will be measured.

    Key Benefits Achieved

    The team will learn best practices for managing innovation.

    The team will be ready to operationalize an effective process for IT-led innovation. You can start scheduling ideation sessions as soon as the workshop is complete.

    The team will understand the current innovation ecosystem: drivers, barriers, and enablers.

    The team will be ready to roll out an innovation program that will help generate wider engagement with IT-led innovation.

    You will be ready to measure and report on the success of your program.

    Activities

    4.1 Design an IT-led innovation process.

    4.2 Assign roles and responsibilities.

    4.3 Generate an action plan to roll out the process.

    4.4 Determine critical process metrics to track.

    4.5 Identify innovation drivers, enablers, and barriers.

    4.6 Develop a program to nurture a culture of innovation.

    4.7 Create an action plan to jumpstart each of your program components.

    4.8 Determine critical metrics to track.

    4.9 Summarize findings and gather feedback.

    Outputs

    A process for IT-led innovation.

    Defined process roles and responsibilities.

    An action plan for operationalizing the process.

    Critical process metrics to measure success.

    A list of innovation drivers, enablers, and barriers.

    A program for innovation that will leverage enablers and minimize barriers.

    An action plan to roll out your innovation program.

    Critical program metrics to track.

    Overview of workshop results and feedback.

    Implement and Mature Your User Experience Design Practice

    • Buy Link or Shortcode: {j2store}430|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Requirements & Design
    • Parent Category Link: /requirements-and-design

    Many organizations want to get to market quickly and on budget but don’t know the steps to get the right product/service to satisfy the users and business. This may be made apparent through uninformed decisions leading to lack of adoption of your product or service, rework due to post-implementation user feedback, or the competition discovering new approaches that outshine yours.

    Our Advice

    Critical Insight

    Ensure your practice has a clear understanding of the design problem space – not just the solution. An understanding of the user is critical to this.

    Impact and Result

    • Create a practice that is focused on human outcomes; it starts and ends with the people you are designing for. This includes:
      • Establishing a practice with a common vision.
      • Enhancing the practice through four design factors.
      • Communicating a roadmap to improve your business through design.
    • Create a practice that develops solutions specific to the needs of users, customers, and stakeholders.

    Implement and Mature Your User Experience Design Practice Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should implement an experience design practice, review Info-Tech’s methodology, and understand the four dimensions we recommend using to mature your practice.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Build the foundation

    Motivate your team with a common vision, mission, and goals.

    • Design Roadmap Workbook
    • User Experience Practice Roadmap

    2. Review the design dimensions

    Examine your practice – from the perspectives of organizational alignment, business outcomes, design perspective, and design integration – to determine what it takes to improve your maturity.

    3. Build your roadmap and communications

    Bring it all together – determine your team structure, the roadmap for the practice maturity, and communication plan.

    [infographic]

    Workshop: Implement and Mature Your User Experience Design Practice

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Answer “So What?”

    The Purpose

    Make the case for UX. Bring the team together with a common mission, vision, and goals.

    Key Benefits Achieved

    Mission, vision, and goals for design

    Activities

    1.1 Define design practice goals.

    1.2 Generate the vision statement.

    1.3 Develop the mission statement.

    Outputs

    Design vision statement

    Design mission statement

    Design goals

    2 Examine Design Dimensions

    The Purpose

    Review the dimensions that help organizations to mature, and assess what next steps make sense for your organization.

    Key Benefits Achieved

    Develop initiatives that are right-sized for your organization.

    Activities

    2.1 Examine organizational alignment.

    2.2 Establish priorities for initiatives.

    2.3 Identify business value sources.

    2.4 Identify design perspective.

    2.5 Brainstorm design integration.

    2.6 Complete UCD-Canvas.

    Outputs

    Documented initiatives for design maturity

    Design canvas framework

    3 Create Structure and Initiatives

    The Purpose

    Make your design practice structure right for you.

    Key Benefits Achieved

    Examine patterns and roles for your organization.

    Activities

    3.1 Structure your design practice.

    Outputs

    Design practice structure with patterns

    4 Roadmap and Communications

    The Purpose

    Define the communications objectives and audience for your roadmap.

    Develop your communication plan.

    Sponsor check-in.

    Key Benefits Achieved

    Complete in-progress deliverables from previous four days.

    Set up review time for workshop deliverables and to discuss next steps.

    Activities

    4.1 Define the communications objectives and audience for your roadmap.

    4.2 Develop your communication plan.

    Outputs

    Communication Plan and Roadmap

    z-Series Modernization and Migration

    • Buy Link or Shortcode: {j2store}114|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Strategy and Organizational Design
    • Parent Category Link: /strategy-and-organizational-design

    Under the best of circumstances, mainframe systems are complex, expensive, and difficult to scale. In today’s world, applications written for mainframe legacy systems also present significant operational challenges to customers compounded by the dwindling pool of engineers who specialize in these outdated technologies. Many organizations want to migrate their legacy applications to the cloud but to do so they need to go through a lengthy migration process that is made more challenging by the complexity of mainframe applications.

    Our Advice

    Critical Insight

    The most common tactic is for the organization to better realize their z/Series options and adopt a strategy built on complexity and workload understanding. To make the evident, obvious, the options here for the non-commodity are not as broad as with commodity server platforms and the mainframe is arguably the most widely used and complex non-commodity platform on the market.

    Impact and Result

    This research will help you:

    • Evaluate the future viability of this platform.
    • Assess the fit and purpose, and determine TCO
    • Develop strategies for overcoming potential challenges.
    • Determine the future of this platform for your organization.

    z/Series Modernization and Migration Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. z/Series Modernization and Migration Guide – A brief deck that outlines key migration options and considerations for the z/Series platform.

    This blueprint will help you assess the fit, purpose, and price; develop strategies for overcoming potential challenges; and determine the future of z/Series for your organization.

    • z/Series Modernization and Migration Storyboard

    2. Scale Up vs. Scale Out TCO Tool – A tool that provides organizations with a framework for TCO.

    Use this tool to play with the pre-populated values or insert your own amounts to compare possible database decisions, and determine the TCO of each. Note that common assumptions can often be false; for example, open-source Cassandra running on many inexpensive commodity servers can actually have a higher TCO over six years than a Cassandra environment running on a larger single expensive piece of hardware. Therefore, calculating TCO is an essential part of the database decision process.

    • Scale Up vs. Scale Out TCO Tool
    [infographic]

    Further reading

    z/Series Modernization and Migration

    The biggest migration is yet to come.

    Executive Summary

    Info-Tech Insight

    “A number of market conditions have coalesced in a way that is increasingly driving existing mainframe customers to consider running their application workloads on alternative platforms. In 2020, the World Economic Forum noted that 42% of core skills required to perform existing jobs are expected to change by 2022, and that more than 1 billion workers need to be reskilled by 2030.” – Dale Vecchio

    Your Challenge

    It seems like anytime there’s a new CIO who is not from the mainframe world there is immediate pressure to get off this platform. However, just as there is a high financial commitment required to stay on System Z, moving off is risky and potentially more costly. You need to truly understand the scale and complexity ahead of the organization.

    Common Obstacles

    Under the best of circumstances, mainframe systems are complex, expensive, and difficult to scale. In today’s world, applications written for mainframe legacy systems also present significant operational challenges to customers compounded by the dwindling pool of engineers who specialize in these outdated technologies. Many organizations want to migrate their legacy applications to the cloud, but to do so they need to go through a lengthy migration process that is made more challenging by the complexity of mainframe applications.

    Info-Tech Approach

    The most common tactic is for the organization to better realize its z/Series options and adopt a strategy built on complexity and workload understanding. To make the evident, obvious: the options here for the non-commodity are not as broad as with commodity server platforms and the mainframe is arguably the most widely used and complex non-commodity platform on the market.

    Review

    We help IT leaders make the most of their z/Series environment

    Problem statement:

    The z/Series remains a vital platform for many businesses and continues to deliver exceptional reliability and performance and play a key role in the enterprise. With the limited and aging resources at hand, CIOs and the like must continually review and understand their migration path with the same regard as any other distributed system roadmap.

    This research is designed for:

    IT strategic direction decision makers.

    IT managers responsible for an existing z/Series platform.

    Organizations evaluating platforms for mission critical applications.

    This research will help you:

    1. Evaluate the future viability of this platform.
    2. Assess the fit and purpose, and determine TCO.
    3. Develop strategies for overcoming potential challenges.
    4. Determine the future of this platform for your organization.

    Analyst Perspective

    Good Luck.

    Darin Stahl.

    Modernize the mainframe … here we go again.

    Prior to 2020, most organizations were muddling around in “year eleven of the four-year plan” to exit the mainframe platform where a medium-term commitment to the platform existed. Since 2020, it appears the appetite for the mainframe platform changed. Again. Discussions mostly seem to be about what the options are beyond hardware outsourcing or re-platforming to “cloud” migration of workloads – mostly planning and strategy topics. A word of caution: it would appear unwise to stand in front of the exit door for fear of being trampled.

    Hardware expirations between now and 2025 are motivating hosting deployments. Others are in migration activities, and some have already decommissioned and migrated but now are trying to rehab the operations team now lacking direction and/or structure.

    There is little doubt that modernization and “digital transformation” trends will drive more exit traffic, so IT leaders who are still under pressure to get off the platform need to assess their options and decide. Being in a state of perpetually planning to get off the mainframe handcuffs your ability to invest in the mainframe, address deficiencies, and improve cost-effectiveness.

    Darin Stahl
    Principal Research Advisor, Infrastructure & Operations Research
    Info-Tech Research Group

    The mainframe “fidget spinner”

    Thinking of modernizing your mainframe can cause you angst so grab a fidget spinner and relax because we have you covered!

    External Business Pressures:

    • Digital transformation
    • Modernization programs
    • Compliance and regulations
    • TCO

    Internal Considerations:

    • Reinvest
    • Migrate to a new platform
    • Evaluate public and vendor cloud alternatives
    • Hosting versus infrastructure outsourcing

    Info-Tech Insight

    With multiple control points to be addressed, care must be taken to simplify your options while addressing all concerns to ease operational load.

    The analyst call review

    “Who has Darin talked with?” – Troy Cheeseman

    Dating back to 2011, Darin Stahl has been the primary z/Series subject matter expert within the Infrastructure & Operations Research team. Below represents the percentage of calls, per industry, where z/Series advisory has been provided by Darin*:

    37% - State Government

    19% - Insurance

    11% - Municipality

    8% - Federal Government

    8% - Financial Services

    5% - Higher Education

    3% - Retail

    3% - Hospitality/Resort

    3% - Logistics and Transportation

    3% - Utility

    Based on the Info-Tech call history, there is a consistent cross section of industry members who not only rely upon the mainframe but are also considering migration options.

    Note:

    Of course, this only represents industries who are Info-Tech members and who called for advisory services about the mainframe.

    There may well be more Info-Tech members with mainframes who have no topic to discuss with us about the mainframe specifically. Why do we mention this?

    We caution against suggesting things like, ”somewhat less than 50% of mainframes live in state data centers” or any other extrapolated inference from this data.

    Our viewpoint and discussion is based on the cases and the calls that we have taken over the years.

    *37+ enterprise calls were reviewed and sampled.

    Scale out versus scale up

    For most workloads “scale out" (e.g. virtualized cloud or IaaS ) is going to provide obvious and quantifiable benefits.

    However, with some workloads (extremely large analytics or batch processing ) a "scale up" approach is more optimal. But the scale up is really limited to very specific workloads. Despite some assumptions, the gains made when moving from scale up to scale out are not linear.

    Obviously, when you scale out from a performance perspective you experience a drop in what a single unit of compute can do. Additionally, there will be latency introduced in the form of network overhead, transactions, and replication into operations that were previously done just bypassing object references within a single frame.

    Some applications or use cases will have to be architected or written differently (thinking about the high-demand analytic workloads at large scale). Remember the “grid computing” craze that hit us during the early part of this century? It was advantageous for many to distribute work across a grid of computing devices for applications but the advantage gained was contingent on the workload able to be parsed out as work units and then pulled back together through the application.

    There can be some interesting and negative consequences for analytics or batch operations in a large scale as mentioned above. Bottom line, as experienced previously with Microfocus mainframe ports to x86, the batch operations simply take much longer to complete.

    Big Data Considerations*:

    • Value: Data has no inherent value until it’s used to solve a business problem.
    • Variety: The type of data being produced is increasingly diverse and ranges from email and social media to geo-spatial and photographic data. This data may be difficult to process using a structured data model.
    • Volume: The sheer size of the datasets is growing exponentially, often ranging from terabytes to petabytes. This is complicating traditional data management strategies.
    • Velocity: The increasing speed at which data is being collected and processed is also causing complications. Big data is often time sensitive and needs to be captured in real time as it is streaming into the enterprise.

    *Build a Strategy for Big Data Platforms

    Consider your resourcing

    Below is a summary of concerns regarding core mainframe skills:

    1. System Management (System Programmers): This is the most critical and hard-to-replace skill since it requires in-depth low-level knowledge of the mainframe (e.g. at the MVS level). These are skills that are generally not taught anymore, so there is a limited pool of experienced system programmers.
    2. Information Management System (IMS) Specialists: Requires a combination of mainframe knowledge and data analysis skills, which makes this a rare skill set. This is becoming more critical as business intelligence takes on an ever-increasing focus in most organizations.
    3. Application Development: The primary concern here is a shortage of developers skilled in older languages such as COBOL. It should be noted that this is an application issue; for example, this is not solved by migrating off mainframes.
    4. Mainframe Operators: This is an easier skill set to learn, and there are several courses and training programs available. An IT person new to mainframes could learn this position in about six weeks of on-the-job training.
    5. DB2 Administration: Advances in database technology have simplified administration (not just for DB2 but also other database products). As a result, as with mainframe operators, this is a skill set that can be learned in a short period of time on the job.

    The Challenge

    An aging workforce, specialized skills, and high salary expectations

    • Mainframe specialists, such as system programmers and IMS specialists, are typically over 50, have a unique skill set, and are tasked with running mission-critical systems.

    The In-House Solution:

    Build your mentorship program to create a viable succession plan

    • Get your money’s worth out of your experienced staff by having them train others.
    • Operator skills take about six weeks to learn. However, it takes about two years before a system programmer trainee can become fully independent. This is similar to the learning curve for other platforms; however, this is a more critical issue for mainframes since organizations have far fewer mainframe specialists to fall back on when senior staff retire or move on.

    Understand your options

    Migrate to another platform

    Use a hosting provider

    Outsource

    Re-platform (cloud/vendors)

    Reinvest

    There are several challenges to overcome in a migration project, from finding an appropriate alternative platform to rewriting legacy code. Many organizations have incurred huge costs in the attempt, only to be unsuccessful in the end, so make this decision carefully.

    Organizations often have highly sensitive data on their mainframes (e.g. financial data), so many of these organizations are reluctant to have this data live outside of their four walls. However, the convenience of using a hosting provider makes this an attractive option to consider.

    The most common tactic is for the organization to adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house.

    A customer can “re-platform” the non-commodity workload into public cloud offerings or in a few offerings
    “re-host.”

    If you’re staying with the mainframe and keeping it in-house, it’s important to continue to invest in this platform, keep it current, and look for opportunities to optimize its value.

    Migrate

    Having perpetual plans to migrate handcuffs your ability to invest in your mainframe, extend its value, and improve cost effectiveness.

    If this sounds like your organization, it’s time to do the analysis so you can decide and get clarity on the future of the mainframe in your organization.

    1. Identify current performance, availability, and security requirements. Assess alternatives based on this criteria.
    2. Review and use Info-Tech’s Mainframe TCO Comparison Tool to compare mainframe costs to the potential alternative platform.
    3. Assess the business risks and benefits. Can the alternative deliver the same performance, reliability, and security? If not, what are the risks? What do you gain by migrating?
    4. If migration is still a go, evaluate the following:
    • Do you have the expertise or a reliable third party to perform the migration, including code rewrites?
    • How long will the migration take? Can the business function effectively during this transition period?
    • How much will the migration cost? Is the value you expect to gain worth the expense?

    *3 of the top 4 challenges related to shortfalls of alternative platforms

    The image contains a bar graph that demonstrates challenges related to shortfalls of alternative platforms.

    *Source: Maximize the Value of IBM Mainframes in My Business

    Hosting

    Using a hosting provider is typically more cost-effective than running your mainframe in-house.

    Potential for reduced costs

    • Hosting enables you to reduce or eliminate your mainframe staff.
    • Economies of scale enable hosting providers to reduce software licensing costs. They also have more buying power to negotiate better terms.
    • Power and cooling costs are also transferred to the hosting provider.

    Reliable infrastructure and experienced staff

    • A quality hosting provider will have 24/7 monitoring, full redundancy, and proven disaster recovery capabilities.
    • The hosting provider will also have a larger mainframe staff, so they don’t have the same risk of suddenly being without those advanced critical skills.

    So, what are the risks?

    • A transition to a hosting provider usually means eliminating or significantly reducing your in-house mainframe staff. With that loss of in-house expertise, it will be next to impossible to bring the mainframe back in-house, and you become highly dependent on your hosting provider.

    Outsourcing

    The most common tactic is for the organization to adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house.

    The options here for the non-commodity (z/Series, IBM Power platforms, for example) are not as broad as with commodity server platforms. More confusingly, the term “outsourcing” for these can include:

    Traditional/Colocation – A customer transitions their hardware environment to a provider’s data center. The provider can then manage the hardware and “system.”

    Onsite Outsourcing – Here a provider will support the hardware/system environment at the client’s site. The provider may acquire the customer’s hardware and provide software licenses. This could also include hiring or “rebadging” staff supporting the platform. This type of arrangement is typically part of a larger services or application transformation. While low risk, it is not as cost-effective as other deployment models.

    Managed Hosting – A customer transitions their legacy application environment to an off-prem hosted multi-tenanted environment. It will provide the most cost savings following the transition, stabilization, and disposal of existing environment. Some providers will provide software licensing, and some will also support “Bring Your Own,” as permitted by IBM terms for example.

    Info-Tech Insight

    Technical debt for non-commodity platforms isn’t only hardware based. Moving an application written for the mainframe onto a “cheaper” hardware platform (or outsourced deployment) leaves the more critical problems and frequently introduces a raft of new ones.

    Re-platform – z/Series COBOL Cloud

    Re-platforming is not trivial.

    While the majority of the coded functionality (JCLs, programs, etc.) migrate easily, there will be a need to re-code or re-write objects – especially if any object, code, or location references are not exactly the same in the new environment.

    Micro Focus has solid experience in this but if consider it within the context of an 80/20 rule (the actual metrics might be much better than that), meaning that some level of rework would have to be accomplished as an overhead to the exercise.

    Build that thought into your thinking and business case.

    AWS Cloud

    • Astadia (an AWS Partner) is re-platforming mainframe workloads to AWS. With its approach you reuse the original application source code and data to AWS services. Consider reviewing Amazon’s “Migrating a Mainframe to AWS in 5 Steps.”

    Azure Cloud

    Micro Focus COBOL (Visual COBOL)

    • Micro Focus' Visual COBOL also supports running COBOL in Docker containers and managing and orchestrating the containers with Kubernetes. I personally cannot imagine what sort of drunken bender decision would lead me to move COBOL into Docker and then use Kubernetes to run in GCP but there you are...if that's your Jam you can do it.

    Re-platform – z/Series (Non-COBOL)

    But what if it's not COBOL?

    Yeah, a complication for this situation is the legacy code.

    While re-platforming/re-hosting non-COBOL code is not new, we have not had many member observations compared to the re-platforming/re-hosting of COBOL functionality initiatives.

    That being said, there are a couple of interesting opportunities to explore.

    NTT Data Services (GLOBAL)

    • Most intriguing is the re-hosting of a mainframe environment into AWS. Not sure if the AWS target supports NATURAL codebase; it does reference Adabas however (Re-Hosting Mainframe Applications to AWS with NTT DATA Services). Nevertheless, NTT has supported re-platforming and NATURAL codebase environments previously.

    ModernSystems (or ModSys) has relevant experience.

    • ModSys is the resulting entity following a merger between BluePhoenix and ATERAS a number of years ago. ATERAS is the entity I find references to within my “wayback machine” for member discussions. There are also a number of published case studies still searchable about ATERAS’ successful re-platforming engagements, including the California Public Employees Retirement System (CalPERS) most famously after the Accenture project to rewrite it failed.

    ATOS, as a hosting vendor mostly referenced by customers with global locations in a short-term transition posture, could be an option.

    Lastly, the other Managed Services vendors with NATURAL and Adabas capabilities:

    Reinvest

    By contrast, reducing the use of your mainframe makes it less cost-effective and more challenging to retain in-house expertise.

    • For organizations that have migrated applications off the mainframe (at least partly to reduce dependency on the platform), inevitably there remains a core set of mission critical applications that cannot be moved off for reasons described on the “Migrate” slide. This is when the mainframe becomes a costly burden:
      • TCO is relatively high due to low utilization.
      • In-house expertise declines as workload declines and current staffing allocations become harder to justify.
    • Organizations that are instead adding capacity and finding new ways to use this platform have lower cost concerns and resourcing challenges. The charts below illustrate this correlation. While some capacity growth is due to normal business growth, some is also due to new workloads, and it reflects an ongoing commitment to the platform.

    *92% of organizations that added capacity said TCO is lower than for commodity servers (compared to 50% of those who did not add capacity)

    *63% of organizations that added capacity said finding resources is not very difficult (compared to 42% of those who did not add capacity)

    The image contains a bar graph as described in the above text. The image contains a bar graph as described in the above text.

    *Maximize the Value of IBM Mainframes in My Business

    An important thought about data migration

    Mainframe data migrations – “VSAM, IMS, etc.”

    • While the application will be replaced and re-platformed, there is the historical VIN data remaining in the VSAM files and access via the application. The challenge is that a bulk conversion can add upfront costs and delay the re-platforming of the application functionality. Some shops will break the historical data migration into a couple of phases.
    • While there are technical solutions to accessing VSAM data stores, what I have observed with other members facing a similar scenario is a need to “shrink” the data store over time. The technical accesses to historical VSAM records would also have a lifespan, and rather than kicking the can down the road indefinitely, many have turned to a process-based solution allowing them to shrink the historical data store over time. I have observed three approaches to the handling or digitization of historical records like this:

    Temporary workaround. This would align with a technical solution allowing the VASM files to be accessed using platforms other than on mainframe hardware (Micro Focus or other file store trickery). This can be accomplished relatively quickly but does run the risk of technology obsolesce for the workaround at some point in the future.

    Bulk conversion. This method would involve the extract/transform/load of the historical records into the new application platform. Often the order of the conversion is completed on work newest to oldest (the idea is that the newest historical records would have the highest likelihood of an access need), but all files would be converted to the new application and the old data store destroyed.

    Forward convert, which would have files undergo the extract/transform/load conversion into the new application as they are accessed or reopened. This method would keep historical records indefinitely or until they are converted – or the legal retention schedule allows for their destruction (hopefully no file must be kept forever). This could be a cost-efficient approach since the historical files remaining on the VSAM platform would be shrunk over time based on demand from the district attorney process. The conversion process could be automated and scripted, with a QR step allowing for the records to be deleted from the old platform.

    Info-Tech Insight

    It is not usual for organizations to leverage options #2 and #3 above to move the functionality forward while containing the scope creep and costs for the data conversions.

    Enterprise class job scheduling

    Job scheduling or data center automation?

    • Enterprise class job scheduling solutions enable complex unattended batched programmatically conditioned task/job scheduling.
    • Data center automation (DCIM) software automates and orchestrates the processes and workflow for infrastructure operations including provisioning, configuring, patching of physical, virtual, and cloud servers, and monitoring of tasks involved in maintaining the operations of a data center or Infrastructure environment.
    • While there maybe some overlap and or confusion between data center automation and enterprise class job scheduling solutions, data center automation (DCIM) software solutions are least likely to have support for non-commodity server platforms and lack robust scheduling functionality.

    Note: Enterprise job scheduling is a topic with low member interest or demand. Since our published research is driven by members’ interest and needs, the lack of activity or member demand would obviously be a significant influence into our ability to aggregate shared member insight, trends, or best practices in our published agenda.

    Data Center Automation (DCIM) Software

    Orchestration/Provisioning Software

    Enterprise class job scheduling features

    The feature set for these tools is long and comprehensive. The feature list below is not exhaustive as specific tools may have additional product capabilities. At a minimum, the solutions offered by the vendors in the list below will have the following capabilities:

    • Automatic restart and recovery
    • File management
    • Integration with security systems such as AD
    • Operator alerts
    • Ability to control spooling devices
    • Cross-platform support
    • Cyclical scheduling
    • Deadline scheduling
    • Event-based scheduling / triggers
    • Inter-dependent jobs
    • External task monitoring (e.g. under other sub-systems)
    • Multiple calendars and time-zones
    • Scheduling of packaged applications (such as SAP, Oracle, JD Edwards)
    • The ability to schedule web applications (e.g. .net, java-based)
    • Workload analysis
    • Conditional dependencies
    • Critical process monitoring
    • Event-based automation (“self-healing” processes in response to common defined error conditions)
    • Graphical job stream/workflow visualization
    • Alerts (job failure notifications, task thresholds (too long, too quickly, missed windows, too short, etc.) via multiple channels
    • API’s supporting programmable scheduler needs
    • Virtualization support
    • Workload forecasting and workload planning
    • Logging and message data supporting auditing capabilities likely to be informed by or compliant with regulatory needs such as Sarbanes, Gramme-Leach
    • Historical reporting
    • Auditing reports and summaries

    Understand your vendors and tools

    List and compare the job scheduling features of each vendor.

    • This is not presented as an exhaustive list.
    • The list relies on observations aggregated from analyst engagements with Info-Tech Research Group members. Those member discussions tend to be heavily tilted toward solutions supporting non-commodity platforms.
    • Nothing is implied about a solution suitability or capability by the order of presentation or inclusion or absence in this list.

    ✓ Advanced Systems Concepts

    ✓ BMC

    ✓ Broadcom

    ✓ HCL

    ✓ Fortra

    ✓ Redwood

    ✓ SMA Technologies

    ✓ StoneBranch

    ✓ Tidal Software

    ✓ Vinzant Software

    Info-Tech Insight

    Creating vendor profiles will help quickly filter the solution providers that directly meet your z/Series needs.

    Advanced Systems Concepts

    ActiveBatch

    Workload Management:

    Summary

    Founded in 1981, ASCs ActiveBatch “provides a central automation hub for scheduling and monitoring so that business-critical systems, like CRM, ERP, Big Data, BI, ETL tools, work order management, project management, and consulting systems, work together seamlessly with minimal human intervention.”*

    URL

    advsyscon.com

    Coverage:

    Global

    Amazon EC2

    Hadoop Ecosystem

    IBM Cognos

    DataStage

    IBM PureData (Netezza)

    Informatica Cloud

    Microsoft Azure

    Microsoft Dynamics AX

    Microsoft SharePoint

    Microsoft Team Foundation Server

    Oracle EBS

    Oracle PeopleSoft

    SAP

    BusinessObjects

    ServiceNow

    Teradata

    VMware

    Windows

    Linux

    Unix

    IBM i

    *Advanced Systems Concepts, Inc.


    BMC

    Control-M

    Workload Management:

    Summary

    Founded in 1980, BMCs Control-M product “simplifies application and data workflow orchestration on premises or as a service. It makes it easy to build, define, schedule, manage, and monitor production workflows, ensuring visibility, reliability, and improving SLAs.”*

    URL

    bmc.com/it-solutions/control-m.html

    Coverage:

    Global

    AWS

    Azure

    Google Cloud Platform

    Cognos

    IBM InfoSphere

    DataStage

    SAP HANA

    Oracle EBS

    Oracle PeopleSoft

    BusinessObjects

    ServiceNow

    Teradata

    VMware

    Windows

    Linux

    Unix

    IBM i

    IBM z/OS

    zLinux

    *BMC

    Broadcom

    Atomic Automation

    Autosys Workload Automation

    Workload Management:

    Summary

    Broadcom offers Atomic Automation and Autosys Workload Automation which ”gives you the agility, speed and reliability required for effective digital business automation. From a single unified platform, Atomic centrally provides the orchestration and automation capabilities needed accelerate your digital transformation and support the growth of your company.”*

    URL

    broadcom.com/products/software/automation/automic-automation

    broadcom.com/products/software/automation/autosys

    Coverage:

    Global


    Windows

    MacOS

    Linux

    UNIX

    AWS

    Azure

    Google Cloud Platform

    VMware

    z/OS

    zLinux

    System i

    OpenVMS

    Banner

    Ecometry

    Hadoop

    Oracle EBS

    Oracle PeopleSoft

    SAP

    BusinessObjects

    ServiceNow

    Teradata

    VMware

    Windows

    Linux

    Unix

    IBM i

    *Broadcom

    HCL

    Workload Automation

    Workload Management:

    Summary

    “HCL Workload Automation streamlined modelling, advanced AI and open integration for observability. Accelerate the digital transformation of modern enterprises, ensuring business agility and resilience with our latest version of one stop automation platform. Orchestrate unattended and event-driven tasks for IT and business processes from legacy to cloud and kubernetes systems.”*

    URL

    hcltechsw.com/workload-automation

    Coverage:

    Global


    Windows

    MacOS

    Linux

    UNIX

    AWS

    Azure

    Google Cloud Platform

    VMware

    z/OS

    zLinux

    System i

    OpenVMS

    IBM SoftLayer

    IBM BigInsights

    IBM Cognos

    Hadoop

    Microsoft Dynamics 365

    Microsoft Dynamics AX

    Microsoft SQL Server

    Oracle E-Business Suite

    PeopleSoft

    SAP

    ServiceNow

    Apache Oozie

    Informatica PowerCenter

    IBM InfoSphere DataStage

    Salesforce

    BusinessObjects BI

    IBM Sterling Connect:Direct

    IBM WebSphere MQ

    IBM Cloudant

    Apache Spark

    *HCL Software

    Fortra

    JAMS Scheduler

    Workload Management:

    Summary

    Fortra’s “JAMS is a centralized workload automation and job scheduling solution that runs, monitors, and manages jobs and workflows that support critical business processes.

    JAMS reliably orchestrates the critical IT processes that run your business. Our comprehensive workload automation and job scheduling solution provides a single pane of glass to manage, execute, and monitor jobs—regardless of platforms or applications.”*

    URL

    jamsscheduler.com

    Coverage:

    Global


    OpenVMS

    OS/400

    Unix

    Windows

    z/OS

    SAP

    Oracle

    Microsoft

    Infor

    Workday

    AWS

    Azure

    Google Cloud Compute

    ServiceNow

    Salesforce

    Micro Focus

    Microsoft Dynamics 365

    Microsoft Dynamics AX

    Microsoft SQL Server

    MySQL

    NeoBatch

    Netezza

    Oracle PL/SQL

    Oracle E-Business Suite

    PeopleSoft

    SAP

    SAS

    Symitar

    *JAMS

    Redwood

    Redwood SaaS

    Workload Management:

    Summary

    Founded in 1993 and delivered as a SaaS solution, ”Redwood lets you orchestrate securely and reliably across any application, service or server, in the cloud or on-premises, all inside a single platform. Automation solutions are at the core of critical business operations such as forecasting, replenishment, reconciliation, financial close, order to cash, billing, reporting, and more. Enterprises in every industry — from manufacturing, utility, retail, and biotech to healthcare, banking, and aerospace.”*

    URL

    redwood.com

    Coverage:

    Global


    OpenVMS

    OS/400

    Unix

    Windows

    z/OS

    SAP

    Oracle

    Microsoft

    Infor

    Workday

    AWS

    Azure

    Google Cloud Compute

    ServiceNow

    Salesforce

    Github

    Office 365

    Slack

    Dropbox

    Tableau

    Informatica

    SAP BusinessObjects

    Cognos

    Microsoft Power BI

    Amazon QuickSight

    VMware

    Xen

    Kubernetes

    *Redwood

    Fortra

    Robot Scheduler

    Workload Management:

    Summary

    “Robot Schedule’s workload automation capabilities allow users to automate everything from simple jobs to complex, event-driven processes on multiple platforms and centralize management from your most reliable system: IBM i. Just create a calendar of when and how jobs should run, and the software will do the rest.”*

    URL

    fortra.com/products/job-scheduling-software-ibm-i

    Coverage:

    Global


    IBM i (System i, iSeries, AS/400)

    AIX/UNIX

    Linux

    Windows

    SQL/Server

    Domino

    JD Edwards EnterpriseOne

    SAP

    Automate Schedule (formerly Skybot Scheduler)

    *Fortra

    SMA Technologies

    OpCon

    Workload Management:

    Summary

    Founded in1980, SMA offers to “save time, reduce error, and free your IT staff to work on more strategic contributions with OpCon from SMA Technologies. OpCon offers powerful, easy-to-use workload automation and orchestration to eliminate manual tasks and manage workloads across business-critical operations. It's the perfect fit for financial institutions, insurance companies, and other transactional businesses.”*

    URL

    smatechnologies.com

    Coverage:

    Global

    Windows

    Linux

    Unix

    z/Series

    IBM i

    Unisys

    Oracle

    SAP

    Microsoft Dynamics AX

    Infor M3

    Sage

    Cegid

    Temenos

    FICS

    Microsoft Azure Data Management

    Microsoft Azure VM

    Amazon EC2/AWS

    Web Services RESTful

    Docker

    Google Cloud

    VMware

    ServiceNow

    Commvault

    Microsoft WSUS

    Microsoft Orchestrator

    Java

    JBoss

    Asysco AMT

    Tuxedo ART

    Nutanix

    Corelation

    Symitar

    Fiserv DNA

    Fiserv XP2

    *SMA Technologies

    StoneBranch

    Universal Automation Center (UAC)

    Workload Management:

    Summary

    Founded in 1999, ”the Stonebranch Universal Automation Center (UAC) is an enterprise-grade business automation solution that goes beyond traditional job scheduling. UAC's event-based workload automation solution is designed to automate and orchestrate system jobs and tasks across all mainframe, on-prem, and hybrid IT environments. IT operations teams gain complete visibility and advanced control with a single web-based controller, while removing the need to run individual job schedulers across platforms.”*

    URL

    stonebranch.com/it-automation-solutions/enterprise-job-scheduling

    Coverage:

    Global

    Windows

    Linux

    Unix

    z/Series

    Apache Kafka

    AWS

    Databricks

    Docker

    GitHub

    Google Cloud

    Informatica

    Jenkins

    Jscape

    Kubernetes

    Microsoft Azure

    Microsoft SQL

    Microsoft Teams

    PagerDuty

    PeopleSoft

    Petnaho

    RedHat Ansible

    Salesforce

    SAP

    ServiceNow

    Slack

    SMTP and IMAP

    Snowflake

    Tableau

    VMware

    *Stonebranch

    Tidal Software

    Workload Automation

    Workload Management:

    Summary

    Founded in 1979, Tidal’s Workload Automation will “simplify management and execution of end-to-end business processes with our unified automation platform. Orchestrate workflows whether they're running on-prem, in the cloud or hybrid environments.”*

    URL

    tidalsoftware.com

    Coverage:

    Global

    CentOS

    Linux

    Microsoft Windows Server

    Open VMS

    Oracle Cloud

    Oracle Enterprise Linux

    Red Hat Enterprise Server

    Suse Enterprise

    Tandem NSK

    Ubuntu

    UNIX

    HPUX (PA-RISC, Itanium)

    Solaris (Sparc, X86)

    AIX, iSeries

    z/Linux

    z/OS

    Amazon AWS

    Microsoft Azure

    Oracle OCI

    Google Cloud

    ServiceNow

    Kubernetes

    VMware

    Cisco UCS

    SAP R/3 & SAP S/4HANA

    Oracle E-Business

    Oracle ERP Cloud

    PeopleSoft

    JD Edwards

    Hadoop

    Oracle DB

    Microsoft SQL

    SAP BusinessObjects

    IBM Cognos

    FTP/FTPS/SFTP

    Informatica

    *Tidal

    Vinzant Software

    Global ECS

    Workload Management:

    Summary

    Founded in 1987, Global ECS can “simplify operations in all areas of production with the GECS automation framework. Use a single solution to schedule, coordinate and monitor file transfers, database operations, scripts, web services, executables and SAP jobs. Maximize efficiency for all operations across multiple business units intelligently and automatically.”*

    URL

    vinzantsoftware.com

    Coverage:

    Global

    Windows

    Linux

    Unix

    iSeries

    SAP R/3 & SAP S/4HANA

    Oracle, SQL/Server

    *Vizant Software

    Activity

    Scale Out or Scale Up

    Activities:

    1. Complete the Scale Up vs. Scale Out TCO Tool.
    2. Compare total lifecycle costs to determine TCO.

    This activity involves the following participants:

    IT strategic direction decision makers

    IT managers responsible for an existing z/Series platform

    Organizations evaluating platforms for mission critical applications

    Outcomes of this step:

    • Completed Scale Up vs. Scale Out TCO Tool

    Info-Tech Insight

    This checkpoint process creates transparency around agreement costs with the business and gives the business an opportunity to re-evaluate its requirements for a potentially leaner agreement.

    Scale out versus scale up activity

    The Scale Up vs. Scale Out TCO Tool provides organizations with a framework for estimating the costs associated with purchasing and licensing for a scale-up and scale-out environment over a multi-year period.

    Use this tool to:

    • Compare the pre-populated values.
    • Insert your own amounts to contrast possible database decisions and determine the TCO of each.
    The image contains screenshots of the Scale Up vs. Scale Out TCO Tool.

    Info-Tech Insight

    Watch out for inaccurate financial information. Ensure that the financials for cost match your maintenance and contract terms.

    Use the Scale Up vs. Scale Out TCO Tool to determine your TCO options.

    Related Info-Tech Research

    Effectively Acquire Infrastructure Services

    Acquiring a service is like buying an experience. Don’t confuse the simplicity of buying hardware with buying an experience.

    Outsource IT Infrastructure to Improve System Availability, Reliability, and Recovery

    There are very few IT infrastructure components you should be housing internally – outsource everything else.

    Build Your Infrastructure Roadmap

    Move beyond alignment: Put yourself in the driver’s seat for true business value.

    Define Your Cloud Vision

    Make the most of cloud for your organization.

    Document Your Cloud Strategy

    Drive consensus by outlining how your organization will use the cloud.

    Build a Strategy for Big Data Platforms

    Know where to start and where to focus attention in the implementation of a big data strategy.

    Create a Better RFP Process

    Improve your RFPs to gain leverage and get better results.

    Research Authors

    Darin Stahl.

    Darin Stahl, Principal Research Advisor, Info-Tech Research Group

    Darin is a Principal Research Advisor within the Infrastructure Practice, and leveraging 38+ years of experience, his areas of focus include: IT Operations Management, Service Desk, Infrastructure Outsourcing, Managed Services, Cloud Infrastructure, DRP/BCP, Printer Management, Managed Print Services, Application Performance Monitoring/ APM, Managed FTP, non-commodity servers (z/Series, mainframe, IBM i, AIX, Power PC).

    Troy Cheeseman.

    Troy Cheeseman, Practice Lead, Info-Tech Research Group

    Troy has over 25 years of IT management experience and has championed large enterprise-wide technology transformation programs, remote/home office collaboration and remote work strategies, BCP, IT DRP, IT Operations and expense management programs, international right placement initiatives, and large technology transformation initiatives (M&A). Additionally, he has deep experience working with IT solution providers and technology (cloud) start-ups.

    Bibliography

    “AWS Announces AWS Mainframe Modernization.” Business Wire, 30 Nov. 2021.
    de Valence, Phil. “Migrating a Mainframe to AWS in 5 Steps with Astadia?” AWS, 23 Mar. 2018.
    Graham, Nyela. “New study shows mainframes still popular despite the rise of cloud—though times are changing…fast?” WatersTechnology, 12 Sept. 2022.
    “Legacy applications can be revitalized with API.” MuleSoft, 2022.
    Vecchio, Dale. “The Benefits of Running Mainframe Applications on LzLabs Software Defined Mainframe® & Microsoft Azure.” LzLabs Sites, Mar. 2021.

    Modernize Your Applications

    • Buy Link or Shortcode: {j2store}178|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • member rating average days saved: Read what our members are saying
    • Parent Category Name: Architecture & Strategy
    • Parent Category Link: /architecture-and-strategy
    • Application modernization is essential to stay competitive and productive in today’s digital environment. Your stakeholders have outlined their digital business goals that IT is expected to meet.
    • Your application portfolio cannot sufficiently support the flexibility and efficiency the business needs because of legacy challenges.
    • Your teams do not have a framework to illustrate, communicate, and justify the modernization effort and organizational changes in the language your stakeholders understand.

    Our Advice

    Critical Insight

    • Build your digital applications around continuous modernization. End-user needs, technology, business direction, and regulations rapidly change in today’s competitive and fast-paced industry. This reality will quickly turn your modern applications into shelfware. Build continuous modernization at the center of your digital application vision to keep up with evolving business, end-user, and IT needs.
    • Application modernization is organizational change management. If you build and modernize it, they may not come. The crux of successful application modernization is centered on the strategic, well-informed, and onboarded adoption of changes in key business areas, capabilities, and processes. Organizational change management must be front and center so that applications are fit for purpose and are something that end users want and need to use.
    • Business-IT collaboration is not optional. Application modernization will not be successful if your lines of business (LOBs) and IT are not working together. IT must empathize how LOBs operate and proactively support the underlying operational systems. LOBs must be accountable for all products leveraging modern technologies and be able to rationalize the technical feasibility of their digital application vision.

    Impact and Result

    • Establish the digital application vision. Gain a grounded understanding of the digital application construct and prioritize these attributes against your digital business goals.
    • Define your modernization approach. Obtain a thorough view of your business and technical complexities, risks, and impacts. Employ the right modernization techniques based on your organization’s change tolerance.
    • Build your roadmap. Clarify the organizational changes needed to support modernization and adoption of your digital applications.

    Modernize Your Applications Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should strategically modernize your applications, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Set your vision

    Describe your application vision and set the right modernization expectations with your stakeholders.

    • Modernize Your Applications – Phase 1: Set Your Vision

    2. Identify your modernization opportunities

    Focus your modernization efforts on the business opportunities that your stakeholders care about.

    • Modernize Your Applications – Phase 2: Identify Your Modernization Opportunities

    3. Plan your modernization

    Describe your modernization initiatives and build your modernization tactical roadmap.

    • Modernize Your Applications – Phase 3: Plan Your Modernization
    [infographic]

    Workshop: Modernize Your Applications

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Set Your Vision

    The Purpose

    Discuss the goals of your application modernization initiatives

    Define your digital application vision and priorities

    List your modernization principles

    Key Benefits Achieved

    Clear application modernization objectives and high priority value items

    Your digital application vision and attributes

    Key principles that will guide your application modernization initiatives

    Activities

    1.1 State Your Objectives

    1.2 Characterize Your Digital Application

    1.3 Define Your Modernization Principles

    Outputs

    Application modernization objectives

    Digital application vision and attributes definitions

    List of application modernization principles and guidelines

    2 Identify Your Modernization Opportunities

    The Purpose

    Identify the value streams and business capabilities that will benefit the most from application modernization

    Conduct a change tolerance assessment

    Build your modernization strategic roadmap

    Key Benefits Achieved

    Understanding of the value delivery improvements modernization can bring

    Recognizing the flexibility and tolerance of your organization to adopt changes

    Select an approach that best fits your organization’s goals and capacity

    Activities

    2.1 Identify the Opportunities

    2.2 Define Your Modernization Approach

    Outputs

    Value streams and business capabilities that are ideal modernization opportunities

    Your modernization strategic roadmap based on your change tolerance and modernization approach

    3 Plan Your Modernization

    The Purpose

    Identify the most appropriate modernization technique and the scope of changes to implement your techniques

    Develop an actionable tactical roadmap to complete your modernization initiatives

    Key Benefits Achieved

    Clear understanding of what must be changed to the organization and application considering your change tolerance

    An achievable modernization plan

    Activities

    3.1 Shortlist Your Modernization Techniques

    3.2 Roadmap Your Modernization Initiatives

    Outputs

    Scope of your application modernization initiatives

    Your modernization tactical roadmap

    Prepare for Cognitive Service Management

    • Buy Link or Shortcode: {j2store}335|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: 10 Average Days Saved
    • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • Parent Category Name: Strategy and Organizational Design
    • Parent Category Link: /strategy-and-organizational-design
    • The evolution of natural language processing and machine learning applications has led to specialized AI-assisted toolsets that promise to improve the efficiency and timeliness of IT operations.

    Our Advice

    Critical Insight

    • These are early days. These AI-assisted toolsets are generating a considerable amount of media attention, but most of them are relatively untested. Early adopters willing to absorb experimentation costs are in the process of deploying the first use cases. Initial lessons are showing that IT operations in most organizations are not yet mature enough to take advantage of AI-assisted toolsets.
    • Focus on the problem, not the tool. Explicit AI questions should be at the end of the list. Start by asking what business problem you want to solve.
    • Get your house in order. The performance of AI-assisted tools depends on mature IT operations processes and reliable data sets. Standardize service management processes and build a knowledgebase of structured content to prepare for AI-assisted IT operations.

    Impact and Result

    • Don’t fall prey to the AI-bandwagon effect. AI-assisted innovations will support shift-left service support strategies through natural language processing and machine learning applications. However, the return on your AI investment will depend on whether it helps you meet an actual business goal.
    • AI-assisted tools presuppose the existence of mature IT operations functions, including standardized processes, high-quality structured content focused on the incidents and requests that matter, and a well-functioning ITSM web portal.
    • The success of AI ITSM projects hinges on adoption. If your vision is to power end-user interactions with chatbots and deploy intelligent agents on tickets coming through the web portal, be sure to develop a self-service culture that empowers end users to help themselves and experiment with new tools and technologies. Without end-user adoption, the promised benefits of AI projects will not materialize.

    Prepare for Cognitive Service Management Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should prepare for cognitive service management, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Review emerging AI technology

    Get an overview of emerging AI applications to understand how they will strengthen a shift-left service support strategy.

    2. Sort potential IT operations AI use cases

    Review potential use cases for AI applications to prioritize improvement initiatives and align them to organizational goals.

    • Disruptive Technology Shortlisting Tool
    • Disruptive Technology Value-Readiness and SWOT Analysis Tool

    3. Prepare for a cognitive service management project

    Develop an ITSM AI strategy to prepare your organization for the coming of cognitive service management, and build a roadmap for implementation.

    • Customer Journey Map (PDF)
    • Customer Journey Map (Visio)
    • Infrastructure Roadmap Technology Assessment Tool
    • Strategic Infrastructure Roadmap Tool
    [infographic]

    Integrate Portfolios to Create Exceptional Customer Value

    • Buy Link or Shortcode: {j2store}176|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Architecture & Strategy
    • Parent Category Link: /architecture-and-strategy
    • Through growth, both organic and acquisition, you have a significant footprint of projects and applications.
    • Projects and applications have little in common with one another, all with their own history and pedigree.
    • You need to look across your portfolio of applications and projects to see if they will collectively help the organization achieve its goals.

    Our Advice

    Critical Insight

    • Stakeholders don’t care about the minutia and activities involved in project and application portfolio management.
    • Timely delivery of effective and important applications that deliver value throughout their life are the most important factors driving business satisfaction with IT.

    Impact and Result

    • Define an organizing principle that will structure your projects and applications in a way that matters to your stakeholders.
    • Bridge application and project portfolio data using the organizing principle that matters to communicate with stakeholders across the organization.
    • Create a dashboard that brings together the benefits of both project and application portfolio management to improve visibility and decision making.

    Integrate Portfolios to Create Exceptional Customer Value Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should integrate your application and project portfolios, review Info-Tech’s methodology, and understand the three ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define the principle that organizes your portfolios, objectives, and stakeholders

    To bring your portfolios together, you need to start with learning about your objectives, principles, and stakeholders.

    • Integrate Portfolios to Create Exceptional Customer Value – Phase 1: Define the Principle That Organizes Your Portfolios, Objectives, and Stakeholders
    • Integrated Portfolio Dashboard Tool
    • Integrated Portfolio Dashboard Tool – Example

    2. Take stock of what brings you closer to your goals

    Get a deeper understanding of what makes up your organizing principle before learning about your applications and projects that are aligned with your principles.

    • Integrate Portfolios to Create Exceptional Customer Value – Phase 2: Take Stock of What Brings You Closer to Your Goals

    3. Bring it all together

    Bound by your organizing principles, bring your projects and applications together under a single dashboard. Once defined, determine the rollout and communication plan that suits your organization.

    • Integrate Portfolios to Create Exceptional Customer Value – Phase 3: Bring It All Together
    • Integrated Portfolio Communication and Roadmap Plan
    • Integrated Portfolio Communication and Roadmap Plan Example
    [infographic]

    Workshop: Integrate Portfolios to Create Exceptional Customer Value

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Looking at Your Principles

    The Purpose

    Determine your organizational objectives and organizing principle.

    Key Benefits Achieved

    A clear understanding of where you need to go as an organization.

    A clear way to enable all parts of your portfolio to come together.

    Activities

    1.1 Determine your organization’s objectives.

    1.2 Determine your key stakeholders.

    1.3 Define your organizing principle.

    1.4 Decompose your organizing principle into its core components.

    Outputs

    Determined organizing principle for your applications and projects

    2 Understanding Your Applications

    The Purpose

    Get a clear view of the applications that contribute to your organization’s objectives.

    Key Benefits Achieved

    A key element of IT value delivery is its applications. Gaining awareness allows you to evaluate if the right value is being provided.

    Activities

    2.1 Determine your complete list of applications.

    2.2 Determine the health of your applications.

    2.3 Link your applications to the organization’s core components.

    Outputs

    List of applications

    Application list with health statistics filled in

    List of applications with health metrics bound to the organization’s core components

    3 Understanding Your Projects

    The Purpose

    Get a clear view of your project portfolio and how it relates to your applications and their organizing principle.

    Key Benefits Achieved

    An understanding of your project portfolio.

    Activities

    3.1 List all in-flight projects and vital health statistics.

    3.2 Map out the key programs and projects in your portfolio to the application’s core components.

    Outputs

    List of projects

    List of projects mapped to applications they impact

    4 Rolling Out the New Dashboard

    The Purpose

    Bring together your application and project portfolios in a new, easy-to-use dashboard with a full rollout plan.

    Key Benefits Achieved

    Dashboard available for use

    Roadmap and communication plan to make dashboard implementable and tangible

    Activities

    4.1 Test the dashboard.

    4.2 Define your refresh cadence.

    4.3 Plan your implementation.

    4.4 Develop your communication plan.

    Outputs

    Validated dashboards

    Microsoft Teams Cookbook

    • Buy Link or Shortcode: {j2store}408|cart{/j2store}
    • member rating overall impact: 8.8/10 Overall Impact
    • member rating average dollars saved: $6,299 Average $ Saved
    • member rating average days saved: 27 Average Days Saved
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity

    Remote work calls for leveraging your Office 365 license to use Microsoft Teams – but IT is unsure about best practices for governance and permissions. Moreover, IT has few resources to help train end users with Teams best practices.

    Our Advice

    Critical Insight

    Microsoft Teams is not a standalone app. Successful utilization of Teams occurs when conceived in the broader context of how it integrates with Office 365. Understanding how information flows between Teams, SharePoint Online, and OneDrive for Business, for instance, will aid governance with permissions, information storage, and file sharing.

    Impact and Result

    Use Info-Tech’s Microsoft Teams Cookbook to successfully implement and use Teams. This cookbook includes recipes for:

    • IT best practices concerning governance of the creation process and Teams rollout.
    • End-user best practices for Teams functionality and common use cases.

    Microsoft Teams Cookbook Research & Tools

    Start here – read the Executive Brief

    Learn critical insights for an effective Teams rollout.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Microsoft Teams Cookbook – Sections 1-2

    1. Teams for IT

    Understand best practices for governance of the Teams creation process and Teams rollout.

    • Microsoft Teams Cookbook – Section 1: Teams for IT

    2. Teams for end users

    Get end users on board with this series of how-tos and common use cases for Teams.

    • Microsoft Teams Cookbook – Section 2: Teams for End Users

    [infographic]

     

    Further reading

    Microsoft Teams Cookbook

    Recipes for best practices and use cases for Microsoft Teams.

    Table of contents

    Executive Brief

    Section 1: Teams for IT

    Section 2: Teams for End Users

    Executive Summary

    Situation

    Remote work calls for leveraging your Office 365 license to utilize Teams – but IT is unsure about best practices for governance and permissions.

    Without a framework or plan for governing the rollout of Teams, IT risks overlooking secure use of Teams, the phenomenon of “teams sprawl,” and not realizing how Teams integrates with Office 365 more broadly.

    Complication

    Teams needs to be rolled out quickly, but IT has few resources to help train end users with Teams best practices.

    With teams, channels, chats, meetings, and live events to choose from, end users may get frustrated with lack of guidance on how to use Teams’ many capabilities.

    Resolution

    Use Info-Tech’s Microsoft Teams Cookbook to successfully implement and utilize Teams. This cookbook includes recipes for:

    • IT best practices concerning governance of the creation process and Teams rollout.
    • End-user best practices for Teams functionality and common use cases.

    Key Insights

    Teams is not a standalone app

    Successful utilization of Teams occurs when conceived in the broader context of how it integrates with Office 365. Understanding how information flows between Teams, SharePoint Online, and OneDrive for Business, for instance, will aid governance with permissions, information storage, and file sharing.

    IT should paint the first picture for team creation

    No initial governance for team creation can lead to “teams sprawl.” While Teams was built to allow end users’ creativity to flow in creating teams and channels, this can create problems with a cluttered interface and keeping track of information. To prevent end-user dissatisfaction here, IT’s initial Teams rollout should offer a basic structure for end users to work with first, limiting early teams sprawl.

    The Teams admin center can only take you so far with permissions

    Knowing how Teams integrates with other Office 365 apps will help with rolling out sensitivity labels to protect important information being accidentally shared in Teams. Of course, technology only does so much – proper processes to train and hold people accountable for their actions with data sharing must be implemented, too.

    Related Info-Tech Research

    Establish a Communication and Collaboration System Strategy

    Don’t waste your time deploying yet another collaboration tool that won’t get used.

    Modernize Communication and Collaboration Infrastructure

    Your legacy telephony infrastructure is dragging you down – modern communications and collaboration technology will dramatically improve productivity.

    Migrate to Office 365 Now

    One small step to cloud, one big leap to Office 365. The key is to look before you leap.

    Section 1: Teams for IT

    Governance best practices and use cases for IT

    Section 1

    Teams for IT

    Section 2

    Teams for end users

    From determining prerequisites to engaging end users.

    IT fundamentals
    • Creation process
    • Teams rollout
    Use cases
    • Retain and search for legal/regulatory compliance
    • Add an external user to a team
    • Delete/archive a team

    Overview: Creation process

    IT needs to be prepared to manage other dependent services when rolling out Teams. See the figure below for how Teams integrates with these other Office 365 applications.

    A flow chart outlining how Teams integrates with other Office 365 applications. Along the side are different applications, from the top: 'Teams client', 'OneDrive for Business', 'Sharepoint Online', 'Planner (Tasks for Teams)', 'Exchange Online', and 'Stream'. Along the top are services of 'Teams client', 'Files', 'Teams', 'Chat', 'Meeting', and 'Calls'.

    Which Microsoft 365 license do I need to access Teams?

    • Microsoft 365 Business Essentials
    • Microsoft 365 Business Premium
    • Office 365 Enterprise, E1, E3, or E5
    • Office 365 Enterprise E4 (if purchased prior to its retirement)

    Please note: To appeal to the majority of Info-Tech’s members, this blueprint refers to Teams in the context of Office 365 Enterprise licenses.

    Assign admin roles

    You will already have at least one global administrator from setting up Office 365.

    Global administrators have almost unlimited access to settings and most of the data within the software, so Microsoft recommends having only two to four IT and business owners responsible for data and security.

    Info-Tech Best Practice

    Configure multifactor authentication for your dedicated Office 365 global administrator accounts and set up two-step verification.

    Once you have organized your global administrators, you can designate your other administrators with “just-enough” access for managing Teams. There are four administrator roles:

    Teams Service Administrator Manage the Teams service; manage and create Microsoft 365 groups.
    Teams Communications Administrator Manage calling and meetings features with Teams.
    Teams Communications Support Engineer Troubleshoot communications issues within Teams using the advanced troubleshooting toolset.
    Teams Communications Support Specialist Troubleshoot communications issues using Call Analytics.

    Prepare the network

    There are three prerequisites before Teams can be rolled out:

    • UDP ports 3478 through 3481 are opened.
    • You have a verified domain for Office 365.
    • Office 365 has been rolled out, including Exchange Online and SharePoint Online.

    Microsoft then recommends the following checklist to optimize your Teams utilization:

    • Optimize calls and performance using the Call Quality Dashboard.
    • Assess network requirements in the Network Planner in the Teams admin center.
    • Ensure all computers running Teams client can resolve external DNS queries.
    • Check adequate public IP addresses are assigned to the NAT pools to prevent port exhaustion.
    • Route to local or regional Microsoft data centers.
    • Whitelist all Office 365 URLs to move through security layers, especially IDS/IPS.
    • Split tunnel Teams traffic so it bypasses your organization’s VPN.

    Info-Tech Best Practice

    For online support and walkthroughs, utilize Advisor for Teams. This assistant can be found in the Teams admin center.

    Team Creation

    You can create and manage Teams through the Teams PowerShell module and the Teams admin center. Only the global administrator and Teams service administrator have full administrative capabilities in this center.

    Governance over team creation intends to prevent “teams sprawl” – the phenomenon whereby end users create team upon team without guidance. This creates a disorganized interface, with issues over finding the correct team and sharing the right information.

    Prevent teams sprawl by painting the first picture for end users:

    1. Decide what kind of team grouping would best fit your organization: by department or by project.
    2. Start with a small number of teams before letting end users’ creativity take over. This will prevent initial death by notifications and support adoption.
    3. Add people or groups to these teams. Assign multiple owners for each team in case people move around at the start of rollout or someone leaves the organization.
    4. Each team has a general channel that cannot be removed. Use it for sharing an overview of the team’s goals, onboarding, and announcements.

    Info-Tech Best Practice

    For smaller organizations that are project-driven, organize teams by projects. For larger organizations with established, siloed departments, organize by department; projects within departments can become channels.

    Integrations with SharePoint Online

    Teams does not integrate with SharePoint Server.

    Governance of Teams is important because of how tightly it integrates with other Office 365 apps, including SharePoint Online.

    A poor rollout of Teams will have ramifications in SharePoint. A good rollout will optimize these apps for the organization.

    Teams and SharePoint integrate in the following ways:

    • Each team created in Teams automatically generates a SharePoint team site behind it. All documents and chat shared through a team are stored in that team’s SharePoint document library.
    • As such, all files shared through Teams are subject to SharePoint permissions.
    • Existing SharePoint folders can be tied to a team without needing to create a new one.
    • If governance over resource sharing in Teams is poor, information can get lost, duplicated, or cluttered throughout both Teams and SharePoint.

    Info-Tech Best Practice

    End users should be encouraged to integrate their teams and channels with existing SharePoint folders and, where no folder exists, to create one in SharePoint first before then attaching a team to it.

    Permissions

    Within the Teams admin center, the global or Teams service administrator can manage Teams policies.

    Typical Teams policies requiring governance include:

    • The extent end users can discover or create private teams or channels
    • Messaging policies
    • Third-party app use

    Chosen policies can be either applied globally or assigned to specific users.

    Info-Tech Best Practice

    If organizations need to share sensitive information within the bounds of a certain group, private channels help protect this data. However, inviting users into that channel will enable them to see all shared history.

    External and guest access

    Within the security and compliance center, the global or Teams service administrator can set external and guest access.

    External access (federation) – turned on by default.

    • Lets you find, call, and chat with users in other domains. External users will have no access to the organization’s teams or team resources.

    Guest access – turned off by default.

    • Lets you add individual users with their own email address. You do this when you want external users to access teams and team resources. Approved guests will be added to the organization’s active directory.

    If guest access is enabled, it is subject to Azure AD and Office 365 licensing and service limits. Guests will have no access to the following, which cannot be changed:

    • OneDrive for Business
    • An organization’s calendar/meetings
    • PSTN
    • Organization’s hierarchical chart
    • The ability to create, revise, or browse a team
    • Upload files to one-on-one chat

    Info-Tech Best Practice

    Within the security and compliance center, you can allow users to add sensitivity labels to their teams that can prevent external and guest access.

    Expiration and archiving

    To reduce the number of unused teams and channels, or delete information permanently, the global or Teams service administrator can implement an Office 365 group expiration and archiving policy through the Teams admin center.

    If a team has an expiration policy applied to it, the team owner will receive a notification for team renewal 30 days, 15 days, and 1 day before the expiry date. They can renew their team at any point within this time.

    • To prevent accidental deletion, auto-renewal is enabled for a team. If the team owner is unable to manually respond, any team that has one channel visit from a team member before expiry is automatically renewed.
    • A deleted Office 365 group is retained for 30 days and can be restored at any point within this time.

    Alternatively, teams and their channels (including private) can be archived. This will mean that all activity for the team ceases. However, you can still add, remove, and update roles of the members.

    Retention and data loss prevention

    Retention policies can be created and managed in the Microsoft 365 Compliance Center or the security and compliance center PowerShell cmdlets. This can be applied globally or to specific users.

    By default, information shared through Teams is retained forever.

    However, setting up retention policies ensures data is retained for a specified time regardless of what happens to that data within Teams (e.g. user deletes).

    Info-Tech Best Practice

    To prevent external or guest users accessing and deleting sensitive data, Teams is able to block this content when shared by internal users. Ensure this is configured appropriately in your organization:

    • For guest access in teams and channels
    • For external access in meetings and chat

    Please note the following limitations of Teams’ retention and data loss prevention:

    • Organization-wide retention policies will need to be manually inputted into Teams. This is because Teams requires a retention policy that is independent of other workloads.
    • As of May 2020, retention policies apply to all information in Teams except private channel messages. Files shared in private channels, though, are subject to retention policies.
    • Teams does not support advanced retention settings, such as a policy that pertains to specific keywords or sensitive information.
    • It will take three to seven days to permanently delete expired messages.

    Teams telephony

    Teams has built-in functionality to call any team member within the organization through VoIP.

    However, Teams does not automatically connect to the PSTN, meaning that calling or receiving calls from external users is not immediately possible.

    Bridging VoIP calls with the PSTN through Teams is available as an add-on that can be attached to an E3 license or as part of an E5 license.

    There are two options to enable this capability:

    • Enable Phone System. This allows for call control and PBX capabilities in Office 365.
    • Use direct routing. You can use an existing PSTN connection via a Session Border Controller that links with Teams (Amaxra).

    Steps to implement Teams telephony:

    1. Ensure Phone System and required (non-Microsoft-related) services are available in your country or region.
    2. Purchase and assign Phone System and Calling Plan licenses. If Calling Plans are not available in your country or region, Microsoft recommends using Direct Routing.
    3. Get phone numbers and/or service numbers. There are three ways to do this:
      • Get new numbers through the Teams admin center.
      • If you cannot get new numbers through the Teams admin center, you can request new numbers from Microsoft directly.
      • Port or transfer existing numbers. To do this, you need to send Microsoft a letter of authorization, giving them permission to request and transfer existing numbers on your behalf.
    4. To enable service numbers, including toll-free numbers, Microsoft recommends setting up Communications Credits for your Calling Plans and Audio Conferencing.

    Overview: Teams rollout

    1. From Skype (and Slack) to Teams
    2. Gain stakeholder purchase
    3. Employ a phased deployment
    4. Engage end users

    Skype for Business is being retired; Microsoft offers a range of transitions to Teams.

    Combine the best transition mode with Info-Tech’s adoption best practices to successfully onboard and socialize Teams.

    From Skype to Teams

    Skype for Business Online will be retired on July 31, 2021. Choose from the options below to see which transition mode is right for your organization.

    Skype for Business On-Premises will be retired in 2024. To upgrade to Teams, first configure hybrid connectivity to Skype for Business Online.

    Islands mode (default)

    • Skype for Business and Teams coexist while Teams is rolled out.
    • Recommended for phased rollouts or when Teams is ready to use for chat, calling, and meetings.
    • Interoperability is limited. Teams and Skype for Business only transfer information if an internal Teams user sends communications to an external Skype for Business user.

    Teams only mode (final)

    • All capabilities are enabled in Teams and Skype for Business is disabled.
    • Recommended when end users are ready to switch fully to Teams.
    • End users may retain Skype for Business to join meetings with non-upgraded or external parties. However, this communication is only initiated from the Skype for Business external user.

    Collaboration first mode

    • Skype for Business and Teams coexist, but only Teams’ collaboration capabilities are enabled. Teams communications capabilities are turned off.
    • Recommended to leverage Skype for Business communications yet utilize Teams for collaboration.

    Meetings first mode

    • Skype for Business and Teams coexist, but only Teams’ meetings capabilities are enabled.
    • Recommended for organizations that want to leverage their Skype for Business On-Premises’ Enterprise Voice capability but want to benefit from Teams’ meetings through VoIP.

    From Slack to Teams

    The more that’s left behind in Slack, the easier the transition. As a prerequisite, pull together the following information:

    • Usage statistics of Slack workspaces and channels
    • What apps end users utilize in Slack
    • What message history you want to export
    • A list of users whose Slack accounts can map on to required Microsoft accounts
    Test content migration

    Your Slack service plan will determine what you can and can’t migrate. By default, public channels content can be exported. However, private channels may not be exportable, and a third-party app is needed to migrate Direct Messages.

    Files migration

    Once you have set up your teams and channels in Teams, you can programmatically copy files from Slack into the target Teams channel.

    Apps migration

    Once you have a list of apps and their configurations used in Slack’s workspaces, you can search in Teams’ app store to see if they’re available for Teams.

    User identity migration

    Slack user identities may not map onto a Microsoft account. This will cause migration issues, such as problems with exporting text content posted by that user.

    Follow the migration steps to the right.

    Importantly, determine which Slack workspaces and channels should become teams and channels within Teams.

    Usage statistics from Slack can help pinpoint which workspaces and channels are redundant.

    This will help IT paint an ordered first picture for new Teams end users.

    1. Create teams and channels in Teams
    2. Copy files into Teams
    3. Install apps, configure Office 365 Connecters
    4. Import Slack history
    5. Disable Slack user accounts

    Info-Tech Best Practice

    Avoid data-handling violations. Determine what privacy and compliance regulations (if any) apply to the handling, storage, and processing of data during this migration.

    Gain stakeholder purchase

    Change management is a challenging aspect of implementing a new collaboration tool. Creating a communication and adoption plan is crucial to achieving universal buy-in for Teams.

    To start, define SMART objectives and create a goals cascade.

    Specific Measurable Actionable Realistic Time Bound
    Make sure the objective is clear and detailed. Objectives are `measurable` if there are specific metrics assigned to measure success. Metrics should be objective. Objectives become actionable when specific initiatives designed to achieve the objective are identified. Objectives must be achievable given your current resources or known available resources. An objective without a timeline can be put off indefinitely. Furthermore, measuring success is challenging without a timeline.
    Who, what, where, why? How will you measure the extent to which the goal is met? What is the action-oriented verb? Is this within my capabilities? By when: deadline, frequency?

    Sample list of stakeholder-specific benefits from improving collaboration

    Stakeholder Driver Benefits
    Senior Leadership Resource optimization Increased transparency into IT operational costs.
    Better ability to forecast hardware, resourcing costs.
    All employees Increasing productivity Apps deployed faster.
    Issues fixed faster.
    Easier access to files.
    Able to work more easily offsite.
    LBU-HR, legal, finance Mitigating risk Better able to verify compliance with external regulations.
    Better understanding of IT risks.
    Service desk Resource optimization Able to resolve issues faster.
    Fewer issues stemming from updates.
    Tier 2 Increasing productivity Less time spent on routine maintenance.

    Use these activities to define what pain points stakeholders face and how Teams can directly mitigate those pain points.

    (Source: Rationalize Your Collaboration Tools (coming soon), Activities: 3.1C – 3.1D)

    Employ a phased deployment

    Info-Tech Best Practice

    Deploy Teams over a series of phases. As such, if you are already using Skype for Business, choose one of the coexistence phases to start.

      1. Identify and pilot Teams with early adopters that will become your champions. These champions should be formally trained, be encouraged to help and train their colleagues, and be positively reinforced for their efforts.
      2. Iron out bugs identified with the pilot group and train middle management. Enterprise collaboration tool adoption is strongly correlated with leadership adoption.
        1. Top-level management
          Control and direct overall organization.
        2. Middle management
          Execute top-level management’s plans in accordance with organization’s norms.
        3. First-level management
          Execute day-to-day activities.
      3. Use Info-Tech’s one-pager marketing template to advertise the new tool to stakeholders. Highlight how the new tool addresses specific pain points. Address questions stemming from fear and uncertainty to avoid employees’ embarrassment or their rejection of the tool.
    A screenshot of Info-Tech's one-pager marketing template.
    1. Extend the pilot to other departments and continue this process for the whole organization.

    (Source: Rationalize Your Collaboration Tools (coming soon), Tools:GANTT Chart and Marketing Materials, Activities: 3.2A – 3.2B)

    Info-Tech Insight

    Be in control of setting and maintaining expectations. Aligning expectations with reality and the needs of employees will lower onboarding resistance.

    Engage end users

    Short-term best practices

    Launch day:
    • Hold a “lunch and learn” targeted training session to walk end users through common use cases.
    • Open a booth or virtual session (through Teams!) and have tool representatives available to answer questions.
    • Create a game to get users exploring the new tool – from scavenger hunts to bingo.
    Launch week:
    • Offer incentives for using the tool and helping others, including small gift cards.
    • Publicize achievements if departments hit adoption milestones.

    Long-term best practices

    • Make available additional training past launch week. End users should keep learning new features to improve familiarity.
    • Distribute frequent training clips, slowly exposing end users to more complex ways of utilizing Teams.
    • Continue to positively reinforce and recognize those who use Teams well. This could be celebrating those that help others use the tool, how active certain users are, and attendance at learning events.

    Info-Tech Best Practice

    Microsoft has a range of training support that can be utilized. From instructor-led training to “Coffee in the Cloud” sessions, leverage all the support you can.

    Use case #1: Retain and search data for legal/regulatory compliance

    Scenario:

    Your organization requires you to retain data and documents for a certain period of time; however, after this period, your organization wishes to delete or archive the data instead of maintaining it indefinitely. Within the timeframe of the retention policy, the admin may be asked to retrieve information that has been requested through a legal channel.

    Purpose:
    • Maintain compliance with the legal and regulatory standards to which the organization is subject.
    Jobs:
    • Ensure the data is retained for the approved time period.
    • Ensure the policy applies to all relevant data and users.
    Solution: Retention Policies
    • Ensure that your organization has an Office 365 E3 or higher license.
    • Set the desired retention policy through the Security & Compliance Center or PowerShell by deciding which teams, channels, chats, and users the policies will apply to and what will happen once the retention period ends.
    • Ensure that matching retention policies are applied to SharePoint and OneDrive, since this is where files shared in Teams are stored.
    • Be aware that Teams retention policies cannot be applied to messages in private channels.
    Solution: e-Discovery
    • If legally necessary, place users or Teams on legal hold in order to retain data that would be otherwise deleted by your organization’s retention policies.
    • Perform e-discovery on Teams messages, files, and summaries of meetings and calls through the Security & Compliance Center.
    • See Microsoft’s chart on the next slide for what is e-discoverable.

    Content subject to e-discovery

    Content type eDiscoverable Notes
    Teams chat messages Yes Chat messages from chats where guest users are the only participants in a 1:1 or 1:N chat are not e-discoverable.
    Audio recordings No  
    Private channel messages Yes  
    Emojis, GIFs, stickers Yes  
    Code snippets No  
    Chat links Yes  
    Reactions (likes, hearts, etc) No  
    Edited messages Yes If the user is on hold, previous versions of edited messages are preserved.
    Inline images Yes  
    Tables Yes  
    Subject Yes  
    Quotes Yes Quoted content is searchable. However, search results don’t indicate that the content was quoted.
    Name of channel No  

    E-discovery does not capture audio messages and read receipts in MS Teams.

    Since files shared in private channels are stored separately from the rest of a team, follow Microsoft’s directions for how to include private channels in e-discovery. (Source: “Conduct an eDiscovery investigation of content in Microsoft Teams,” Microsoft, 2020.)

    Use case #2: Add external person to a team

    Scenario:

    A team in your organization needs to work in an ongoing way with someone external to the company. This user needs access to the relevant team’s work environment, but they should not be privy to the goings-on in the other parts of the organization.

    Jobs:

    This external person needs to be able to:

    • Attend meetings
    • Join calls
    • Chat with individual team members
    • View and collaborate on the team’s files
    Solution:
    • If necessary, set a data loss prevention policy to prevent your users from sharing certain types of information or files with external users present in your organization’s Teams chats and public channels.
    • Ensure that your Microsoft license includes DLP protection. However:
      • DLP cannot be applied to private channel messages.
      • DLP cannot block messages from external Skype for Business users nor external users who are not in “Teams only” mode.
    • Ensure that you have a team set up for the project that you wish the external user to join. The external user will be able to see all the channels in this team, unless you create a private channel they are restricted from.
    • Complete Microsoft’s “Guest Access Checklist” to enable guest access in Teams, if it isn’t already enabled.
    • As admin, give the external user guest access through the Teams admin center or Azure AD B2B collaboration. (If given permission, team owners can also add guests through the Teams client).
    • Decide whether to set a policy to monitor and audit external user activity.

    Use case #3: Delete/archive a team

    Scenario:

    In order to avoid teams sprawl, organizations may want IT to periodically delete or archive unused teams within the Teams client in order to improve the user interface.

    Alternately, if you are using a project-based approach to organizing Teams, you may wish to formalize a process to archive a team once the project is complete.

    Delete:
    • Determine if the team owner anticipates the team will need to be restored one day.
    • Ensure that deletion does not contradict the organization’s retention policy.
    • If not, proceed with deletion. Find the team in the Teams admin center and delete.
    • Restore a deleted team within 30 days of its initial deletion through PowerShell.
    Archive:
    • Determine if the team owner anticipates the team will need to be restored one day.
    • Find the relevant team in the Teams admin center and change its status to “Archived.”
    • Restore the archived team if the workspace becomes relevant once again.

    Info-Tech Best Practice

    Remind end users that they can hide teams or channels they do not wish to see in their Teams interface. Knowing a team can be hidden may impact a team owner’s decision to delete it.

    Section 2: Teams for End Users

    Best practices for utilizing teams, channels, chat, meetings, and live events

    Section 1

    Teams for IT

    Section 2

    Teams for end users

    From Teams how-tos to common use cases for end users.

    End user basics
    • Teams, channels, and chat
    • Meetings and live events
    Common use cases: Workspaces
    • WS#1: Departments
    • WS#2: A cross-functional committee
    • WS#3: An innovation day event
    • WS#4: A non-work-related social event
    • WS#5: A project team with a defined end time
    Common use cases: Meetings
    • M#1: Job interview with an external candidate
    • M#2: Quarterly board meeting
    • M#3: Weekly recurring team meeting
    • M#4: Morning stand-up/scrum
    • M#5: Phone call between two people

    Overview: Teams, channels, and chat

    Teams

    • Team: A workspace for a group of collaborative individuals.
      • Public channel: A focused area where all members of a team can meet, communicate, and share ideas and content.
      • Private channel: Like a public channel but restricted to a subset of team members, defined by channel owner.

    Chat

    • Chat: Two or more users collected into a common conversation thread.
    (Source: “Overview of teams and channels in Microsoft Teams,” Microsoft, 2020.)

    For any Microsoft Teams newcomer, the differences between teams, channels, and chat can be confusing.

    Use Microsoft’s figure (left) to see how these three mediums differ in their role and function.

    Best practices: Workspaces 1/2

      Team
    A workspace for a group of collaborative individuals.
    Public Channel
    A focused area where all members of a team can meet, communicate, and share ideas and content.
    Private Channel
    Like a public channel but restricted to a subset of team members, defined by channel owner.
    Group Chat
    Two or more users collected into a common conversation thread.
    Limits and Administrative Control
    Who can create? Default setting: All users in an organization can create a team

    Maximum 500,000 teams per tenant

    Any member of a team can create a public channel within the team

    Maximum 200 public channels per team

    Any member of a team can create a private channel and define its members

    Maximum 30 private channels per team

    Anyone
    Who can add members? Team owner(s); max 5,000 members per team N/A Channel owner(s) can add up to 250 members Anyone can bring new members into the chat (and decide if they can see the previous history) up to 100 members
    Who can delete? Team owner/admin can delete Any team member Channel owner(s) Anyone can leave a chat but cannot delete chat, but they are never effectively deleted
    Social Context
    Who can see it? Public teams are indexed and searchable

    Private teams are not indexed and are visible only to joined members

    All members of the team can see all public channels. Channels may be hidden from view for the purposes of cleaning up the UI. Individuals will only see private channels for which they have membership Only participants in the group chat can see the group chat
    Who can see the content? Team members can see any content that is not otherwise part of a private channel All team members All members of the private channel Only members of the group chat

    When does a Group Chat become a Channel?

    • When it’s appropriate for the conversation to have a gallery – an audience of members who may not be actively participating in the discussion.
    • When control over who joins the conversation needs to be centrally governed and not left up to anyone in the discussion.
    • When the discussion will persist over a longer time period.
    • When the number of participants approaches 100.

    When does a Channel become a Team?

    • When a team approaches 30 private channels, many of those private channels are likely candidates to become their own team.
    • When the channel membership needs to extend beyond the boundary of the team membership.

    Best practices: Workspaces 2/2

      Team
    A workspace for a group of collaborative individuals.
    Public Channel
    A focused area where all members of a team can meet, communicate, and share ideas and content.
    Private Channel
    Like a public channel but restricted to a subset of team members, defined by channel owner.
    Group Chat
    Two or more users collected into a common conversation thread.
    Data and Applications
    Where does the content live? SharePoint: Every team resides in its own SharePoint site SharePoint: Each team (public and private) has its own folder off the root of the SharePoint site’s repository SharePoint: Each team (public and private) has its own folder off the root of the SharePoint site’s repository OneDrive: Files that are shared in a chat are stored in the OneDrive folder of the original poster and shared to the other members
    How does the data persist or be retained? If a team expires/is deleted, its corresponding SharePoint site and those artifacts are also deleted Available for 21 days after deletion. Any member of the team can delete a public channel. The team owner and private channel owner can delete/restore a private channel Chats are never effectively deleted. They can be hidden to clean up the user interface.
    Video N/A Yes, select “Meet now” in channel below text entry box Yes, select “Meet now” in channel below text entry box Yes
    Phone calls N/A Yes, select “Meet now” in channel below text entry box Yes, select “Meet now” in channel below text entry box Yes
    Shared computer audio/screen N/A Yes, select “Meet now” in channel below text entry box Yes, select “Meet now” in channel below text entry box Yes
    File-sharing Within channels Yes. Frequently used/collaborated files can be turned into discrete tab. Yes. Frequently used/collaborated files can be turned into discrete tab. Yes
    Wikis Within channels Yes Yes No
    Whiteboarding No No No No

    When does a Team become a Channel?

    • When a team’s purpose for existing can logically be subsumed by another team that has a larger scope.

    When does a Channel become a Group Chat?

    • When a conversation within a channel between select users does not pertain to that channel’s scope (or any other existing channel), they should move the conversation to a group chat.
    • However, this is until that group chat desires to form a channel of its own.

    Create a new team

    Team owner: The person who creates the team. It is possible for the team owner to then invite other members of the team to become co-owners to distribute administrative responsibilities.

    Team members: People who have accepted their invitation to be a part of the team.

    NB: Your organization can control who has permission to set up a team. If you can’t set a up a team, contact your IT department.

    Screenshots detailing how to create a new team in Microsoft Teams, steps 1 to 3. Step 1: 'Click the <Teams data-verified= tab on the left-hand side of the app'. Step 2: 'At the bottom of the app, click '. Step 3: 'Under the banner , click '.">

    Create a new team

    Screenshot detailing how to create a new team in Microsoft Teams, the step 4 starting point with an arrow pointing to the 'Build a team from scratch' button.

    Decide from these two options:

    • Building a team from scratch, which will create a new group with no prior history imported (steps 4.1–4.3).
    • Creating a team from an existing group in Office 365, including an already existing team (steps 4.4–4.6).

    NB: You cannot create a team from an existing group if:

    • That group has 5,000 members or more.
    • That group is in Yammer.

    Screenshot detailing how to create a new team in Microsoft Teams, step 4.1. There are buttons for 'Private' and 'Public'.

    Decide if you want you new team from scratch to be private or public. If you set up a private team, any internal or external user you invite into the team will have access to all team history and files shared.

    Screenshot detailing how to create a new team in Microsoft Teams, step 4.2 and 4.3. 4.2 has a space to give your team a name and another for a description. 4.3 says 'Then click <Create data-verified='.">

    Create a new team

    Screenshot detailing how to create a new team in Microsoft Teams, the step 4 starting point with an arrow pointing to the 'Create from...' button.

    Decide from these two options:

    • Building a team from scratch, which will create a new group with no prior history imported (steps 4.1–4.3).
    • Creating a team from an existing group in Office 365, including an already existing team (steps 4.4–4.6).

    NB: You cannot create a team from an existing group if:

    • That group has 5,000 members or more.
    • That group is in Yammer.

    Screenshot detailing how to create a new team in Microsoft Teams, step 4.4. It reads 'Create a new team from something you already own' with a button for 'Team'.

    Configure your new team settings, including privacy, apps, tabs, and members.

    Screenshot detailing how to create a new team in Microsoft Teams, step 4.5 and 4.6. 4.5 has a space to give your team a name, a description, choose privacy settings, and what you'd like to include from the original team. 4.6 says 'Then click <Create data-verified='.">

    Add team members

    Remove team members

    Screenshot detailing how to add team members in Microsoft Teams, step 1.

    To add a team member, on the right-hand side of the team name, click “More options.”

    Then, from the drop-down menu, click “Add member.”

    Screenshot detailing how to remove team members in Microsoft Teams, step 1.

    Only team owners can remove a team member. To do so, on the right-hand side of the team name, click “More options.”

    Then, from the drop-down menu, click “Manage team.”

    Screenshot detailing how to add team members in Microsoft Teams, step 2.

    If you’re a team owner, you can then type a name or an email address to add another member to the team.

    If you’re a team member, typing a name or an email address will send a request to the team owner to consider adding the member.

    Screenshot detailing how to remove team members in Microsoft Teams, step 2.

    Under the “Members” tab, you’ll see a list of the members in the team. Click the “X” at the far right of the member’s name to remove them.

    Team owners can only be removed if they change their role to team member first.

    Create a new channel

    Screenshot detailing how to create a new channel in Microsoft Teams, step 1.

    On the right-hand side of the team name, click “More options.”

    Then, from the drop-down menu, click “Add channel.”

    Screenshot detailing how to create a new channel in Microsoft Teams, step 2.

    Name your channel, give a description, and set your channel’s privacy.

    Screenshot detailing how to create a new channel in Microsoft Teams, step 3.

    To manage subsequent permissions, on the right-hand side of the channel name, click “More options.”

    Then, from the drop-down menu, click “Manage channel.”

    Adding and removing members from channels:

    Only members in a team can see that team’s channels. Setting channel privacy as “standard” means that the channel can be accessed by anyone in a team. Unless privacy settings for a channel are set as “private” (from which the channel creator can choose who can be in that channel), there is no current way to remove members from channels.

    It will be up to the end user to decide which channels they want to hide.

    Link team/channel to SharePoint folder

    Screenshot detailing how to link a team or channel to a SharePoint folder in Microsoft Teams, steps 1, 2, and 3. Step 1: 'Along the top of the team/channel tab bar, click the “+” symbol'. Step 2: 'Select “Document Library” to link the team/channel to a SharePoint folder'. Step 3: 'Copy and paste the SharePoint URL for the desired folder, or search in “Relevant sites” if the folder can be found there'.

    Need to find the SharePoint URL?

    Screenshot detailing how to find the SharePoint URL in Microsoft Teams. 'Locate the folder in SharePoint and click <Show actions data-verified=', 'Click to access the folder's SharePoint URL.'">

    Hide/unhide teams

    Hide/unhide channels

    Screenshot detailing how to hide and unhide teams in Microsoft Teams, step 1.

    To hide a team, on the right-hand side of the team name, click “More options.”

    Then, from the drop-down menu, click “Hide.” Hidden teams are moved to the “hidden teams” menu at the bottom of your team list.

    Screenshot detailing how to hide and unhide channels in Microsoft Teams, step 1.

    To hide a channel, on the right-hand side of the channel name, click “More options.”

    Then, from the drop-down menu, click “Hide.” Hidden channels are moved to the “hidden channels” menu at the bottom of your channel list in that team.

    Screenshot detailing how to hide and unhide teams in Microsoft Teams, step 2. Screenshot of a button that says 'Hidden teams'.

    To unhide a team, click on the “hidden teams” menu. On the right-hand side of the team name, click “More options.”

    Then, from the drop-down menu, click “Show.”

    Screenshot detailing how to hide and unhide channels in Microsoft Teams, step 2.

    To unhide a channel, click on the “hidden channels” menu at the bottom of the team. This will produce a drop-down menu of all hidden channels in that team.

    Hover over the channel you want to unhide and click “Show.”

    Find/join teams

    Leave teams

    Screenshot detailing how to find and join teams in Microsoft Teams, step 1. Click the “Teams” tab on the left-hand side of the app. Screenshot detailing how to find and join teams in Microsoft Teams, step 2.

    At the bottom of the app, click “Join or create a team.” Teams will then suggest a range of teams that you might be looking for. You can join public teams immediately. You will have to request approval to join a private team.

    Screenshot detailing how to leave teams in Microsoft Teams.

    To leave a team, on the right-hand side of the team name, click “More options.”

    Then, from the drop-down menu, click “Leave the team.”

    NB: If the owner of a private team has switched off discoverability, you will have to contact that owner to join that team. Screenshot detailing how to find and join teams in Microsoft Teams, step 3. If you can’t immediately see the team, you have two options: either search for the team or enter that team’s code under the banner “Join a team with a code.” Can I find a channel?

    No. To join a channel, you need to first join the team that channel belongs to.

    Can I leave a channel?

    No. The most you can do is hide the channel. By default, if you join a team you will have access to all the channels within that team (unless a channel is private, in which case you’ll have to request access to that channel).

    Create a chat

    Screenshots detailing how to create a chat in Microsoft Teams, steps 1 to 5. Step 1:'Click the “Chat” tab on the left hand side of the app (or keyboard shortcut Ctrl+N)'. Step 2: 'Search the name of the person you want to chat with'. Step 3: 'You’re now ready to start the chat! You can also send a chat message while working in a separate channel by typing/chat into the search bar and entering the recipient’s name'. Step 4: 'For group chat, click the “Add people” button in the top right hand corner of the app to add other persons into the existing chat'. Step 5: 'You can then rename the group chat (if there are 3+ people) by clicking the “Name group chat” option to the right of the group chat members’ names'.

    Hide a chat

    Unhide a chat

    Screenshots detailing how to hide a chat in Microsoft Teams, steps 1 to 3. Step 1:'Click the “Chat” tab on the left-hand side of the app'. Step 2: 'Search the name of the chat or group chat that you want to hide'. Step 3: In either 'Single person chat options' or 'Group chat options' Click “More options.” Then click “Hide.”' To unhide a chat, search for the hidden person or name of the group chat in the search bar. Click “More options.” Then click “Unhide.” Screenshot detailing how to unhide a chat in Microsoft Teams.

    Leave a chat

    You can only leave group chats. To do so, click “More options.” Then click “Leave.” Screenshot detailing how to leave a chat in Microsoft Teams.

    Overview: Meetings and live events

    Teams Meetings: Real-time communication and collaboration between a group, limited to 250 people.

    Teams Live Events: designed for presentations and webinars to a large audience of up to 10,000 people, in which attendees watch rather than interact.

     

    Office 365 and Microsoft 365 Licenses

    I want to: F1 F3 E1 E3 E5 Audio conferencing add-on
    Join a Teams meeting No license required. Any email address can participate in a Teams meeting.
    Attend a Teams meeting with a dial-in phone number No license required. Any phone number can dial into a Teams meeting. (Meeting organizers need to have an Audio Conferencing add-on license to send an invite that includes dial-in conferencing.)
    Attend a Teams live event No license required. Any phone number can dial into a Teams live event.
    Create a Teams meeting for up to 250 attendees   One of these licensing plans
    Create a Teams meeting for up to 250 attendees with a dial-in phone number   One of these licensing plans + Audio Conferencing (Meeting organizers need to have an Audio Conferencing add-on license to send an invite that includes dial-in conferencing.)
    Create a Teams live event for up to 10,000 attendees     One of these licensing plans
    Dial out from a Teams meeting to add someone at their Call me at number   One of these licensing plans + Audio Conferencing (Meeting dial out to a Call me at number requires organizers to have an E5 or Audio Conference add-in license. A dial plan may also be needed.)

    Depending on the use case, end users will have to determine whether they need to hold a meeting or a live event.

    Use Microsoft’s table (left) to see what license your organization needs to perform meetings and live events.

    (Source: “Admin quick start – Meetings and live events in Microsoft Teams,” Microsoft, 2020.)

    Best practices: Meetings

      Ad Hoc Call
    Direct audio/video call
    Scheduled Meeting Live Event
    Limits and Administrative Control
    Who can create? Anyone Anyone Anyone, unless altered by admin (permission to create MS Stream events also required if external production tools are used).
    Who can add members? Anyone in the session. The meeting organizer can add new attendees to the meeting. The event creator (the “organizer”) sets attendee permissions and assigns event group roles (“producer” and “presenter”).
    Can external stakeholders attend? Yes, through email invite. However, collaboration tools are restricted. Yes, through email invite. However, collaboration tools are restricted. Public events: yes, through shared invite link.
    Org-wide event: yes, if guest/external access granted.
    Who can delete? Anyone can leave the session. There is no artifact to delete. The meeting organizer Any attendee can leave the session.
    The organizer can cancel the event.
    Maximum attendees 100 250 10,000 attendees and 10 active presenters/producers (250 presenters and producers can be present at the event).
    Social Context
    How does the request come in? Unscheduled.
    Notification of an incoming audio or video call.
    Scheduled.
    Meeting invite, populated in the calendar, at a scheduled time.
    Meeting only auto-populated in event group’s calendars. Organizer must circulate event invite link to attendees – for instance, by pasting link into an Outlook meeting invite.
    Available Functionality
    Screen-sharing Yes Yes Producers and Presenters (through Teams, no third-party app).
    Whiteboard No Yes Yes
    OneNote (for minutes) Yes (from a member’s OneDrive) Yes, part of the meeting construct. No. A Meeting Notes tab is available instead.
    Dedicated chat space Yes. Derived from a group chat. Meeting has its own chat room. The organizer can set up a moderated Q&A (not chat) when creating the event. Only Presenters and Producers can chat.
    Recording Yes Yes Yes. Event can last up to 4 hours.

    When should an Ad Hoc Call become a Scheduled Meeting?

    • When the participants need time to prepare content for the call.
    • When an answer is not required immediately.
    • When bringing a group of people together requires logistical organizing.

    When should a Scheduled Meeting become an Ad Hoc Call?

    • When the participants can meet on short notice.
    • When a topic under discussion requires creating alignment quickly.

    When should a Live Event be created?

    • When the expected attendance exceeds 250 people.
    • If the event does not require collaboration and is mostly a presenter conveying information.

    Create a scheduled meeting

    Screenshots detailing how to create a scheduled meeting in Microsoft Teams, steps 1 to 4. Step 1:'Click the “Calendar” tab on the left-hand side of the app'. Step 2: 'On the top-right of the app, click the drop-down menu for “+ New meeting” and then “Schedule meeting.”' Step 3: 'Fill in the meeting details. When inputting internal attendees, their names will drop down without needing their email. You will need to input email addresses for external attendees'. Step 4: 'To determine internal attendees’ availability, click “Scheduling assistant” on the top left. Then click “Save” to create the meeting'.

    Create an ad hoc meeting

    Screenshots detailing how to create an ad hoc meeting in Microsoft Teams, steps 1 to 4. Step 1:'Click the “Calendar” tab on the left-hand side of the app'. Step 2: 'Along the top-right, click “Meet now.”' Step 3: 'Name your meeting, choose your audio and video settings, and click “Join now.”'. Step 4: 'To determine internal attendees’ availability, click “Scheduling assistant” on the top left. Then click “Save” to create the meeting. You’ll then be prompted to fill in the meeting details. When inputting internal attendees, their names will drop down without needing their email. You will need to input email addresses for external attendees'.

    Tip: Use existing channels to host the chatrooms for your online meetings

    When you host a meeting online with Microsoft Teams, there will always be a chatroom associated with the meeting. While this is a great place for meeting participants to interact, there is one particular downside.

    Problem: The never-ending chat. Often the activity in these chatrooms can persist long after the meeting. The chatroom itself becomes, unofficially, a channel. When end users can’t keep up with the deluge of communication, the tools have failed them.

    Solution: Adding an existing channel to the meeting. This ensures that discussion activity is already hosted in the appropriate venue for the group, during and after the meeting. Furthermore, it provides non-attendees with a means to catch up on the discussion they have missed.

    In section two of this cookbook, we will often refer to this tactic.

    A screenshot detailing how to add an existing channel to a meeting in Microsoft Teams. 'Break the habit of online booking meetings in Outlook – use the Teams Calendar View instead! In order to make use of this function, the meeting must be setup in Microsoft Teams, not Microsoft Outlook. The option to assign a channel to the meeting will then be available to the meeting organizer.'

    Don’t have a channel for the chat session of your online meeting? Perhaps you should!

    If your meeting is with a group of individuals that will be collaborating frequently, they may need a workspace that persists beyond the meeting.

    Guests can still attend the meeting, but they can’t chat!

    If there are attendees in your meeting that do not have access to the channel you select to host the chat, they will not see the chat discussion nor have any ability to use this function.

    This may be appropriate in some cases – for example, a vendor providing a briefing as part of a regular team meeting.

    However, if there are attendees outside the channel membership that need to see the meeting chat, consider another channel or simply default to not assigning one.

    Meeting settings explained

    Show device settings. For settings concerning audio, video, and whether viewing is private.

    Show meeting notes. Use to take notes throughout the meeting. The notes will stay attached to this event.

    Show meeting details. Find meeting information for: a dial-in number, conference ID, and link to join.

    Enter full screen.

    Show background effects. Choose from a range of video backgrounds to hide/blur your location.

    Turn on the captions (preview). Turn on live speech-to-text captions.

    Keypad. For dialing a number within the meeting (when enabled as an add-on with E3 or as part of E5).

    Start recording. Recorded and saved using Microsoft Stream.

    End meeting.

    Turn off incoming video. To save network bandwidth, you can decline receiving attendee’s video.

    Click “More options” to access the meetings settings.

    Screen share. In the tool tray, select “Share” to share your screen. Select particular applications if you only want to share certain information; otherwise, you can share your whole desktop.

    System audio share. To share your device’s audio while screen sharing, checkbox the “Include system audio” option upon clicking “Share.”

    If you didn’t click that option at the start but now want to share audio during screen share, click the “Include systems audio” option in the tool tray along the top of the screen.

    Give/take control of screen share. To give control, click “Give control” in the tool tray along the top of the screen when sharing content. Choose from the drop-down who you would like to give control to. In the same spot, click “Take back control” when required.

    To request control, click “Request control” in the same space when viewing someone sharing their content. Click “Release control” once finished.

    Start whiteboarding

    1. You’ll first need to enable Microsoft Whiteboard in the Microsoft 365 admin center. Ask your relevant admin to do so if Whiteboard is not already enabled.
    2. Once enabled, click “Share” in a meeting. This feature only appears if you have 3+ participants in the meeting.
    3. Under the “Whiteboard” section in the bottom right, click “Microsoft Whiteboard.”
    4. Click the pen icons to the right of the screen to begin sketching.

    NB: Anonymous, federated, or guest users are currently not supported to start, view, or ink a whiteboard in a Teams meeting.

    Will the whiteboard session be recorded if the meeting is being recorded?

    No. However, the final whiteboard will be available to all meeting attendees after the meeting, under “Board Gallery” in the Microsoft Whiteboard app. Attendees can then continue to work on the whiteboard after the meeting has ended.

    Create a live event

    Screenshots detailing how to create a live event in Microsoft Teams, steps 1 to 3. Step 1: 'Click the “Calendar” tab on the left-hand side of the app'. Step 2: 'On the top right of the app, click the drop-down menu for “+ New meeting” and then “Live event.”' Step 3: 'You will be labeled the “Event organizer.” First, fill in the live event details on the left'. Screenshot detailing how to create a live event in Microsoft Teams, step 4.

    As the organizer, you can invite other people to the event who will be the “producers” or “presenters.”

    Producers: Control the live event stream, including being able to start and stop the event, share their own and others’ video, share desktop or window, and select layout.

    Presenters: Present audio, video, or a screen.

    Screenshot detailing how to create a live event in Microsoft Teams, step 5.

    Select who your audience will be for your live event from three options: specified people and groups, the organization, or the public with no sign-in required.

    Edit the setting for whether you want recording to be available for attendees.

    Then click “Schedule” to finish.

    Live event settings explained

    When you join the live event as a producer/presenter, nothing will be immediately broadcast. You’ll be in a pre-live state. Decide what content to share and in what order. Along the bottom of the screen, you can share your video and audio, share your screen, and mute incoming attendees.

    Once your content is ready to share along the bottom of the screen, add it to the screen on the left, in order of viewing. This is your queue – your “Pre-live” state. Then, click “Send now.”

    This content will now move to the right-hand screen, ready for broadcasting. Once you’re ready to broadcast, click “Start.” Your state will change from “Pre-live” to “Live.”

    Along the top right of the app will be a tools bar.

    Screenshot listing live events settings icons in Microsoft Teams. Beside the heart monitor icon is 'Monitor health and performance of network, devices, and media sharing'. Beside the notepad icon is 'Take meeting notes'. Beside the chatbox icon is 'Chat function'. Beside the two little people with a plus sign icon is 'Invite and show participants'. Beside the gear icon is 'Device settings'. Beside the small 'i' in a circle is 'Meeting details, including schedule, meeting link, and dial-in number'.

    Workspace #1: Departments

    Scenario: Most of your organization’s communication and collaboration occurs within its pre-existing departmental divisions.

    Conventional communication channels:

    • Oral communication: Employees work in proximity to each other and communicate in person, by phone, in department meetings
    • Email: Department-wide announcements
    • Memos: Typically posted/circulated in mailboxes

    Solution: Determine the best way to organize your organization’s departments in Teams based on its size and your requirements to keep information private between departments.

    Option A:

    • Create a team for the organization/division.
    • Create channels for each department. Remember that all members of a team can view all public channels created in that team and the default General channel.
    • Create private channels if you wish to have a channel that only select members of that team can see. Remember that private channels have some limitations in functionality.

    Option B:

    • Create a new team for each department.
    • Create channels within this team for projects or topics that are recurring workflows for the department members. Only department members can view the content of these channels.

    Option C:

    • Post departmental memos and announcements in the General channel.
    • Use “Meet now” in channels for ad hoc meetings. For regular department meetings, create a recurring Teams calendar event for the specific department channel (Option A) or the General channel (Option B). Remember that all members of a team can join a public channel meeting.

    Workspace #2: A cross-functional committee

    Scenario: Your organization has struck a committee composed of members from different departments. The rest of the organization should not have access to the work done in the committee.

    Purpose: To analyze a particular organizational challenge and produce a plan or report; to confidentially develop or carry out a series of processes that affect the whole organization.

    Jobs: Committee members must be able to:

    • Attend private meetings.
    • Share files confidentially.

    Solution:

    Ingredients:

    • Private team

    Construction:

    • Create a new private team for the cross-functional committee.
    • Add only committee members to the team.
    • Create channels based on the topics likely to be the focal point of the committee work.
    • Decide how you will use the mandatory General channel. If the committee is small and the work limited in scope, this channel may be the main communication space. If the committee is larger or the work more complex, use the General channel for announcements and move discussions to new topic-related channels.
    • Schedule recurring committee meetings in the Teams calendar. Add the relevant channel to the meeting invite to keep the meeting chat attached to this team and channel (as meeting organizer, put your name in the meeting invite notes, as the channel will show as the organizer in the Outlook invite).
    • Remember that all members of this team will have access to these meetings and be able to view that they are occurring.

    Workspace #3: An innovation day event

    Scenario: The organization holds a yearly innovation day event in which employees form small groups and work on a defined, short-term problem or project.

    Purpose: To develop innovative solutions and ideas.

    Jobs:

    • Convene small groups.
    • Work toward time-sensitive goals.
    • Communicate synchronously.
    • Share files.

    Solution:

    Ingredients:

    • Public team
    • Channel tabs
    • Whiteboard
    • Planner

    Construction:

    • Create a team for the innovation day event.
    • Add channels for each project working group.
    • Communicate to participants the schedule for the day and their assigned channel.
    • Use the General channel for announcements and instructions throughout the day. Ensure someone moderates the General channel for participants’ questions.
    • Pre-populate the channel tabs with files the participants need to work with. To add a scrum board, refer to M#4 (Morning stand-up/Scrum) in this slide deck.
    • For breakouts, instruct participants to use the “meet now” feature in their channel and how to use the Whiteboard during these meetings.
    • Arrange to have your IT admin archive the team after a certain point so the material is still viewable but not editable.

    Workspace #4: A non-work-related social event

    Scenario: Employees within the organization wish to organize social events around shared interests: board game clubs, book clubs, TV show discussion groups, trivia nights, etc.

    Purpose: To encourage cohesion among coworkers and boost morale.

    Jobs:

    • Schedule the event.
    • Invite participants.
    • Prepare the activity.
    • Host and moderate the discussion.

    Solution:

    Ingredients:

    • Public team
    • Private channels
    • Screen-sharing

    Construction:

    • Create a public team for the social event so that interested people can find and join it.
    • Example: Trivia Night
      • Schedule the event in the Teams calendar.
      • Publish the link to the Trivia Night team where other employees will see it.
      • Create private channels for each trivia team so they cannot see the other competitors’ discussions. Add yourself to each private channel so you can see their answers.
      • As the host, begin a meeting in the General channel. Pose the trivia questions live or present the questions on PowerPoint via screen-sharing.
      • Ask each team to post its answers to its private channel.
    • To avoid teams sprawl, ask your IT admin to set a deletion policy for the team, as long as this request does not contradict your organization’s policies on data retention. If the team becomes moribund, it can be set to auto-delete after a certain period of time.

    Workspace #5: A project team with a defined end time

    Scenario: Within a department/workplace team, employees are assigned to projects with defined end times, after which they will be assigned to a new project.

    Purpose: To complete project-based work that fulfills business needs.

    Jobs:

    • Oral communication with team members.
    • Synchronous and asynchronous work on project files.
    • The ability to attend scheduled meetings and ad hoc meetings.
    • The ability to access shared resources related to the project.

    Solution:

    If your working group already has its own team within Teams:

    • Create a new public or private channel for the project. Remember that some functionality is not available in private channels (such as Microsoft Planner).
    • Use the channel for the project team’s meetings (scheduled in Teams calendar or through Meet Now).
    • Add a tab that links to the team’s project folder in SharePoint.

    If your workplace team does not already have its own team in Teams:

    • Determine if there is a natural fit for this project as a new channel in an existing team. Remember that all team members will be able to see the channel if it is public and that all relevant project members need to belong to the Team to participate in the channel.
    • If necessary, create a new team for the project. Add the project members.
    • Create channels based on the type of work that comprises the project.
    • Use the channel for the project team’s meetings (scheduled in Teams calendar or through Meet Now)
    • Add a tab to link to the team’s project folder in SharePoint.

    Info-tech Best Practice

    Hide the channel after the project concludes to de-clutter your Teams user interface.

    Meeting #1: Job interview with external candidate

    Scenario: The organization must interview a slate of candidates to fill an open position.

    Purpose:

    • Select the most qualified candidate for the job.

    Jobs:

    • Create a meeting, ensuring the candidate and other attendees know when and where the meeting will happen.
    • Ensure the meeting is secure to protect confidential information.
    • Ensure the meeting is accessible, allowing the candidate to present themselves through audio and/or visual means.
    • Create a professional environment for the meeting to take place.
    • Engender a space for the candidate to share their CV, research, or other relevant file.
    • The interview must be transcribed and recorded.

    Solution:

    Ingredients:

    • Private Teams meeting
    • Screen-sharing
    • Microsoft Stream

    Construction:

    • Create a Teams meeting, inviting the candidate with their email, alongside other internal attendees. The Teams meeting invite will auto-generate a link to the meeting itself.
    • The host can control who joins the meeting through settings for the “lobby.”
    • Through the Teams meeting, the attendees will be able to use the voice and video chat functionality.
    • All attendees can opt to blur their backgrounds to maintain a professional online presence.
    • The candidate can share their screen, either specific applications or their whole desktop, during the Teams meeting.
    • A Teams meeting can be recorded and transcribed through Stream. After the meeting, the transcript can be searched, edited, and shared

    NB: The external candidate does not need the Teams application. Through the meeting invite, the external candidate will join via a web browser.

    Meeting #2: Quarterly board meeting

    Scenario: Every quarter, the organization holds its regular board meeting.

    Purpose: To discuss agenda items and determine the company’s future direction.

    Jobs:

    During meeting:
      • Attendance and minutes must be taken.
      • Votes must be recorded.
      • In-camera sessions must occur.
      • External experts must be included.
    After meeting:
    • Follow-up items must be assigned.
    • Reports must be submitted.

    Solution:

    Ingredients:

    • Teams calendar invite
    • Planner; Forms
    • Private channel
    • Microsoft Stream

    Construction:

    • Guest Invite: Invites can be sent to any non-domain-joined email address to join a private, invitation-only channel within the team controlled by the board chair.
    • SharePoint & Flow: Documents are emailed to the Team addresses, which kicks off an MS Flow routine to collect review notes.
    • Planner: Any board member can assign tasks to any employee.
    • Forms/Add-On: Chair puts down the form of the question and individual votes are tracked.
    • Teams cloud meeting recording: Recording available through Stream. Manual edits can be made to VTT caption file. Greater than acceptable transcription error rate.
    • Meeting Log: Real-time attendance is viewable but a point-in-time record needs admin access.

    NB: The external guests do not need the Teams application. Through the meeting invite, the guests will join via a web browser.

    Meeting #3: Weekly team meeting

    Scenario: A team meets for a weekly recurring meeting. The meeting is facilitated by the team lead (or manager) who addresses through agenda items and invites participation from the attendees.

    Purpose: The purpose of the meeting is to:

    • Share information verbally
    • Present content visually
    • Achieve consensus
    • Build team morale

    Jobs: The facilitator must:

    • Determine participants
    • Book room
    • Book meeting in calendar

    Solution:

    Ingredients:

    • Meeting Place: A channel in Microsoft Teams (must be public) where all members of the meeting make up the entirety of the audience.
    • Calendar Recurrence: A meeting is booked through Teams and appears in all participants’ Outlook calendar.
    • Collaboration Space: Participants join the meeting through video or audio and can share screens and contribute text, images, and links to the meeting chat.

    Construction:

    • Ensure your team already has a channel created for it. If not, create one in the appropriate team.
    • Create the meeting using the calendar view within Microsoft Teams:
      • Set the meeting’s name, attendees, time, and recurrence.
      • Add the team channel that serves as the most appropriate workplace for the meeting. (Any discussion in the meeting chat will be posted to this channel.)

    NB: Create the meeting in the Teams calendar, not Outlook, or you will not be able to add the Teams channel. As meeting organizer, put your name in the meeting invite notes, as the channel will show as the organizer in the Outlook invite.

    Meeting #4: Morning stand-up/scrum

    Scenario: Each morning, at 9am, members of the team meet online.

    Purpose: After some pleasantries, the team discusses what tasks they each plan to complete in the day.

    Jobs: The team leader (or scrum master) must:

    • Place all tasks on a scrum board, each represented by a sticky note denoting the task name and owner.
    • Move the sticky notes through the columns, adjusting assignments as needed.
    • Sort tasks into the following columns: “Not Started,” “In Progress,” and “Done.”

    Solution:

    Ingredients:

    • Meeting Place: A channel in Microsoft Teams (must be public) where all members of the meeting make up the entirety of the audience.
    • Scrum Board: A tab within that channel where a persistent scrum board has been created and is visible to all team members.

    Meeting Place Construction:

    • Create the meeting using the calendar view in Teams.
    • Set the meeting’s name, attendees, time, and work-week daily recurrence (see left).
    • Add the channel that is the most appropriate workplace for the meeting. Any meeting chat will be posted to this channel rather than a separate chat.

    Scrum Board Construction:

    • Add a tab to the channel using Microsoft Planner as the app. (You can use other task management apps such as Trello, but the identity integration of first-party Office 365 tools may be less hassle.)
    • Create a new (or import an existing) Plan to the channel. This will be used as the focal point.

    Meeting #5: Weekly team meeting

    Scenario: An audio-only conversation that could be a regularly scheduled event but is more often conducted on an ad-hoc basis.

    Purpose: To quickly share information, achieve consensus, or clarify misunderstandings.

    Jobs:

    • Dial recipient
    • See missed calls
    • Leave/check voicemail
    • Create speed-dial list
    • Conference call

    Solution:

    Ingredients:

    • Audio call begun through Teams chat.

    Construction:

    • Voice over IP calls between users in the same MS Teams tenant can begin in multiple ways:
      • A call can be initiated through any appearance of a user’s profile picture: hover over user’s profile photo in the Chat list and select the phone icon.
      • Enter your last chat with a user and click phone icon in upper-right corner.
      • Go to the Calls section and type the name in the “Make a call” text entry form.
    • Voicemail: Voicemail, missed calls, and call history are available in the Calls section.
    • Speed dial: Speed dial lists can be created in the Calls section.
    • Conference call: Other users can be added to an ongoing call.

    NB: Microsoft Teams can be configured to provide an organization’s telephony for external calls, but this requires an E5 license. Additional audio-conferencing licenses are required to call in to a Teams meeting over a phone.

    Bibliography 1/4

    Section 1: Teams for IT › Creation Process

    Overview: Creation process
    Assign admin roles
    Prepare the network
    Team creation
    Integrations with SharePoint Online
    Permissions

    Bibliography 2/4

    Section 1: Teams for IT › Creation Process (cont'd.)

    External and guest access
    Expiration and archiving
    Retention and data loss prevention
    Teams telephony

    Bibliography 3/4

    Section 1: Teams for IT › Teams Rollout

    From Skype to Teams
    From Slack to Teams
    Teams adoption

    Section 1: Teams for IT › Use Cases

    Bibliography 4/4

    Section 2: Teams for End Users › Teams, Channels, Chat

    Section 2: Teams for End Users › Meetings and Live Events

    Section 2: Teams for End Users › Use Cases

    Generative AI: Market Primer

    • Buy Link or Shortcode: {j2store}349|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Data Management
    • Parent Category Link: /data-management
    • Much of the organization remains in the dark for understanding what Gen AI is, complicated by ambiguous branding from vendors claiming to provide Gen AI solutions.
    • Searching the market for a Gen AI platform is nearly impossible, owing to the sheer number of vendors.
    • The evaluative criteria for selecting a Gen AI platform are unclear.

    Our Advice

    Critical Insight

    • You cannot rush Gen AI selection and implementation. Organizations with (1) FTEs devoted to making Gen AI work (including developers and business intelligence analysts), (2) trustworthy and regularly updated data, and (3) AI governance are just now reaching PoC testing.
    • Gen AI is not a software category – it is an umbrella concept. Gen AI platforms will be built on different foundational models, be trained in different ways, and provide varying modalities. Do not expect Gen AI platforms to be compared against the same parameters in a vendor quadrant.
    • Bad data is the tip of the iceberg for Gen AI risks. While Gen AI success will be heavily reliant on the quality of data it is fine-tuned on, there are independent risks organizations must prepare for, from Gen AI hallucinations and output reliability to infrastructure feasibility and handling high-volume events.
    • Prepare for ongoing instability in the Gen AI market. If your organization is unsure about where to start with Gen AI, the secure route is to examine what your enterprise providers are offering. Use this as a learning platform to confidently navigate which specialized Gen AI provider will be viable for meeting your use cases.

    Impact and Result

    • Consensus on Gen AI scope and key Gen AI capabilities
    • Identification of your readiness to leverage Gen AI applications
    • Agreement on Gen AI evaluative criteria
    • Knowledge of vendor viability

    Generative AI: Market Primer Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Generative AI: Market Primer – Contextualize the marketspace and prepare for generative AI selection.

    Use Info-Tech’s best practices for setting out a selection roadmap and evaluative criteria for narrowing down vendors – both enterprise and specialized providers.

    • Generative AI: Market Primer Storyboard
    • Data Governance Policy
    • AI Governance Storyboard
    • AI Architecture Assessment and Project Planning Tool
    • AI Architecture Assessment and Project Planning Tool – Sample
    • AI Architecture Templates
    [infographic]

    Further reading

    Generative AI: Market Primer

    Cut through Gen AI buzzwords to achieve market clarity.

    Analyst Perspective

    The generative AI (Gen AI) marketspace is complex, nascent, and unstable.

    Organizations need to get clear on what Gen AI is, its infrastructural components, and the governance required for successful platform selection.

    Thomas Randall

    The urge to be fast-moving to leverage the potential benefits of Gen AI is understandable. There are plenty of opportunities for Gen AI to enrich an organization’s use cases – from commercial to R&D to entertainment. However, there are requisites an organization needs to get right before Gen AI can be effectively applied. Part of this is ensuring data and AI governance is well established and mature within the organization. The other part is contextualizing Gen AI to know what components of this market the organization needs to invest in.

    Owing to its popularity surge, OpenAI’s ChatGPT has become near synonymous with Gen AI. However, Gen AI is an umbrella concept that encompasses a variety of infrastructural architecture. Organizations need to ask themselves probing questions if they are looking to work with OpenAI: Does ChatGPT rest on the right foundational model for us? Does ChatGPT offer the right modalities to support our organization’s use cases? How much fine-tuning and prompt engineering will we need to perform? Do we require investment in on-premises infrastructure to support significant data processing and high-volume events? And do we require FTEs to enable all this infrastructure?

    Use this market primer to quickly get up to speed on the elements your organization might need to make the most of Gen AI.

    Thomas Randall

    Advisory Director, Info-Tech Research Group

    Executive Summary

    Your Challenge

    • Much of the organization remains in the dark for understanding what Gen AI is, complicated by ambiguous branding from vendors claiming to provide Gen AI solutions.
    • Searching the market for a Gen AI platform is near impossible, owing to the sheer number of vendors.
    • The evaluative criteria for selecting a Gen AI platform is unclear.

    Common Obstacles

    • Data governance is immature within the organization. There is no source of truth or regularly updated organizational process assets.
    • AI functionality is not well understood within the organization; there is little AI governance for monitoring and controlling its use.
    • The extent of effort and resources required to make Gen AI a success remains murky.

    Info-Tech's Solution

    This market primer for Gen AI will help you:

    1. Contextualize the Gen AI market: Learn what components of Gen AI an organization should consider to make Gen AI a success.
    2. Prepare for Gen AI selection: Use Info-Tech’s best practices for setting out a selection roadmap and evaluative criteria for narrowing down vendors – both enterprise and specialized providers.

    “We are entering the era of generative AI.
    This is a unique time in our history where the benefits of AI are easily accessible and becoming pervasive with co-pilots emerging in the major business tools we use today. The disruptive capabilities that can potentially drive dramatic benefits also introduces risks that need to be planned for.”

    Bill Wong, Principal Research Director – Data and BI, Info-Tech Research Group

    Who benefits from this project?

    This research is designed for:

    • Senior IT, developers, data staff, and project managers who:
      • Have received a mandate from their executives to begin researching the Gen AI market.
      • Need to quickly get up to speed on the state of the Gen AI market, given no deep prior knowledge of the space.
      • Require an overview of the different components to Gen AI to contextualize how vendor comparisons and selections can be made.
      • Want to gain an understanding of key trends, risks, and evaluative criteria to consider in their selection process.

    This research will help you:

    • Articulate the potential business value of Gen AI to your organization.
    • Establish which high-value use cases could be enriched by Gen AI functionality.
    • Assess vendor viability for enterprise and specialized software providers in the Gen AI marketspace.
    • Collect information on the prerequisites for implementing Gen AI functionality.
    • Develop relevant evaluative criteria to assist differentiating between shortlisted contenders.

    This research will also assist:

    • Executives, business analysts, and procurement teams who are stakeholders in:
      • Contextualizing the landscape for learning opportunities.
      • Gathering and documenting requirements.
      • Building deliverables for software selection projects.
      • Managing vendors, especially managing the relationships with incumbent enterprise software providers.

    This research will help you:

    • Identify examples of how Gen AI applications could be leveraged for your organization’s core use cases.
    • Verify the extent of Gen AI functionality an incumbent enterprise provider has.
    • Validate accuracy of Gen AI language and architecture referenced in project deliverables.

    Insight Summary

    You cannot speedrun Gen AI selection and implementation.

    Organizations with (1) FTEs devoted to making Gen AI work (including developers and business intelligence analysts), (2) trustworthy and regularly updated data, and (3) AI governance are just now reaching PoC testing.

    Gen AI is not a software category – it is an umbrella concept.

    Gen AI platforms will be built on different foundational models, be trained in different ways, and provide varying modalities. Do not expect to compare Gen AI platforms to the same parameters in a vendor quadrant.

    Bad data is the tip of the iceberg for Gen AI risks.

    While Gen AI success will be heavily reliant on the quality of data it is fine-tuned on, there are independent risks organizations must prepare for: from Gen AI hallucinations and output reliability to infrastructure feasibility to handle high-volume events.

    Gen AI use may require changes to sales incentives.

    If you plan to use Gen AI in a commercial setting, review your sales team’s KPIs. They are rewarded for sales velocity; if they are the human-in-the-loop to check for hallucinations, you must change incentives to ensure quality management.

    Prepare for ongoing instability in the Gen AI market.

    If your organization is unsure about where to start with Gen AI, the secure route is to examine what your enterprise providers are offering. Use this as a learning platform to confidently navigate which specialized Gen AI provider will be viable for meeting your use cases.

    Brace for a potential return of on-premises infrastructure to power Gen AI.

    The market trend has been for organizations to move to cloud-based products. Yet, for Gen AI, effective data processing and fine-tuning may call for organizations to invest in on-premises infrastructure (such as more GPUs) to enable their Gen AI to function effectively.

    Info-Tech’s methodology for understanding the Gen AI marketspace

    Phase Steps

    1. Contextualize the Gen AI marketplace

    1. Define Gen AI and its components.
    2. Explore Gen AI trends.
    3. Begin deriving Gen AI initiatives that align with business capabilities.

    2. Prepare for and understand Gen AI platform offerings

    1. Review Gen AI selection best practices and requisites for effective procurement.
    2. Determine evaluative criteria for Gen AI solutions.
    3. Explore Gen AI offerings with enterprise and specialized providers.
    Phase Outcomes
    1. Achieve consensus on Gen AI scope and key Gen AI capabilities.
    2. Identify your readiness to leverage Gen AI applications.
    3. Hand off to Build Your Generative AI Roadmap to complete pre-requisites for selection.
    1. Determine whether deeper data and AI governance is required; if so, hand off to Create an Architecture for AI.
    2. Gain consensus on Gen AI evaluative criteria.
    3. Understand vendor viability.

    Guided Implementation

    Phase 1

    Phase 2

    • Call #1: Discover if Gen AI is right for your organization. Understand what a Gen AI platform is and discover the art of the possible.
    • Call #2: To take advantage of Gen AI, perform a business capabilities analysis to begin deriving Gen AI initiatives.
    • Call #3: Explore whether Gen AI initiatives can be achieved either with incumbent enterprise players or via procurement of specialized solutions.
    • Call #4: Evaluate vendors and perform final due diligence.

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    The Gen AI market evaluation process should be broken into segments:

    1. Gen AI market education with this primer
    2. Structured approach to selection
    3. Evaluation and final due diligence

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful"

    Guided Implementation

    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

    Workshop

    "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

    Consulting

    "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks are used throughout all four options.

    Software selection engagement

    Five advisory calls over a five-week period to accelerate your selection process

    • Receive expert analyst guidance over five weeks (on average) to select and negotiate software.
    • Save money, align stakeholders, speed up the process, and make better decisions.
    • Use a repeatable, formal methodology to improve your application selection process.
    • Get better, faster results guaranteed, included in membership.
    Software selection process timeline. Week 1: Awareness - 1 hour call, Week 2: Education & Discovery - 1 hour call, Week 3: Evaluation - 1 hour call, Week 4: Selection - 1 hour call, Week 5: Negotiation & Configuration - 1 hour call.

    Click here to book your selection engagement.

    Software selection workshops

    40 hours of advisory assistance delivered online.

    Select better software, faster.

    • 40 hours of expert analyst guidance
    • Project and stakeholder management assistance
    • Save money, align stakeholders, speed up the process, and make better decisions
    • Better, faster results guaranteed; 25K standard engagement fee
    Software selection process timeline. Week 1: Awareness - 5 hours of Assistance, Week 2: Education & Discovery - 10 hours of assistance, Week 3: Evaluation - 10 hours of assistance, Week 4: Selection - 10 hours of assistance, Week 5: Negotiation & Configuration - 10 hours of assistance.

    Click here to book your workshop engagement.

    10 Secrets for Successful Disaster Recovery in the Cloud

    • Buy Link or Shortcode: {j2store}419|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $12,096 Average $ Saved
    • member rating average days saved: 20 Average Days Saved
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity
    • The pay-per-use pricing structure of cloud services make it a cheaper DR option, but there are gotchas you need to avoid, ranging from unexpected licensing costs to potential security vulnerabilities.
    • You likely started on the path to cloud DR with consideration of cloud storage for offsite retention of backups. Systems recovery in the cloud can be a real value-add to using cloud as a backup target.
    • Your cloud-based DR environment has to be secure and compliant, but performance also has to be “good enough” to operate the business.
    • Location still matters, and selecting the DR site that optimizes latency tolerance and geo-redundancy can be difficult.

    Our Advice

    Critical Insight

    • Keep your systems dormant until disaster strikes. Prepare as much of your environment as possible without tapping into compute resources. Enjoy the low at-rest costs, and leverage the reliability of the cloud in your failover.
    • Avoid failure on the failback! Bringing up your systems in the cloud is a great temporary solution, but an expensive long-term strategy. Make sure you have a plan to get back on premises.
    • Leverage cloud DR as a start for cloud migration. Cloud DR provides a gateway for broader infrastructure lift and shift to cloud IaaS, but this should only be the first phase of a longer-term roadmap that ends in multi-service hybrid cloud.

    Impact and Result

    • Calculate the cost of your DR solution with a cloud vendor. Test your systems often to build out more accurate budgets and to define failover and failback action plans to increase confidence in your capabilities.
    • Define “good enough” performance by consulting with the business and setting correct expectations for the recovery state.
    • Dig deeper into the various flavors of cloud-based DR beyond backup and restore, including pilot light, warm standby, and multi-site recovery. Each of these has unique benefits and challenges when done in the cloud.

    10 Secrets for Successful Disaster Recovery in the Cloud Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out the 10 secrets for success in cloud-based DR deployment, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    [infographic]

    Integrate IT Risk Into Enterprise Risk

    • Buy Link or Shortcode: {j2store}195|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $12,599 Average $ Saved
    • member rating average days saved: 2 Average Days Saved
    • Parent Category Name: IT Governance, Risk & Compliance
    • Parent Category Link: /it-governance-risk-and-compliance
    • IT risks, when considered, are identified and classified separately from the enterprise-wide perspective.
    • IT is expected to own risks over which they have no authority or oversight.
    • Poor behaviors, such as only considering IT risks when conducting compliance or project due diligence, have been normalized.

    Our Advice

    Critical Insight

    • Stop avoiding risk – integrate it. This provides a holistic view of uncertainty for the organization to drive innovative new approaches to optimize the organization’s ability to respond to risk.

    Impact and Result

    • Understand gaps in the organization’s current approach to risk management practices.
    • Establish a standardized approach for how IT risks impact the enterprise as a whole.
    • Drive a risk-aware organization toward innovation and consider alternative options for how to move forward.
    • Integrate IT risks into the foundational risk practice.

    Integrate IT Risk Into Enterprise Risk Research & Tools

    Integrated Risk Management Capstone – A framework for how IT risks can be integrated into your organization’s enterprise risk management program to enable strategic risk-informed decisions.

    This is a capstone blueprint highlighting the benefits of an integrated risk management program that uses risk information and data to inform strategic decision making. Throughout this research you will gain insight into the five core elements of integrating risk through assessing, governing, defining the program, defining the process, and implementing.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Integrate IT Risk Into Enterprise Risk Capstone
    • Integrated Risk Maturity Assessment
    • Risk Register Tool

    Infographic

    Further reading

    Integrate IT Risk Into Enterprise Risk

    Don’t fear IT risks, integrate them.

    EXECUTIVE BRIEF

    Analyst Perspective

    Having siloed risks is risky business for any enterprise.

    Photo of Valence Howden, Principal Research Director, CIO Practice.
    Valence Howden
    Principal Research Director, CIO Practice
    Photo of Petar Hristov Research Director, Security, Privacy, Risk & Compliance.
    Petar Hristov
    Research Director, Security, Privacy, Risk & Compliance
    Photo of Ian Mulholland Research Director, Security, Risk & Compliance.
    Ian Mulholland
    Research Director, Security, Risk & Compliance
    Photo of Brittany Lutes, Senior Research Analyst, CIO Practice.
    Brittany Lutes
    Senior Research Analyst, CIO Practice
    Photo of Ibrahim Abdel-Kader, Research Analyst, CIO Practice
    Ibrahim Abdel-Kader
    Research Analyst, CIO Practice

    Every organization has a threshold for risk that should not be exceeded, whether that threshold is defined or not.

    In the age of digital, information and technology will undoubtedly continue to expand beyond the confines of the IT department. As such, different areas of the organization cannot address these risks in silos. A siloed approach will produce different ways of identifying, assessing, responding to, and reporting on risk events. Integrated risk management is about embedding IT uncertainty to inform good decision making across the organization.

    When risk is integrated into the organization's enterprise risk management program, it enables a single view of all risks and the potential impact of each risk event. More importantly, it provides a consistent view of the risk event in relation to uncertainty that might have once been seemingly unrelated to IT.

    And all this can be achieved while remaining within the enterprise’s clearly defined risk appetite.

    Executive Summary

    Your Challenge

    Most organizations fail to integrate IT risks into enterprise risks:

    • IT risks, when considered, are identified and classified separately from the enterprise-wide perspective.
    • IT is expected to own risks over which they have no authority or oversight.
    • Poor behaviors, such as only considering IT risks when conducting compliance or project due diligence, have been normalized.

    Common Obstacles

    IT leaders have to overcome these obstacles when it comes to integrating risk:

    • Making business leaders aware of, involved in, and able to respond to all enterprise risks.
    • A lack of data or information being used to support a holistic risk management process.
    • A low level of enterprise risk maturity.
    • A lack of risk management capabilities.

    Info-Tech’s Approach

    By leveraging the Info-Tech Integrated Risk approach, your business can better address and embed risk by:

    • Understanding gaps in the organization’s current approach to risk management practices.
    • Establishing a standardized approach for how IT risks impact the enterprise as a whole.
    • Driving a risk-aware organization toward innovation and considering alternative options for how to move forward.
    • Helping integrate IT risks into the foundational risk practice.

    Info-Tech Insight

    Stop avoiding risk – integrate it. This provides a holistic view of uncertainty for the organization to drive innovative new approaches to optimize its ability to respond to risk.

    What is integrated risk management?

    • Integrated risk management is the process of ensuring all forms of risk information, including information and technology, are considered and included in the enterprise’s risk management strategy.
    • It removes the siloed approach to classifying risks related to specific departments or areas of the organization, recognizing that each of those risks is a threat to the overarching enterprise.
    • Aggregating the different threats or uncertainty that might exist within an organization allows for informed decisions to be made that align to strategic goals and continue to drive value back to the business.
    • By holistically considering the different risks, the organization can make informed decisions on the best course of action that will reduce any negative impacts associated with the uncertainty and increase the overall value.

    Enterprise Risk Management (ERM)

    • IT
    • Security
    • Digital
    • Vendor/Third Party
    • Other

    Enterprise risk management is the practice of identifying and addressing risks to your organization and using risk information to drive better decisions and better opportunities.

    IT risk is enterprise risk

    Multiple types of risk, 'Finance', 'IT', 'People', and 'Digital', funneling into 'ENTERPRISE RISKS'. IT risks have a direct and often aggregated impact on enterprise risks and opportunities in the same way other business risks can. This relationship must be understood and addressed through integrated risk management to ensure a consistent approach to risk.

    Your challenge

    Embedding IT risks into the enterprise risk management program is challenging because:

    • Most organizations classify risks based on the departments or areas of the business where the uncertainty is likely to happen.
    • Unnecessary expectations are placed on the IT department to own risks over which they have no authority or oversight.
    • Risks are often only identified when conducting due diligence for a project or ensuring compliance with regulations and standards.

    Risk-mature organizations have a unique benefit in that they often have established an overarching governance framework and embedded risk awareness into the culture.

    35% — Only 35% of organizations had embraced ERM in 2020. (Source: AICPA and NC State Poole College of Management)

    12% — Only 12% of organizations are leveraging risk as a tool to their strategic advantage. (Source: AICPA and NC State Poole College of Management)

    Common obstacles

    These barriers make integrating IT risks difficult to address for many organizations:

    • IT risks are not seen as enterprise risks.
    • The organization’s culture toward risk is not defined.
    • The organization’s appetite and threshold for risk are not defined.
    • Each area of the organization has a different method of identifying, assessing, and responding to risk events.
    • Access to reliable and informative data to support risk management is difficult to obtain.
    • Leadership does not see the business value of integrating risk into a single management program.
    • The organization’s attitudes and behaviors toward risk contradict the desired and defined risk culture.
    • Skills, training, and resources to support risk management are lacking, let alone those to support integrated risk management.

    Integrating risks has its challenges

    62% — Accessing and disseminating information is the main challenge for 62% of organizations maturing their organizational risk management. (Source: OECD)

    20-28% — Organizations with access to machine learning and analytics to address future risk events have 20 to 28% more satisfaction. (Source: Accenture)

    Integrate Risk and Use It to Your Advantage

    Accelerate and optimize your organization by leveraging meaningful risk data to make intelligent enterprise risk decisions.

    Risk management is more than checking an audit box or demonstrating project due diligence.

    Risk Drivers
    • Audit & compliance
    • Preserve value & avoid loss
    • Previous risk impact driver
    • Major transformation
    • Strategic opportunities
    Arrow pointing right. Only 7% of organizations are in a “leading” or “aspirational” level of risk maturity. (OECD, 2021) 63% of organizations struggle when it comes to defining their appetite toward strategy related risks. (“Global Risk Management Survey,” Deloitte, 2021) Late adopters of risk management were 70% more likely to use instinct over data or facts to inform an efficient process. (Clear Risk, 2020) 55% of organizations have little to no training on ERM to properly implement such practices. (AICPA, NC State Poole College of Management, 2021)
    1. Assess Enterprise Risk Maturity 3. Build a Risk Management Program Plan 4. Establish Risk Management Processes 5. Implement a Risk Management Program
    2. Determine Authority with Governance
    Unfortunately, less than 50% of those in risk focused roles are also in a governance role where they have the authority to provide risk oversight. (Governance Institute of Australia, 2020)
    IT can improve the maturity of the organization’s risk governance and help identify risk owners who have authority and accountability.

    Governance and related decision making is optimized with integrated and aligned risk data.

    List of 'Integrated Risk Maturity Categories': '1. Context & Strategic Direction', '2. Risk Culture and Authority', '3. Risk Management Process', and '4. Risk Program Optimization'. The five types of a risk in Enterprise Risk Management.

    ERM incorporates the different types of risk, including IT, security, digital, vendor, and other risk types.

    The program plan is meant to consider all the major risk types in a unified approach.

    The 'Risk Process' cycle starting with '1. Identify', '2. Assess', '3. Respond', '4. Monitor', '5. Report', and back to the beginning. Implementation of an integrated risk management program requires ongoing access to risk data by those with decision making authority who can take action.

    Integrated Risk Mapping — Downside Risk Focus

    A diagram titled 'Risk and Controls' beginning with 'Possible Sources' and a list of sources, 'Control Activities' to prevent, the 'RISK EVENT', 'Recovery Activities' to recover, and 'Possible Repercussions' with a list of ramifications.

    Integrated Risk Mapping — Downside and Upside Risk

    Third-Party Risk Example

    Example of a third-party risk mapped onto the diagram on the previous slide, but with potential upsides mapped out as well. The central risk event is 'Vendor exposes private customer data'. Possible Sources of the downside are 'External Attack' with likelihood prevention method 'Define security standard requirements for vendor assessment' and 'Exfiltration of data through fourth-party staff' with likelihood prevention method 'Ensure data is properly classified'. Possible Sources of the upside are 'Application rationalization' with likelihood optimization method 'Reduce number of applications in environment' and 'Review vendor assessment practices' with likelihood optimization method 'Improve vendor onboarding'. Possible Repercussions on the downside are 'Organization unable to operate in jurisdiction' with impact minimization method 'Engage in-house risk mitigation responses' and 'Fines levied against organization' with impact minimization method 'Report incident to any regulators'. Possible Repercussions on the upside are 'Easier vendor integration and management' with impact utilization method 'Improved vendor onboarding practices' and 'Able to bid on contracts with these requirements' with impact utilization method 'Vendors must provide attestations (e.g. SOC or CMMC)'.

    Insight Summary

    Overarching insight

    Stop fearing risk – integrate it. Integration leads to opportunities for organizations to embrace innovation and new digital technologies as well as reducing operational costs and simplifying reporting.

    Govern risk strategically

    Governance of risk management for information- and technology-related events is often misplaced. Just because it's classified as an IT risk does not mean it shouldn’t be owned by the board or business executive.

    Assess risk maturity

    Integrating risk requires a baseline of risk maturity at the enterprise level. IT can push integrating risks, but only if the enterprise is willing to adopt the attitudes and behaviors that will drive the integrated risk approach.

    Manage risk

    It is not a strategic decision to have different areas of the organization manage the risks perceived to be in their department. It’s the easy choice, but not the strategic one.

    Implement risk management

    Different areas of an enterprise apply risk management processes differently. Determining a single method for identification, assessment, response, and monitoring can ensure successful implementation of enterprise risk management.

    Tactical insight

    Good risk management will consider both the positives and negatives associated with a risk management program by recognizing both the upside and downside of risk event impact and likelihood.

    Integrated risk benefits

    IT Benefits

    • IT executives have a responsibility but not accountability when it comes to risk. Ensure the right business stakeholders have awareness and ability to make informed risk decisions.
    • Controls and responses to risks that are within the “IT” realm will be funded and provided with sufficient support from the business.
    • The business respects and values the role of IT in supporting the enterprise risk program, elevating its role into business partner.

    Business Benefits

    • Business executives and boards can make informed responses to the various forms of risk, including those often categorized as “IT risks.”
    • The compounding severity of risks can be formally assessed and ideally quantified to provide insight into how risks’ ramifications can change based on scenarios.
    • Risk-informed decisions can be used to optimize the business and drive it toward adopting innovation as a response to risk events.
    • Get your organization insured against cybersecurity threats at the lowest premiums possible.

    Measure the value of integrating risk

    • Reduce Operating Costs

      • Organizations can reduce their risk operating costs by 20 to 30% by adopting enterprise-wide digital risk initiatives (McKinsey & Company).
    • Increase Cybersecurity Threat Preparedness

      • Increase the organization’s preparedness for cybersecurity threats. 79% of organizations that were impacted by email threats in 2020 were not prepared for the hit (Diligent)
    • Increase Risk Management’s Impact to Drive Strategic Value

      • Currently, only 3% of organizations are extensively using risk management to drive their unique competitive advantage, compared to 35% of companies who do not use it at all (AICPA & NC State Poole College of Management).
    • Reduce Lost Productivity for the Enterprise

      • Among small businesses, 76% are still not considering purchasing cyberinsurance in 2021, despite the fact that ransomware attacks alone cost Canadian businesses $5.1 billion in productivity in 2020 (Insurance Bureau of Canada, 2021).

    “31% of CIO’s expected their role to expand and include risk management responsibilities.” (IDG “2021 State of the CIO,” 2021)

    Make integrated risk management sustainable

    58%

    Focus not just on the preventive risk management but also the value-creating opportunities. With 58% of organizations concerned about disruptive technology, it’s an opportunity to take the concern and transform it into innovation. (Accenture)

    70%

    Invest in tools that have data and analytics features. Currently, “gut feelings” or “experience” inform the risk management decisions for 70% of late adopters. (Clear Risk)

    54%

    Align to the strategic vision of the board and CEO, given that these two roles account for 54% of the accountability associated with extended enterprise risk management. (Extended Enterprise Risk Management Survey, 2020,” Deloitte)

    63%

    Include IT leaders in the risk committee to help informed decision making. Currently 63% of chief technology officers are included in the C‑suite risk committee. (AICPA & NC State Poole College of Management)

    Successful adoption of integrated risk management is often associated with these key elements.

    Assessment

    Assess your organization’s method of addressing risk management to determine if integrated risk is possible

    Assessing the organization’s risk maturity

    Mature or not, integrated risk management should be a consideration for all organizations

    The first step to integrating risk management within the enterprise is to understand the organization’s readiness to adopt practices that will enable it to successfully integrate information.

    In 2021, we saw enterprise risk management assessments become one of the most common trends, particularly as a method by which the organization can consolidate the potential impacts of uncertainties or threats (Lawton, 2021). A major driver for this initiative was the recognition that information and technology not only have enterprise-wide impacts on the organization’s risk management but that IT has a critical role in supporting processes that enable effective access to data/information.

    A maturity assessment has several benefits for an organization: It ensures there is alignment throughout the organization on why integrated risk is the right approach to take, it recognizes the organization’s current risk maturity, and it supports the organization in defining where it would like to go.

    Pie chart titled 'Organizational Risk Management Maturity Assessment Results' showing just under half 'Progressing', a third 'Established', a seventh 'Emerging', and a very small portion 'Leading or Aspirational'.

    Integrated Risk Maturity Categories

    Semi-circle with colored points indicating four categories.

    1

    Context & Strategic Direction Understand the organization’s main objectives and how risk can support or enhance those objectives.

    2

    Risk Culture and Authority Examine if risk-based decisions are being made by those with the right level of authority and if the organization’s risk appetite is embedded in the culture.

    3

    Risk Management Process Determine if the current process to identify, assess, respond to, monitor, and report on risks is benefitting the organization.

    4

    Risk Program Optimization Consider opportunities where risk-related data is being gathered, reported, and used to make informed decisions across the enterprise.

    Maturity should inform your approach to risk management

    The outcome of the risk maturity assessment should inform how risk management is approached within the organization.

    A row of waves starting light and small and becoming taller and darker in steps. The levels are 'Non-existent', 'Basic', 'Partially Integrated', 'Mostly Integrated', 'Fully Integrated', and 'Optimized'.

    For organizations with a low maturity, remaining superficial with risk will offer more benefits and align to the enterprise’s risk tolerance and appetite. This might mean no integrated risk is taking place.

    However, organizations that have higher risk maturity should begin to integrate risk information. These organizations can identify the nuances that would affect the severity and impact of risk events.

    Integrated Risk Maturity Assessment

    The purpose of the Integrated Risk Maturity Assessment is to assess the organization's current maturity and readiness for integrated risk management (IRM).

    Frequently and continually assessing your organization’s maturity toward integrated risk ensures the right risk management program can be adopted by your organization.

    Integrated Risk Maturity Assessment

    A simple tool to understand if your organization is ready to embrace integrated risk management by measuring maturity across four key categories: Context & Strategic Direction, Risk Culture & Authority, Risk Management Process, and Risk Program Optimization

    Sample of the Integrated Risk Maturity Assessment deliverable.

    Use the results from this integrated risk maturity assessment to determine the type of risk management program that can and should be adopted by your organization.

    Some organizations will need to remain siloed and focused on IT risk management only, while others will be able to integrate risk-related information to start enabling automatic controls that respond to this data.

    Customer Value Contribution

    I'm proud to announce our new Customer Value Contribution Calculator©, or CVCC© in short.

    It enhances and possibly replaces the BIA (Business Impact Analysis) process with a much simpler way.

    More info to follow shortly.

    Measure IT Project Value

    • Buy Link or Shortcode: {j2store}431|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $5,549 Average $ Saved
    • member rating average days saved: 6 Average Days Saved
    • Parent Category Name: Portfolio Management
    • Parent Category Link: /portfolio-management
    • People treat benefits as a box to tick on the business case, deflating or inflating them to facilitate project approval.
    • Even if benefits are properly defined, they are usually forgotten once the project is underway.
    • Subsequent changes to project scope may impact the viability of the project’s business benefits, resulting in solutions that do not deliver expected value.

    Our Advice

    Critical Insight

    • It is rare for project teams or sponsors to be held accountable for managing and/or measuring benefits. The assumption is often that no one will ask if benefits have been realized after the project is closed.
    • The focus is largely on the project’s schedule, budget, and scope, with little attention paid to the value that the project is meant to deliver to the organization.
    • Without an objective stakeholder to hold people accountable for defining benefits and demonstrating their delivery, benefits will continue to be treated as red tape.
    • Sponsors will not take the time to define benefits properly, if at all. The project team will not take the time to ensure they are still achievable as the project progresses. When the project is complete, no one will investigate actual project success.

    Impact and Result

    • The project sponsor and business unit leaders must own project benefits; IT is only accountable for delivering the solution.
    • IT can play a key role in this process by establishing and supporting a benefits realization process. They can help business unit leaders and sponsors define benefits properly, identify meaningful metrics, and report on benefits realization effectively.
    • The project management office is ideally suited to facilitate this process by providing tools and templates, and a consistent and comparable view across projects.
    • Project managers are accountable for delivering the project, not for delivering the benefits of the project itself. However, they must ensure that changes to project scope are assessed for impact on benefits viability.

    Measure IT Project Value Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should establish a benefits legitimacy practice, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Establish benefits legitimacy during portfolio Intake

    This phase will help you define a benefits management process to help support effective benefits definition during portfolio intake.

    • Deliver Project Value With a Benefits Legitimacy Initiative – Phase 1: Establish Benefits Legitimacy During Portfolio Intake
    • Project Sponsor Role Description Template
    • Benefits Commitment Form Template
    • Right-Sized Business Case Template

    2. Maintain benefits legitimacy throughout project planning and execution

    This phase will help you define a process for effective benefits management during project planning and the execution intake phase.

    • Deliver Project Value With a Benefits Legitimacy Initiative – Phase 2: Maintain Benefits Legitimacy Throughout Project Planning and Execution
    • Project Benefits Documentation Workbook
    • Benefits Legitimacy Workflow Template (PDF)
    • Benefits Legitimacy Workflow Template (Visio)

    3. Close the deal on project benefits

    This phase will help you define a process for effectively tracking and reporting on benefits realization post-project.

    • Deliver Project Value With a Benefits Legitimacy Initiative – Phase 3: Close the Deal on Project Benefits
    • Portfolio Benefits Tracking Tool
    • Benefits Lag Report Template
    • Benefits Legitimacy Handbook Template
    [infographic]

    Workshop: Measure IT Project Value

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Analyze the Current State of Benefits Management

    The Purpose

    Assess the current state of benefits management at your organization and establish a realistic target state.

    Establish project and portfolio baselines for benefits management.

    Key Benefits Achieved

    Set achievable workshop goals and align stakeholder expectations.

    Establish a solid foundation for benefits management success.

    Activities

    1.1 Introductions and overview.

    1.2 Discuss attendee expectations and goals.

    1.3 Complete Info-Tech’s PPM Current State Scorecard.

    1.4 Perform right-wrong-confusing-missing analysis.

    1.5 Define target state for benefits management.

    1.6 Refine project levels.

    Outputs

    Info-Tech’s PPM Current State Scorecard report

    Right-wrong-confusing-missing analysis

    Stakeholder alignment around workshop goals and target state

    Info-Tech’s Project Intake Classification Matrix

    2 Establish Benefits Legitimacy During Portfolio Intake

    The Purpose

    Establish organizationally specific benefit metrics and KPIs.

    Develop clear roles and accountabilities for benefits management.

    Key Benefits Achieved

    An articulation of project benefits and measurements.

    Clear checkpoints for benefits communication during the project are defined.

    Activities

    2.1 Map the current portfolio intake process.

    2.2 Establish project sponsor responsibilities and accountabilities for benefits management.

    2.3 Develop organizationally specific benefit metrics and KPIs.

    2.4 Integrate intake legitimacy into portfolio intake processes.

    Outputs

    Info-Tech’s Project Sponsor Role Description Template

    Info-Tech’s Benefits Commitment Form Template

    Intake legitimacy process flow and RASCI chart

    Intake legitimacy SOP

    3 Maintain Benefits Legitimacy Throughout Project Planning and Execution

    The Purpose

    Develop a customized SOP for benefits management during project planning and execution.

    Key Benefits Achieved

    Ensure that all changes to the project have been recorded and benefits have been updated in preparation for deployment.

    Updated benefits expectations are included in the final sign-off package.

    Activities

    3.1 Map current project management process and audit project management documentation.

    3.2 Identify appropriate benefits control points.

    3.3 Customize project management documentation to integrate benefits.

    3.4 Develop a deployment legitimacy process flow.

    Outputs

    Customized project management toolkit

    Info-Tech’s Project Benefits Documentation Workbook

    Deployment of legitimacy process flow and RASCI chart

    Deployment of legitimacy SOP

    4 Close the Deal on Project Benefits

    The Purpose

    Develop a post-project benefits realization process.

    Key Benefits Achieved

    Clear project sponsorship accountabilities for post-project benefits tracking and reporting.

    A portfolio level benefits tracking tool for reporting on benefits attainment.

    Activities

    4.1 Identify appropriate benefits control points in the post-project process.

    4.2 Configure Info-Tech’s Portfolio Benefits Tracking Tool.

    4.3 Define a post-project benefits reporting process.

    4.4 Formalize protocol for reporting on, and course correcting, benefit lags.

    4.5 Develop a post-project legitimacy process flow.

    Outputs

    Info-Tech’s Portfolio Benefits Tracking Tool

    Post-Project legitimacy process flow and RASCI chart

    Post-Project Legitimacy SOP

    Info-Tech’s Benefits Legitimacy Handbook

    Info-Tech’s Benefits Legitimacy Workflow Template

    Drive Real Business Value with an HRIS Strategy

    • Buy Link or Shortcode: {j2store}586|cart{/j2store}
    • member rating overall impact: 9.1/10 Overall Impact
    • member rating average dollars saved: $43,457 Average $ Saved
    • member rating average days saved: 36 Average Days Saved
    • Parent Category Name: Human Resource Systems
    • Parent Category Link: /human-resource-systems
    • In most organizations, the HR application portfolio has evolved tactically on an as-needed basis, resulting in un-integrated systems and significant effort spent on manual workarounds.
    • The relationship between HR and IT is not optimal for technology decision making. System-related decisions are made by HR and IT is typically involved only post-purchase to fix issues as they arise and offer workarounds.
    • IT systems for HR are not viewed as a strategic differentiator or business enabler, thereby leading to a limited budget and resources for HR IT systems and subsequently hindering the adoption of a strategic, holistic perspective.
    • Some organizations overinvest, while others underinvest in lightweight, point-to-point solutions. Finding the sweet spot between a full suite and lightweight functionality is no easy task.

    Our Advice

    Critical Insight

    • Align HRIS goals with the business. Organizations must position HR as a partner prior to embarking on an HRIS initiative, aligning technology goals with organizational objectives before looking at software.
    • Communication is key. Often, HR and IT speak different languages. Maintain a high degree of communication by engaging stakeholder groups early.
    • Plan where you want to go. Designing a roadmap based on clear requirements, alignment with the business, and an understanding of priorities will contribute to success.

    Impact and Result

    • Evaluate the current state of HRIS, understand the pain points, and visualize your ideal processes prior to choosing a solution.
    • Explore the different solution alternatives: maintain current system, integrate and consolidate, augment, or replace system entirely.
    • Create a plan to engage IT and HR throughout the project. Equip HR with the decision-making tools to meet business objectives and drive business strategy. Establish a common language for IT and HR to effectively communicate.
    • Develop a practical and actionable roadmap that the entire organization can buy into.

    Drive Real Business Value with an HRIS Strategy Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should develop an HRIS strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Conduct an environmental scan

    Create a clear project vision that outlines the goals and objectives for the HRIS strategy. Subsequently, construct an HRIS business model that is informed by enablers, barriers, and the organizational, IT, and HR needs.

    • Drive Real Business Value with an HRIS Strategy – Phase 1: Conduct an Environmental Scan
    • Establish an HRIS Strategy Project Charter Template
    • HRIS Readiness Assessment Checklist

    2. Design the future state

    Gather high-level requirements to determine the ideal future state. Explore solution alternatives and choose the path that is best aligned with the organization's needs.

    • Drive Real Business Value with an HRIS Strategy – Phase 2: Design the Future State
    • HRIS Strategy Stakeholder Interview Guide
    • Process Owner Assignment Guide

    3. Finalize the roadmap

    Identify roadmap initiatives. Prioritize initiatives based on importance and effort.

    • Drive Real Business Value with an HRIS Strategy – Phase 3: Finalize the Roadmap
    • Initiative Roadmap Tool
    • HRIS Stakeholder Presentation Template
    [infographic]

    Workshop: Drive Real Business Value with an HRIS Strategy

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Conduct an Environmental Scan

    The Purpose

    Understand the importance of creating an HRIS strategy before proceeding with software selection and implementation.

    Learn why a large percentage of HRIS projects fail and how to avoid common mistakes.

    Set expectations for the HRIS strategy and understand Info-Tech’s HRIS methodology.

    Complete a project charter to gain buy-in, build a project team, and track project success.   

    Key Benefits Achieved

    A go/no-go decision on the project appropriateness.

    Project stakeholders identified.

    Project team created with defined roles and responsibilities.

    Finalized project charter to gain buy-in.  

    Activities

    1.1 Set a direction for the project by clarifying the focus.

    1.2 Identify the right stakeholders for your project team.

    1.3 Identify HRIS needs, barriers, and enablers.

    1.4 Map the current state of your HRIS.

    1.5 Align your business goals with your HR goals and objectives.

    Outputs

    Project vision

    Defined project roles and responsibilities

    Completed HRIS business model

    Completed current state map and thorough understanding of the HR technology landscape

    Strategy alignment between HR and the business

    2 Design the Future State

    The Purpose

    Gain a thorough understanding of the HRIS-related pains felt throughout the organization.

    Use stakeholder-identified pains to directly inform the HRIS strategy and long-term solution.

    Visualize your ideal processes and realize the art of the possible.  

    Key Benefits Achieved

    Requirements to strengthen the business case and inform the strategy.

    The art of the possible.

    Activities

    2.1 Requirements gathering.

    2.2 Sketch ideal future state processes.

    2.3 Establish process owners.

    2.4 Determine guiding principles.

    2.5 Identify metrics.

    Outputs

    Pain points classified by data, people, process, and technology

    Ideal future process vision

    Assigned process owners, guiding principles, and metrics for each HR process in scope

    3 Create Roadmap and Finalize Deliverable

    The Purpose

    Brainstorm and prioritize short- and long-term HRIS tasks.

    Key Benefits Achieved

    Understand next steps for the HRIS project.

    Activities

    3.1 Create a high-level implementation plan that shows dependencies.

    3.2 Identify risks and mitigation efforts.

    3.3 Finalize stakeholder presentation.

    Outputs

    Completed implementation plan

    Completed risk management plan

    HRIS stakeholder presentation

    Proactively Identify and Mitigate Vendor Risk

    • Buy Link or Shortcode: {j2store}227|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management
    • IT priorities are focused on daily tasks, pushing risk management to secondary importance and diverging from a proactive environment.
    • IT leaders are relying on an increasing number of third-party technology vendors and outsourcing key functions to meet the rapid pace of change within IT.
    • Risk levels can fluctuate over the course of the partnership, requiring manual process checks and/or automated solutions.

    Our Advice

    Critical Insight

    • Every IT vendor carries risks that have business implications. These legal, financial, security, and operational risks could inhibit business continuity and IT can’t wait until an issue arises to act.
    • Making intelligent decisions about risks without knowing what their financial impact will be is difficult. Risk impact must be quantified.
    • You don’t know what you don’t know, and what you don’t know, can hurt you. To find hidden risks, you must use a structured risk identification method.

    Impact and Result

    • A thorough risk assessment in the selection phase is your first line of defense. If you follow the principles of vendor risk management, you can mitigate collateral losses following an adverse event.
    • Make a conscious decision whether to accept the risk based on time, priority, and impact. Spend the required time to correctly identify and enact defined vendor management processes that determine spend categories and appropriately evaluate potential and preferred suppliers. Ensure you accurately assess the partnership potential.
    • Take a proactive stance against IT threats and vulnerabilities by identifying and assessing IT’s most significant risks before they happen.

    Proactively Identify and Mitigate Vendor Risk Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out how to create a vendor risk management program that minimizes your organization’s vulnerability and mitigates adverse scenarios.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Review vendor risk fundamentals and establish governance

    Review IT vendor risk fundamentals and establish a risk governance framework.

    • Proactively Identify and Mitigate Vendor Risk – Phase 1: Review Vendor Risk Fundamentals and Establish Governance
    • Vendor Risk Management Maturity Assessment Tool
    • Vendor Risk Management Program Manual
    • Risk Event Action Plan

    2. Assess vendor risk and define your response strategy

    Categorize, prioritize, and assess your vendor risks. Follow up with creating effective response strategies.

    • Proactively Identify and Mitigate Vendor Risk – Phase 2: Assess Vendor Risk and Define Your Response Strategy
    • Vendor Classification Model Tool
    • Vendor Risk Profile and Assessment Tool
    • Risk Costing Tool
    • Risk Register Tool

    3. Monitor, communicate, and improve IT vendor risk process

    Assign accountability and responsibilities to formalize ongoing risk monitoring. Communicate your findings to management and share the plan moving forward.

    • Proactively Identify and Mitigate Vendor Risk – Phase 3: Monitor, Communicate, and Improve IT Vendor Risk Process
    • Risk Report
    [infographic]

    Workshop: Proactively Identify and Mitigate Vendor Risk

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Prepare for the Workshop

    The Purpose

    To prepare the team for the workshop.

    Key Benefits Achieved

    Avoids delays and interruptions once the workshop is in progress.

    Activities

    1.1 Send workshop agenda to all participants.

    1.2 Prepare list of vendors and review any contracts provided by them.

    1.3 Review current risk management process.

    Outputs

    All necessary participants assembled

    List of vendors and vendor contracts

    Understanding of current risk management process

    2 Review Vendor Risk Fundamentals and Establish Governance

    The Purpose

    Review IT vendor risk fundamentals.

    Assess current maturity and set risk management program goals.

    Engage stakeholders and establish a risk governance framework.

    Key Benefits Achieved

    Understanding of organizational risk culture and the corresponding risk threshold.

    Obstacles to effective IT risk management identified.

    Attainable goals to increase maturity established.

    Understanding of the gap to achieve vendor risk readiness.

    Activities

    2.1 Brainstorm vendor-related risks.

    2.2 Assess current program maturity.

    2.3 Identify obstacles and pain points.

    2.4 Develop risk management goals.

    2.5 Develop key risk indicators (KRIs) and escalation protocols.

    2.6 Gain stakeholders’ perspective.

    Outputs

    Vendor risk management maturity assessment

    Goals for vendor risk management

    Stakeholders’ opinions

    3 Assess Vendor Risk and Define Your Response Strategy

    The Purpose

    Categorize vendors.

    Prioritize assessed risks.

    Key Benefits Achieved

    Risk events prioritized according to risk severity – as defined by the business.

    Activities

    3.1 Categorize vendors.

    3.2 Map vendor infrastructure.

    3.3 Prioritize vendors.

    3.4 Identify risk contributing factors.

    3.5 Assess risk exposure.

    3.6 Calculate expected cost.

    3.7 Identify risk events.

    3.8 Input risks into the Risk Register Tool.

    Outputs

    Vendors classified and prioritized

    Vendor risk exposure

    Expected cost calculation

    4 Assess Vendor Risk and Define Your Response Strategy (continued)

    The Purpose

    Determine risk threshold and contract clause relating to risk prevention.

    Identify and assess risk response actions.

    Key Benefits Achieved

    Thorough analysis has been conducted on the value and effectiveness of risk responses for high-severity risk events.

    Risk response strategies have been identified for all key risks.

    Authoritative risk response recommendations can be made to senior leadership.

    Activities

    4.1 Determine the threshold for (un)acceptable risk.

    4.2 Match elements of the contract to related vendor risks.

    4.3 Identify and assess risk responses.

    Outputs

    Thresholds for (un)acceptable risk

    Risk responses

    5 Monitor, Communicate, and Improve IT Vendor Risk Process

    The Purpose

    Communicate top risks to management.

    Assign accountabilities and responsibilities for risk management process.

    Establish monitoring schedule.

    Key Benefits Achieved

    Risk monitoring responsibilities are established.

    Transparent accountabilities and established ongoing improvement of the vendor risk management program.

    Activities

    5.1 Create a stakeholder map.

    5.2 Complete RACI chart.

    5.3 Establish the reporting schedule.

    5.4 Finalize the vendor risk management program.

    Outputs

    Stakeholder map

    Assigned accountability for risk management

    Established monitoring schedule

    Risk report

    Vendor Risk Management Program Manual

    The MVP Major Incident Manager

    The time has come to hire a new major incident manager. How do you go about that? How do you choose the right candidate? Major incident managers must have several typically conflicting traits, so how do you pick the right person? Let's dive into that.

    Register to read more …

    Accelerate Business Growth and Valuation by Building Brand Awareness

    • Buy Link or Shortcode: {j2store}569|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Marketing Solutions
    • Parent Category Link: /marketing-solutions

    Brands that fail to invest in brand awareness are likely to face some, if not all these problems:

    • Lack of brand visibility and recognition
    • Inability to reach and engage with the buyers
    • Difficulties generating and converting leads
    • Low customer retention rate
    • Inability to justify higher pricing
    • Limited brand equity, business valuation, and sustainability

    Our Advice

    Critical Insight

    Awareness brings visibility and traction to brands, which is essential in taking the market leadership position and becoming the trusted brand that buyers think of first.

    Brand awareness also significantly contributes to increasing brand equity, market valuation, and business sustainability.

    Impact and Result

    Building brand awareness allows for the increase of:

    • Brand visibility, perception, recognition, and reputation
    • Interactions and engagement with the target audience
    • Digital advertising performance and ROI
    • Conversion rates and sales wins
    • Revenue and profitability
    • Market share & share of voice (SOV)
    • Talents, partners, and investors attraction and retention
    • Brand equity, business growth, and market valuation

    Accelerate Business Growth and Valuation by Building Brand Awareness Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Accelerate Business Growth and Valuation by Building Brand Awareness Storyboard - Learn how to establish the brand foundation, create assets and workflows, and deploy effective brand awareness strategies and tactics.

    A two-step approach to building brand awareness, starting with defining the brand foundations and then implementing effective brand awareness strategies and tactics.

    • Accelerate Business Growth and Valuation by Building Brand Awareness Storyboard

    2. Define Brand's Personality and Message - Analyze your target market and develop key elements of your brand guidelines.

    With this set of tools, you will be able to capture and analyze your target market, your buyers and their journeys, define your brand's values, personality, and voice, and develop all the key elements of your brand guidelines to enable people within your organization and external resources to build a consistent and recognizable image across all assets and platforms.

    • Market Analysis Template
    • Brand Recognition Survey and Interview Questionnaire and List Template
    • External and Internal Factors Analysis Template
    • Buyer Personas and Journey Presentation Template
    • Brand Purpose, Mission, Vision, and Values Template
    • Brand Value Proposition and Positioning Statement
    • Brand Voice Guidelines Template
    • Writing Style Guide Template
    • Brand Messaging Template
    • Writer Checklist

    3. Start Building Brand Awareness - Achieve strategic alignment.

    These tools will allow you to achieve strategic alignment and readiness, create assets and workflows, deploy tactics, establish Key Performance Indicators (KPIs), and monitor and optimize your strategy on an ongoing basis.

    • Brand Awareness Strategy and Tactics Template
    • Asset Creation and Management List
    • Campaign Workflows Template
    • Brand Awareness Strategy Rollout Plan Template
    • Survey Emails Best Practices Guidelines

    Infographic

    Further reading

    Accelerate Business Growth and Valuation By Building Brand Awareness

    Develop and deploy comprehensive, multi-touchpoint brand awareness strategies to become the trusted brand that buyers think of first.

    EXECUTIVE BRIEF

    Analyst perspective

    Building brand awareness

    Achieving high brand awareness in a given market and becoming the benchmark for buyers

    is what every brand wants to achieve, as it is a guarantee of success. Building brand awareness,

    even though its immediate benefits are often difficult to see and measure, is essential for companies that want to stand out from their competitors and continue to grow in a sustainable way. The return on investment (ROI) may take longer, but the benefits are also greater than those achieved through short-term initiatives with the expectation of immediate, albeit often limited, results.

    Brands that are familiar to their target market have greater credibility, generate more sales,

    and have a more loyal customer base. CMOs that successfully execute brand awareness programs

    build brand equity and grow company valuation.

    This is a picture of Nathalie Vezina

    Nathalie Vezina
    Marketing Research Director
    SoftwareReviews Advisory

    Executive summary

    Brand leaders know that brand awareness is essential to the success of all marketing and sales activities. Brands that fail to invest in brand awareness are likely to face some, if not all these problems:

    • Lack of brand visibility and compelling storytelling.
    • Inability to reach the target audience.
    • Low engagement on digital platforms and with ads.
    • Difficulties generating and converting leads, or closing/winning sales/deals, and facing a high cost per acquisition.
    • Low/no interest or brand recognition, trust level, and customer retention rate.
    • Inability to justify higher pricing.

    Convincing stakeholders of the benefits of strong brand awareness can be difficult when the positive outcomes are hard to quantify, and the return on investment (ROI) is often long-term. Among the many obstacles brand leaders must overcome are:

    • Lack of longer-term corporate vision, focusing all efforts and resources on short-term growth strategies for a quick ROI.
    • Insufficient market and target buyers' information and understanding of the brand's key differentiator.
    • Misalignment of brand message, and difficulties creating compelling content that resonates with the target audience, generates interest, and keeps them engaged.
    • Limited or no resources dedicated to the development of the brand.

    Inspired by top-performing businesses and best practices, this blueprint provides the guidance and tools needed to successfully build awareness and help businesses grow. By following these guidelines, brand leaders can expect to:

    • Gain market intelligence and a clear understanding of the buyer's needs, your competitive advantage, and key differentiator.
    • Develop a clear and compelling value proposition and a human-centric brand messaging driven by the brand's values.
    • Increase online presence and brand awareness to attract and engage with buyers.
    • Develop a long-term brand strategy and execution plan.

    "A brand is the set of expectations, memories, stories, and relationships that, taken together, account for a consumer's decision to choose one product or service over another."

    – Seth Godin

    What is brand awareness?

    The act of making a brand visible and memorable.

    Brand awareness is the degree to which buyers are familiar with and recognize the attributes and image of a particular brand, product, or service. The higher the level of awareness, the more likely the brand is to come into play when a target audience enters the " buying consideration" phase of the buyer's journey.

    Brand awareness also plays an important role in building equity and increasing business valuation. Brands that are familiar to their target market have greater credibility, drive more sales and have a more loyal customer base.
    Building brand awareness allows increasing:

    • Brand visibility, perception, recognition, and reputation
    • Interactions and engagement with the target audience
    • Digital advertising performance and ROI
    • Conversion rates and sales wins
    • Revenue and profitability
    • Market share and share of voice (SOV)
    • Talents, partners, and investors attraction and retention
    • Brand equity, business growth, and market valuation

    "Products are made in a factory, but brands are created in the mind."
    Source: Walter Landor

    Capitalizing on a powerful brand

    A longer-term approach for an increased and more sustainable ROI.

    Market leader position

    Developing brand awareness is essential to increase the visibility and traction of a brand.

    Several factors may cause a brand to be not well-known. One reason might be that the brand recently launched, such as a startup. Another reason could be that the brand has rebranded or entered a new market.

    To become the trusted brand that buyers think of first in their target markets, it is critical for these brands to develop and deploy comprehensive, multi-touchpoint brand awareness strategies.

    A relationship leading to loyalty

    A longer-term brand awareness strategy helps build a strong relationship between the brand and the buyer, fostering a lasting and rewarding alliance.

    It also enables brands to reach and engage with their target audience effectively by using compelling storytelling and meaningful content.

    Adopting a more human-centric approach and emphasizing shared values makes the brand more attractive to buyers and can drive sales and gain loyalty.

    Sustainable business growth

    For brands that are not well established in their target market, short-term tactics that focus on immediate benefits can be ineffective. In contrast, long-term brand awareness strategies provide a more sustainable ROI (return on investment).

    Investing in building brand awareness can impact a business's ability to interact with its target audience, generate leads, and increase sales. Moreover, it can significantly contribute to boosting the business's brand equity and market valuation.

    "Quick wins may work in the short term, but they're not an ideal substitute for long-term tactics and continued success."
    Source: Forbes

    Impacts of low brand awareness on businesses

    Unfamiliar brands, despite their strong potential, won't thrive unless they invest in their notoriety.

    Brands that choose not to invest in longer-term awareness strategies and rely solely on short-term growth tactics in hopes of an immediate gain will see their ability to grow diminished and their longevity reduced due to a lack of market presence and recognition.

    Symptoms of a weakening brand include:

    • High marketing spending and limited result
    • Low market share or penetration
    • Low sales, revenue, and gross margin
    • Weak renewal rate, customer retention, and loyalty
    • Difficulties delivering on the brand promise, low/no trust in the brand
    • Limited brand equity, business valuation, and sustainability
    • Unattractive brand to partners and investors

    "Your brand is the single most important investment you can make in your business."
    Source: Steve Forbes

    Most common obstacles to increasing brand awareness

    Successfully building brand awareness requires careful preparation and planning.

    • Limited market intelligence
    • Unclear competitive advantage/key differentiator
    • Misaligned and inconsistent messaging and storytelling
    • Lack of long-term vision
    • and low prioritization
    • Limited resources to develop and execute brand awareness building tactics
    • Unattractive content that does not resonate, generates little or no interest and engagement

    Investing in the notoriety of the brand

    Become the top-of-mind brand in your target market.

    To stand out, be recognized by their target audience, and become major players in their industry, brands must adopt a winning strategy that includes the following elements:

    • In-depth knowledge and understanding of the market and audience
    • Strengthening digital presence and activities
    • Creating and publishing content relevant to the target audience
    • Reaching out through multiple touchpoints
    • Using a more human-centric approach
    • Ensure consistency in all aspects of the brand, across all media and channels

    How far are you from being the brand buyers think of first in your target market?

    This is an image of the Brand Awareness Pyramid.

    Brand awareness pyramid

    Based on David Aaker's brand loyalty pyramid

    Tactics for building brand awareness

    Focus on effective ways to gain brand recognition in the minds of buyers.

    This is an image of the Brand Awareness Journey Roadmap.

    Brand recognition requires in-depth knowledge of the target market, the creation of strong brand attributes, and increased presence and visibility.

    Understand the market and audience you're targeting

    Be prepared. Act smart.

    To implement a winning brand awareness-building strategy, you must:

    • Be aware of your competitor's strengths and weaknesses, as well as yours.
    • Find out who is behind the keyboard, and the user experience they expect to have.
    • Plan and continuously adapt your tactics accordingly.
    • Make your buyer the hero.

    Identify the brands' uniqueness

    Find your "winning zone" and how your brand uniquely addresses buyers' pain points.

    Focus on your key differentiator

    A brand has found its "winning zone" or key differentiator when its value proposition clearly shows that it uniquely solves its buyers' specific pain points.

    Align with your target audience's real expectations and successfully interact with them by understanding their persona and buyer's journey. Know:

    • How you uniquely address their pain points.
    • Their values and what motivates them.
    • Who they see as authorities in your field.
    • Their buying habits and trends.
    • How they like brands to engage with them.

    An image of a Venn diagram between the following three terms: Buyer pain point; Competitors' value proposition; your unique value proposition.  The overlapping zone is labeled the Winning zone.  This is your key differentiator.

    Give your brand a voice

    Define and present a consistent voice across all channels and assets.

    The voice reflects the personality of the brand and the emotion to be transmitted. That's why it's crucial to establish strict rules that define the language to use when communicating through the brand's voice, the type of words, and do's and don'ts.

    To be recognizable it is imperative to avoid inconsistencies. No matter how many people are behind the brand voice, the brand must show a unique, distinctive personality. As for the tone, it may vary according to circumstances, from lighter to more serious.

    Up to 80% Increased customer recognition when the brand uses a signature color scheme across multiple platforms
    Source: startup Bonsai
    23% of revenue increase is what consistent branding across channels leads to.
    Source: Harvard Business Review

    When we close our eyes and listen, we all recognize Ella Fitzgerald's rich and unique singing voice.

    We expect to recognize the writing of Stephen King when we read his books. For the brand's voice, it's the same. People want to be able to recognize it.

    Adopt a more human-centric approach

    If your brand was a person, who would it be?

    Human attributes

    Physically attractive

    • Brand identity
    • Logo and tagline
    • Product design

    Intellectually stimulating

    • Knowledge and ideas
    • Continuous innovation
    • Thought leadership

    Sociable

    • Friendly, likeable and fun
    • Confidently engage with audience through multiple touchpoints
    • Posts and shares meaningful content
    • Responsive

    Emotionally connected

    • Inspiring
    • Powerful influencer
    • Triggers emotional reactions

    Morally sound

    • Ethical and responsible
    • Value driven
    • Deliver on its promise

    Personable

    • Honest
    • Self-confident and motivated
    • Accountable

    0.05 Seconds is what it takes for someone to form an opinion about a website, and a brand.
    Source: 8ways

    90% of the time, our initial gut reaction to products is based on color alone.
    Source: startup Bonsai

    56% of the final b2b purchasing decision is based on emotional factors.
    Source: B@B International

    Put values at the heart of the brand-buyers relationship

    Highlight values that will resonate with your audience.

    Brands that focus on the values they share with their buyers, rather than simply on a product or service, succeed in making meaningful emotional connections with them and keep them actively engaged.

    Shared values such as transparency, sustainability, diversity, environmental protection, and social responsibility become the foundation of a solid relationship between a brand and its audience.

    The key is to know what motivates the target audience.

    86% of consumers claim that authenticity is one of the key factors they consider when deciding which brands they like and support.
    Source: Business Wire

    56% of the final decision is based on having a strong emotional connection with the supplier.
    Source: B2B International

    64% of today's customers are belief-driven buyers; they want to support brands that "can be a powerful force for change."
    Source: Edelman

    "If people believe they share values with a company, they will stay loyal to the brand."
    – Howard Schultz
    Source: Lokus Design

    Double-down on digital

    Develop your digital presence and reach out to your target audiences through multiple touchpoints.

    Beyond engaging content, reaching the target audience requires brands to connect and interact with their audience in multiple ways so that potential buyers can form an opinion.

    With the right message consistently delivered across multiple channels, brands increase their reach, create a buzz around their brand and raise awareness.

    73% of today's consumers confirm they use more than one channel during a shopping journey
    Source: Harvard Business Review

    Platforms

    • Website and apps
    • Social media
    • Group discussions

    Multimedia

    • Webinars
    • Podcasts
    • Publication

    Campaign

    • Ads and advertising
    • Landing pages
    • Emails, surveys drip campaigns

    Network

    • Tradeshows, events, sponsorships
    • Conferences, speaking opportunities
    • Partners and influencers

    Use social media to connect

    Reach out to the masses with a social media presence.

    Social media platforms represent a cost-effective opportunity for businesses to connect and influence their audience and tell their story by posting relevant and search-engine-optimized content regularly on their account and groups. It's also a nice gateway to their website.

    Building a relationship with their target buyer through social media is also an easy way for businesses to:

    • Understand the buyers.
    • Receive feedback on how the buyers perceive the brand and how to improve it.
    • Show great user experience and responsiveness.
    • Build trust.
    • Create awareness.

    75% of B2B buyers and 84% of C-Suite executives use social media when considering a purchase
    Source: LinkedIn Business

    92% of B2B buyers use social media to connect with leaders in the sales industry.
    Source: Techjury

    With over 4.5 billion social media users worldwide, and 13 new users signing up to their first social media account every second, social media is fast becoming a primary channel of communication and social interaction for many.
    Source: McKinsey

    Become the expert subject matter

    Raise awareness with thought leadership content.

    Thought leadership is about building credibility
    by creating and publishing meaningful, relevant content that resonates with a target audience.
    Thought leaders write and publish all kinds of relevant content such as white papers, ebooks, case studies, infographics, video and audio content, webinars, and research reports.
    They also participate in speaking opportunities, live presentations, and other high-visibility forums.
    Well-executed thought leadership strategies contribute to:

    • Raise awareness.
    • Build credibility.
    • Be recognized as a subject expert matter.
    • Become an industry leader.

    60% of buyers say thought leadership builds credibility when entering a new category where the brand is not already known.
    Source: Edelman | LinkedIn

    70% of people would rather learn about a company through articles rather than advertising.
    Source: Brew Interactive

    57% of buyers say that thought leadership builds awareness for a new or little-known brand.
    Source: Edelman | LinkedIn

    To achieve best results

    • Know the buyers' persona and journey.
    • Create original content that matches the persona of the target audience and that is close to their values.
    • Be Truthful and insightful.
    • Find the right tone and balance between being human-centric, authoritative, and bold.
    • Be mindful of people's attention span and value their time.
    • Create content for each phase of the buyer's journey.
    • Ensure content is SEO, keyword-loaded, and add calls-to-action (CTAs).
    • Add reason to believe, data to support, and proof points.
    • Address the buyers' pain points in a unique way.

    Avoid

    • Focusing on product features and on selling.
    • Publishing generic content.
    • Using an overly corporate tone.

    Promote personal branding

    Rely on your most powerful brand ambassadors and influencers: your employees.

    The strength of personal branding is amplified when individuals and companies collaborate to pursue personal branding initiatives that offer mutual benefits. By training and positioning key employees as brand ambassadors and industry influencers, brands can boost their brand awareness through influencer marketing strategies.

    Personal branding, when well aligned with business goals, helps brands leverage their key employee's brands to:

    • Increase the organization's brand awareness.
    • Broaden their reach and circle of influence.
    • Show value, gain credibility, and build trust.
    • Stand out from the competition.
    • Build employee loyalty and pride.
    • Become a reference to other businesses.
    • Increase speaking opportunities.
    • Boost qualified leads and sales.

    About 90% of organizations' employee network tends to be completely new to the brand.
    Source: Everyone Social

    8X more engagement comes from social media content shared by employees rather than brand accounts.
    Source: Entrepreneur

    561% more reach when brand messages are shared by employees on social media, than the same message shared by the Brand's social media.
    Source: Entrepreneur

    "Personal branding is the art of becoming knowable, likable and trustable."
    Source: Founder Jar, John Jantsch

    Invest in B2B influencer marketing

    Broaden your reach and audiences by leveraging the voice of influencers.

    Influencers are trusted industry experts and analysts who buyers can count on to provide reliable information when looking to make a purchase.

    Influencer marketing can be very effective to reach new audiences, increase awareness, and build trust. But finding the right influencers with the level of credibility and visibility brands are expecting can sometimes be challenging.

    Search for influencers that have:

    • Relevance of audience and size.
    • Industry expertise and credibility.
    • Ability to create meaningful content (written, video, audio).
    • Charismatic personality with values consistent with the brand.
    • Frequent publications on at least one leading media platform.

    76% of people say that they trust content shared by people over a brand.
    Source: Adweek


    44% increased media mention of the brand using B2B influencer marketers.
    Source: TopRank Marketing

    Turn your customers into brand advocates

    Establish customer advocacy programs and deliver a great customer experience.

    Retain your customers and turn them into brand advocates by building trust, providing an exceptional experience, and most importantly, continuously delivering on the brand promise.

    Implement a strong customer advocacy program, based on personalized experiences, the value provided, and mutual exchange, and reap the benefits of developing and growing long-term relationships.

    92% of individuals trust word-of-mouth recommendations, making it one of the most trust-rich forms of advertising.
    Source: SocialToaster

    Word-of-mouth (advocacy) marketing increases marketing effectiveness by 54%
    Source: SocialToaster

    Make your brand known and make it stick in people's minds

    Building and maintaining high brand awareness requires that each individual within the organization carry and deliver the brand message clearly and consistently across all media whether in person, in written communications, or otherwise.

    To achieve this, brand leaders must first develop a powerful, researched narrative that people will embrace and convey, which requires careful preparation.

    Target market and audience intel

    • Target market Intel
    • Buyer persona and journey/pain points
    • Uniqueness and positioning

    Brand attributes

    • Values at the heart of the relationship
    • Brand's human attributes

    Brand visibly and recall

    • Digital and social media presence
    • Thought leadership
    • Personal branding
    • Influencer marketing

    Brand awareness building plan

    • Long-term awareness and multi-touchpoint approach
    • Monitoring and optimization

    Short and long-term benefits of increasing brand awareness

    Brands are built over the long term but the rewards are high.

    • Stronger brand perception
    • Improved engagement and brand associations
    • Enhanced credibility, reputation, and trust
    • Better connection with customers
    • Increased repeat business
    • High-quality leads
    • Higher and faster conversion rate
    • More sales closed/ deals won
    • Greater brand equity
    • Accelerated growth

    "Strong brands outperform their less recognizable competitors by as much as 73%."
    Source: McKinsey

    Brand awareness building

    Building brand awareness, even though immediate benefits are often difficult to see and measure, is essential for companies to stand out from their competitors and continue to grow in a sustainable way.

    To successfully raise awareness, brands need to have:

    • A longer-term vision and strategy.
    • Market Intelligence, a clear value proposition, and key differentiator.
    • Consistent, well-aligned messaging and storytelling.
    • Digital presence and content.
    • The ability to reach out through multiple touchpoints.
    • Necessary resources.

    Without brand awareness, brands become less attractive to buyers, talent, and investors, and their ability to grow, increase their market value, and be sustainable is reduced.

    Brand awareness building methodology

    Define brands' personality and message

    • Gather market intel and analyze the market.
    • Determine the value proposition and positioning.
    • Define the brand archetype and voice.
    • Craft a compelling brand message and story.
    • Get all the key elements of your brand guidelines.

    Start building brand awareness

    • Achieve strategy alignment and readiness.
    • Create and manage assets.
    • Deploy your tactics, assets, and workflows.
    • Establish key performance indicators (KPIs).
    • Monitor and optimize on an ongoing basis.

    Toolkit

    • Market and Influencing Factors Analysis
    • Recognition Survey and Best Practices
    • Buyer Personas and Journeys
    • Purpose, Mission, Vision, Values
    • Value Proposition and Positioning
    • Brand Message, Voice, and Writing Style
    • Brand Strategy and Tactics
    • Asset Creation and Management
    • Strategy Rollout Plan

    Short and long-term benefits of increasing brand awareness

    Increase:

    • Brand perception
    • Brand associations and engagement
    • Credibility, reputation, and trust
    • Connection with customers
    • Repeat business
    • Quality leads
    • Conversion rate
    • Sales closed / deals won
    • Brand equity and growth

    It typically takes 5-7 brand interactions before a buyer remembers the brand.
    Source: Startup Bonsai

    Who benefits from this brand awareness research?

    This research is being designed for:
    Brand and marketing leaders who:

    • Know that brand awareness is essential to the success of all marketing and sales activities.
    • Want to make their brand unique, recognizable, meaningful, and highly visible.
    • Seek to increase their digital presence, connect and engage with their target audience.
    • Are looking at reaching a new segment of the market.

    This research will also assist:

    • Sales with qualified lead generation and customer retention and loyalty.
    • Human Resources in their efforts to attract and retain talent.
    • The overall business with growth and increased market value.

    This research will help you:

    • Gain market intelligence and a clear understanding of the target audience's needs and trends, competitive advantage, and key differentiator.
    • The ability to develop clear and compelling, human-centric messaging and compelling story driven by brand values.
    • Increase online presence and brand awareness activities to attract and engage with buyers.
    • Develop a long-term brand awareness strategy and deployment plan.

    This research will help them:

    • Increase campaign ROI.
    • Develop a longer-term vision and benefits of investing in longer-term initiatives.
    • Build brand equity and increase business valuation.
    • Grow your business in a more sustainable way.

    SoftwareReviews' brand awareness building methodology

    Phase 1 Define brands' personality and message

    Phase 2 Start building brand awareness

    Phase steps

    1.1 Gather market intelligence and analyze the market.

    1.2 Develop and document the buyer's persona and journey.

    1.3 Uncover the brand mission, vision statement, core values, value proposition and positioning.

    1.4 Define the brand's archetype and tone of voice, then craft a compelling brand messaging.

    2.1 Achieve strategy alignment and readiness.

    2.2 Create assets and workflows and deploy tactics.

    2.3 Establish key performance indicators (KPIs), monitor, and optimize on an ongoing basis.

    Phase outcomes

    • Target market and audience are identified and documented.
    • A clear value proposition and positioning are determined.
    • The brand personality, voice, and messaging are developed.
    • All the key elements of the brand guidelines are in place and ready to use, along with the existing logo, typography, color palette, and imagery.
    • A comprehensive and actionable brand awareness strategy, with tactics, KPIs, and metrics, is set and ready to execute.
    • A progressive and effective deployment plan with deliverables, timelines, workflows, and checklists is in place.
    • Resources are assigned.

    Insight summary

    Brands to adapt their strategies to achieve longer-term growth
    Brands must adapt and adjust their strategies to attract informed buyers who have access to a wealth of products, services, and brands from all over. Building brand awareness, even though immediate benefits are often difficult to see and measure, has become essential for companies that want to stand out from their competitors and continue to grow in a sustainable way.

    A more human-centric approach
    Brand personalities matter. Brands placing human values at the heart of the customer-brand relationship will drive interest in their brand and build trust with their target audience.

    Stand out from the crowd
    Brands that develop and promote a clear and consistent message across all platforms and channels, along with a unique value proposition, stand out from their competitors and get noticed.

    A multi-touchpoints strategy
    Engage buyers with relevant content across multiple media to address their pain points. Analyze touchpoints to determine where to invest your efforts.

    Going social
    Buyers expect brands to be active and responsive in their interactions with their audience. To build awareness, brands are expected to develop a strong presence on social media by regularly posting relevant content, engaging with their followers and influencers, and using paid advertising. They also need to establish thought leadership through content such as white papers, case studies, and webinars.

    Thought leaders wanted
    To enhance their overall brand awareness strategy, organizations should consider developing the personal brand of key executives. Thought leadership can be a valuable method to gain credibility, build trust, and drive conversion. By establishing thought leadership, businesses can increase brand mentions, social engagement, website traffic, lead generation, return on investment (ROI), and Net Promoter Score (NPS).

    Save time and money with SoftwareReviews' branding advice

    Collaborating with SoftwareReviews analysts for inquiries not only provides valuable advice but also leads to substantial cost savings during branding activities, particularly when partnering with an agency.

    Guided Implementation Purpose Measured Value
    Build brands' personality and message Get the key elements of the brand guidelines in place and ready to use, along with your existing logo, typography, color palette, and imagery, to ensure consistency and clarity across all brand touchpoints from internal communication to customer-facing materials. Working with SoftwareReviews analysts to develop brand guidelines saves costs compared to hiring an agency.

    Example: Building the guidelines with an agency will take more or less the same amount of time and cost approximately $80K.

    Start building brand awareness Achieve strategy alignment and readiness, then deploy tactics, assets, and other deliverables. Start building brand awareness and reap the immediate and long-term benefits.

    Working with SoftwareReviews analysts and your team to develop a long-term brand strategy and deployment will cost you less than a fraction of the cost of using an agency.

    Example: Developing and executing long-term brand awareness strategies with an agency will cost between $50-$75K/month over a 24-month period minimum.

    Guided Implementation

    What does a typical GI on this topic look like?

    Phase 1

    Build brands' personality and message

    Phase 2

    Start building brand awareness

    • Call #1: Discuss concept and benefits of building brand awareness. Identify key stakeholders. Anticipate concerns and objections.
    • Call #2: Discuss target market intelligence, information gathering, and analysis.
    • Call #3: Review market intelligence information. Address questions or concerns.
    • Call #4: Discuss value proposition and guide to find positioning and key differentiator.
    • Call #5: Review value proposition. Address questions or concerns.
    • Call #6: Discuss how to build a comprehensive brand awareness strategy using SR guidelines and template.
    • Call #7: Review strategy. Address questions or concerns.
    • Call #8: Second review of the strategy. Address questions or concerns.
    • Call #9 (optional): Third review of the strategy. Address questions or concerns.
    • Call #10: Discuss how to build the Execution Plan using SR template.
    • Call #11: Review Execution Plan. Address questions or concerns.
    • Call #12: Second review of the Execution Plan. Address questions or concerns.
    • Call #13 (optional): Third review of the Execution Plan. Address questions or concerns.
    • Call #14: Discuss how to build a compelling storytelling and content creation.
    • Call #15: Discuss website and social media platforms and other initiatives.
    • Call #16: Discuss marketing automation and continuous monitoring.
    • Call #17 (optional): Discuss optimization and reporting
    • Call #18: Debrief and determine how we can help with next steps.

    A Guided Implementation (GI) is a series of calls with a SoftwareReviews Marketing Analyst to help implement our best practices in your organization.

    Your engagement managers will work with you to schedule analyst calls.

    Brand awareness building tools

    Each step of this blueprint comes with tools to help you build brand awareness.

    Brand Awareness Tool Kit

    This kit includes a comprehensive set of tools to help you better understand your target market and buyers, define your brand's personality and message, and develop an actionable brand awareness strategy, workflows, and rollout plan.

    The set includes these templates:
    • Market and Influencing Factors Analysis
    • Recognition Survey and Best Practices
    • Buyer Personas and Journeys
    • Purpose, Mission, Vision, and Values
    • Value Proposition and Positioning
    • Brand Message, Voice, and Writing Style
    • Brand Strategy and Tactics
    • Asset Creation and Management
    • Strategy Rollout Plan
    An image of a series of screenshots from the templates listed in the column to the left of this image.

    Get started!

    Know your target market and audience, deploy well-designed strategies based on shared values, and make meaningful connections with people.

    Phase 1

    Define brands' personality and message

    Phase 2

    Start building brand awareness

    Phase 1

    Define brands' personality and message

    Steps

    1.1 Gather market intelligence and analyze the market.
    1.2 Develop and document the buyer's persona and journey.
    1.3 Uncover the brand mission, vision statement, core values, positioning, and value proposition.
    1.4 Define the brand's archetype and tone of voice, then craft a compelling brand messaging.

    Phase outcome

    • Target market and audience are identified and documented.
    • A clear value proposition and positioning are determined.
    • The brand personality, voice, and messaging are developed.
    • All the key elements of the brand guidelines are in place. and ready to use, along with the existing logo, typography, color palette, and imagery..

    Build brands' personality and message

    Step 1.1 Gather market intelligence and analyze the market.

    Total duration: 2.5-8 hours

    Objective

    Analyze and document your competitive landscape, assess your strengths, weaknesses, opportunities,
    and threats, gauge the buyers' familiarity with your brand, and identify the forces of influence.

    Output

    This exercise will allow you to understand your market and is essential to developing your value proposition.

    Participants

    • Head of branding and key stakeholders

    MarTech
    May require you to:

    • Register to a Survey Platform.
    • Use, setup, or install platforms like CRM and/or Marketing Automation Platform.

    Tools

    1.1.1 SWOT and competitive landscape

    (60-120 min.)

    Analyze & Document

    Follow the instructions in the Market Analysis Template to complete the SWOT and Competitive Analysis, slides 4 to 7.

    1.1.3 Internal and External Factors

    (30-60 min.)

    Analyze

    Follow the instructions in the External and Internal Factors Analysis Template to perform the PESTLE, Porter's 5 Forces, and Internal Factors and VRIO Analysis.

    Transfer

    Transfer key information into slides 10 and 11 of the Market Analysis Template.

    Consult SoftwareReviews website to find the best survey and MarTech platforms or contact one of our analysts for more personalized assistance and guidance

    1.1.2 Brand recognition

    (60-300 min.)

    Prep

    Adapt the survey and interview questions in the Brand Recognition Survey Questionnaire and List Template.

    Determine how you will proceed to conduct the survey and interviews (internal or external resources, and tools).

    Refer to the Survey Emails Best Practices Guidelines for more information on how to conduct email surveys.

    Collect & Analyze

    Use the Brand Recognition Survey Questionnaire and List Template to build your list, conduct the survey /interviews, and collect and analyze the feedback received.

    Transfer

    Transfer key information into slides 8 and 9 of the Market Analysis Template.

    Brand performance diagnostic

    Have you considered diagnosing your brand's current performance before you begin building brand awareness?

    Audit your brand using the Diagnose Brand Health to Improve Business Growth blueprint.Collect and interpret qualitative and quantitative brand performance measures.

    The toolkit includes the following templates:

    • Surveys and interviews questions and lists
    • External and internal factor analysis
    • Digital and financial metrics analysis

    Also included is an executive presentation template to communicate the results to key stakeholders and recommendations to fix the uncovered issues.

    Build brands' personality and message

    Step 1.2 Develop and document the buyer's persona and journey.

    Total duration: 4-8 hours

    Objective

    Gather existing and desired customer insights and conduct market research to define and personify your buyers' personas and their buying behaviors.

    Output

    Provide people in your organization with clear direction on who your target buyers are and guidance on how to effectively reach and engage with them throughout their journey.
    Participants

    • Head of branding
    • Key stakeholders from sales and product marketing

    MarTech
    May require you to:

    • Register to an Online Survey Platform (free version or subscription).
    • Use, setup, or installation of platforms like CRM and/or Marketing Automation Platform.

    Tools

    1.2.1 Buyer Personas and Journeys

    (240-280 min.)

    Research

    Identify your tier 1 to 3 customers using the Ideal Client Profile (ICP) Workbook. (Recommended)

    Survey and interview existing and desired customers based using the Buyer Persona and Journey Interview Guide and Data Capture Tool. (Recommended)

    Create

    Define and document your tier 1 to 3 Buyer Personas and Journeys using the Buyer Personas and Journeys Presentation Template.

    Consult SoftwareReviews website to find the best survey platform for your needs or contact one of our analysts for more personalized assistance and guidance

    Buyer Personas and Journeys

    A well-defined buyer persona and journey is a great way for brands to ensure they are effectively reaching and engaging their ideal buyers through a personalized buying experience.

    When properly documented, it provides valuable insights about the ideal customers, their needs, challenges, and buying decision processes allowing the development of initiatives that correspond to the target buyers.

    Build brands' personality and message

    Step 1.3 Uncover the brand mission, vision statement, core values, value proposition, and positioning.

    Total duration: 4-5.5 hours

    Objective
    Define the "raison d'être" and fundamental principles of your brand, your positioning in the marketplace, and your unique competitive advantage.

    Output
    Allows everyone in an organization to understand and align with the brand's raison d'être beyond the financial dimension, its current positioning and objectives, and how it intends to achieve them.
    It also serves to communicate a clear and appealing value proposition to buyers.

    Participants

    • Head of branding
    • Chief Executive Officer (CEO)
    • Key stakeholders

    Tools

    • Brand Purpose, Mission, Vision, and Values Template
    • Value Proposition and Positioning Statement Template

    1.3.1 Brand Purpose, Mission, Vision, and Values

    (90-120 min.)

    Capture or Develop

    Capture or develop, if not already existing, your brand's purpose, mission, vision statement, and core values using slides 4 to 7 of the Brand Purpose, Mission, Vision, and Values Template.

    1.3.2 Brand Value Proposition and Positioning

    (150-210 min.)

    Define

    Map the brand value proposition using the canvas on slide 5 of the Value Proposition and Positioning Statement Template, and clearly articulate your value proposition statement on slide 4.

    Optional: Use canvas on slide 7 to develop product-specific product value propositions.

    On slide 8 of the same template, develop your brand positioning statement.

    Build brands' personality and message

    Steps 1.4 Define the brand's archetype and tone of voice, and craft a compelling brand messaging.

    Total duration: 5-8 hours

    Objective

    Define your unique brand voice and develop a set of guidelines, brand story, and messaging to ensure consistency across your digital and non-digital marketing and communication assets.
    Output

    A documented brand personality and voice, as well as brand story and message, will allow anyone producing content or communicating on behalf of your brand to do it using a unique and recognizable voice, and convey the right message.

    Participants

    • Head of branding
    • Content specialist
    • Chief Executive Officer and other key stakeholders

    Tools

    • Brand Voice Guidelines Template
    • Writing Style Guide Template
    • Brand Messaging Template
    • Writer Checklist Template

    1.4.1 Brand Archetype and Tone of Voice

    (120-240 min.)

    Define and document

    Refer to slides 5 and 6 of the Brand Voice Guidelines Template to define your brand personality (archetype), slide 7.

    Use the Brand Voice Guidelines Template to define your brand tone of voice and characteristics on slides 8 and 9, based on the 4 primary tone of voice dimensions, and develop your brand voice chart, slide 9.

    Set Rules

    In the Writing Style Guide template, outline your brand's writing principles, style, grammar, punctuation, and number rules.

    1.4.2 Brand Messaging

    (180-240 min.)

    Craft

    Use the Brand Messaging template, slides 4 to 7, to craft your brand story and message.

    Audit

    Create a content audit to review and approve content to be created prior to publication, using the Writer's Checklist template.

    Important Tip!

    A consistent brand voice leads to remembering and trusting the brand. It should stand out from the competitors' voices and be meaningful to the target audience. Once the brand voice is set, avoid changing it.

    Phase 2

    Start building brand awareness

    Steps

    2.1 Achieve strategy alignment and readiness.
    2.2 Create assets and workflows, and deploy tactics.
    2.3 Establish key performance indicators (KPIs), monitor, and optimize on an ongoing basis.

    Phase outcome

    • A comprehensive and actionable brand awareness strategy, with tactics, KPIs, and metrics, is set and ready to execute.
    • A progressive and effective deployment plan with deliverables, timelines, workflows, and checklists is in place.
    • Resources are assigned.

    Start building brand awareness

    Step 2.1 Achieve strategy readiness and alignment.

    Total duration: 4-5 hours

    Objective

    Now that you have all the key elements of your brand guidelines in place, in addition to your existing logo, typography, color palette, and imagery, you can begin to build brand awareness.

    Start planning to build brand awareness by developing a comprehensive and actionable brand awareness strategy with tactics that align with the company's purpose and objectives. The strategy should include achievable goals and measurables, budget and staffing considerations, and a good workload assessment.

    Output

    A comprehensive long-term, actionable brand awareness strategy with KPIs and measurables.

    Participants

    • Head of branding
    • Key stakeholders

    Tools

    • Brand Awareness Strategy and Tactics Template

    2.1.1 Brand Awareness Analysis

    (60-120 min.)

    Identify

    In slide 5 of the Brand Awareness Strategy and Tactics Template, identify your top three brand awareness drivers, opportunities, inhibitors, and risks to help you establish your strategic objectives in building brand awareness.

    2.1.2 Brand Awareness Strategy

    (60-120 min.)

    Elaborate

    Use slides 6 to 10 of the Brand Awareness Strategy and Tactics Template to elaborate on your strategy goals, key issues, and tactics to begin or continue building brand awareness.

    2.1.3 Brand Awareness KPIs and Metrics

    (180-240 min.)

    Set

    Set the strategy performance metrics and KPIs on slide 11 of the Brand Awareness Strategy and Tactics Template.

    Monitor

    Once you start executing the strategy, monitor and report each quarter using slides 13 to 15 of the same document.

    Understanding the difference between strategies and tactics

    Strategies and tactics can easily be confused, but although they may seem similar at times, they are in fact quite different.

    Strategies and tactics are complementary.

    A strategy is a plan to achieve specific goals, while a tactic is a concrete action or set of actions used to implement that strategy.

    To be effective, brand awareness strategies should be well thought-out, carefully planned, and supported by a series of tactics to achieve the expected outcomes.

    Start building brand awareness

    Step 2.2 Create assets and workflows and deploy tactics.

    Total duration: 3.5-4.5 hours

    Objective

    Build a long-term rollout with deliverables, milestones, timelines, workflows, and checklists. Assign resources and proceed to the ongoing development of assets. Implement, manage, and continuously communicate the strategy and results to key stakeholders.

    Output

    Progressive and effective development and deployment of the brand awareness-building strategy and tactics.

    Participants

    • Head of branding

    Tools

    • Asset Creation and Management List
    • Campaign Workflows Template
    • Brand Awareness Strategy Rollout Plan Template

    2.2.1 Assets Creation List

    (60-120 min.)

    Inventory

    Inventory existing assets to create the Asset Creation and Management List.

    Assign

    Assign the persons responsible, accountable, consulted, and informed of the development of each asset, using the RACI model in the template. Ensure you identify and collaborate with the right stakeholders.

    Prioritize

    Prioritize and add release dates.

    Communicate

    Update status and communicate regularly. Make the list with links to the assets available to the extended team to consult as needed.

    2.2.2 Rollout Plan

    (60-120 min.)

    Inventory

    Map out your strategy deployment in the Brand Awareness Strategy Rollout Plan Template and workflow in the Campaign Workflow Template.

    Assign

    Assign the persons responsible, accountable, consulted, and informed for each tactic, using the RACI model in the template. Ensure you identify and collaborate with the right stakeholders.

    Prioritize

    Prioritize and adjust the timeline accordingly.

    Communicate

    Update status and communicate regularly. Make the list with links to the assets available to the extended team to consult as needed.

    Band Awareness Strategy Rollout Plan
    A strategy rollout plan typically includes the following:

    • Identifying a cross-functional team and resources to develop the assets and deploy the tactics.
    • Listing the various assets to create and manage.
    • A timeline with key milestones, deadlines, and release dates.
    • A communication plan to keep stakeholders informed and aligned with the strategy and tactics.
    • Ongoing performance monitoring.
    • Constant adjustments and improvements to the strategy based on data collected and feedback received.

    Start building brand awareness

    Step 2.3 Establish key performance indicators (KPIs), monitor, and optimize on an ongoing basis.

    Total duration: 3.5-4.5 hours

    Objective

    Brand awareness is built over a long period of time and must be continuously monitored in several ways. Measuring and monitoring the effectiveness of your brand awareness activities will allow you to constantly adjust your tactics and continue to build awareness.

    Output

    This step will provide you with a snapshot of your current level of brand awareness and interactions with the brand, and allow you to set up the tools for ongoing monitoring and optimization.

    Participants

    • Head of branding
    • Digital marketing manager

    MarTech
    May require you to:

    • Register to an Online Survey Platform(free version or subscription), or
    • Use, setup, or installation of platforms like CRM and/or Marketing Automation Platform.
    • Use Google Analytics or other tracking tools.
    • Use social media and campaign management tools.

    Tools

    • Brand Awareness Strategy and Tactics Template

    2.2.2 Rollout Plan

    (60-120 min.)

    Measure

    Monitor and record the strategy performance metrics in slides 12 to 15 of the Brand Awareness Strategy and Tactics template, and gauge its performance against preset KPIs in slide 11. Make ongoing improvements to the strategy and assets.

    Communicate

    The same slides in which you monitor strategy performance can be used to report on the results of the current strategy to key stakeholders on a monthly or quarterly basis, as appropriate.

    Take this opportunity to inform stakeholders of any adjustments you plan to make to the existing plan to improve its performance. Since brand awareness is built over time, be sure to evaluate the results based on how long the strategy has been in place before making major changes.

    Consult SoftwareReviews website to find the best survey, brand monitoring and feedback, and MarTech platforms, or contact one of our analysts for more personalized assistance and guidance

    Measuring brand strategy performance
    There are two ways to measure and monitor your brand's performance on an ongoing basis.

    • By registering to brand monitoring and feedback platforms and tools like Meltwater, Hootsuite, Insights, Brand24, Qualtrics, and Wooltric.
    • Manually, using native analytics built in the platforms you're already using, such as Google and Social Media Analytics, or by gathering customer feedback through surveys, or calculating CAC, ROI, and more in spreadsheets.

    SoftwareReviews can help you choose the right platform for your need. We also equip you with manual tools, available with the Diagnose Brand Health to Improve Business Growthblueprint to measure:

    • Surveys and interviews questions and lists.
    • External and internal factor analysis.
    • Digital and financial metrics analysis.
    • Executive presentation to report on performance.

    Related SoftwareReviews research

    An image of the title page for SoftwareReviews Create a Buyer Persona and Journey. An image of the title page for SoftwareReviews Diagnose Brand Health to Improve Business Growth.

    Create a Buyer Persona and Journey

    Get deeper buyer understanding and achieve product-market fit, with easier access to market and sales

    • Reduce time and resources wasted chasing the wrong prospects.
    • Increase open and click-through rates.
    • Perform more effective sales discovery.
    • Increase win rate.

    Diagnose Brand Health to Improve Business Growth

    Have a significant and well-targeted impact on business success and growth by knowing how your brand performs, identifying areas of improvement, and making data-driven decisions to fix them.

    • Increase brand awareness and equity.
    • Build trust and improve customer retention and loyalty.
    • Achieve higher and faster growth.

    Bibliography

    Aaker, David. "Managing Brand Equity." Simon & Schuster, 1991.
    "6 Factors for Brands to Consider While Designing Their Communication." Lokus Design, 23 Sept. 2022.
    "20 Advocacy Marketing Statistics You Need to Know." Social Toaster, n.d.
    Bazilian, Emma. "How Millennials and Baby Boomers Consume User-Generated Content And what brands can learn from their preferences." Adweek, January 2, 2017.
    B2B International, a Gyro: company, B2B Blog - Why Human-To-Human Marketing Is the Next Big Trend in a Tech-Obsessed World.
    B2B International, a Gyro: company, The State of B2B Survey 2019 - Winning with Emotions: How to Become Your Customer's First Choice.
    Belyh, Anastasia. "Brand Ambassador 101:Turn Your Personal Brand into Cash." Founder Jar, December 6, 2022.
    Brand Master Academy.com.
    Businesswire, a Berkshire Hathaway Company, "Stackla Survey Reveals Disconnect Between the Content Consumers Want & What Marketers Deliver." February 20, 2019.
    Chamat, Ramzi. "Visual Design: Why First Impressions Matter." 8 Ways, June 5, 2019.
    Cognism. "21 Tips for Building a LinkedIn Personal Brand (in B2B SaaS)."
    Curleigh, James. "How to Enhance and Expand a Global Brand." TED.
    "2019 Edelman Trust Barometer." Edelman.
    Erskine, Ryan. "22 Statistics That Prove the Value of Personal Branding." Entrepreneur, September 13, 2016.
    Forbes, Steve. "Branding for Franchise Success: How To Achieve And Maintain Brand Consistency Across A Franchise Network?" Forbes, 9 Feb. 2020.
    Godin, Seth. "Define: Brand." Seth's Blog, 30 Dec. 2009,
    Houragan, Stephen. "Learn Brand Strategy in 7 Minutes (2023 Crash Course)." YouTube.
    Jallad, Revecka. "To Convert More Customers, Focus on Brand Awareness." Forbes, October 22, 2019.
    Kingsbury, Joe, et al. "2021 B2B Thought Leadership Impact Study." Edelman, 2021.
    Kunsman, Todd. "The Anatomy of an Employee Influencer." EveryoneSocial, September 8, 2022.
    Landor, Walter. A Brand New World: The Fortune Guide to the 21st Century. Time Warner Books, 1999.
    Liedke, Lindsay. "37+ Branding Statistics For 2023: Stats, Facts & Trends." Startup Bonsai, January 2, 2023.
    Millman, Debbie. "How Symbols and Brands Shape our Humanity." TED, 2019.
    Nenova, Velina. "21 Eye-Opening B2B Marketing Statistics to Know in 2023." Techjury, February 9, 2023.
    Perrey, Jesko et al., "The brand is back: Staying relevant in an accelerating age." McKinsey & Company, May 1, 2015.
    Schaub, Kathleen. "Social Buying Meets Social Selling: How Trusted Networks Improve the Purchase Experience." LinkedIn Business, April 2014.
    Sopadjieva, Emma et al. "A Study of 46,000 Shoppers Shows That Omnichannel Retailing Works." Harvard Business Review, January 3, 2017.
    Shaun. "B2B Brand Awareness: The Complete Guide 2023." B2B House. 2023.
    TopRank Marketing, "2020 State of B2B Influencer Marketing Research Report." Influencer Marketing Report.

    Cookie Notice

    Gert Taeymans BV wants to inform you about our cookie notice on the Gert Taeymans BV websites via this document. Please also see the privacy policy which you can find here.

    This website is owned by Gert Taeymans BV

    Contact details:
    Gert Taeymans BV
    Koning Albertstraat 136
    2070 Burcht
    Belgium
    Company number: 0685974694
    Phone: +32 3 289 41 09
    email: gtbvba@gerttaeymans.com

    Site Scope

    The websites in scope of this notice are:

    • tymansgroup.com
    • gerttaeymans.consulting
    • gerttaeymans.site
    • gerttaeymans.audio

    Cookie Types

    We differentiate 4 types of cookies

    • Necessary cookies
      Necessary cookies help make our website usable by enabling basic functions like page navigation and access to secure areas of the website. While you can decline them, The website cannot function properly without these cookies.
    • Preferences cookies
      Preference cookies enable our website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in. They may include cookies from 3rd party providers whose content we show or reference on our site. Those cookies are outside of our control and these providers may change their terms and policies at any time.
    • Statistics cookies
      Statistic cookies help our company to understand how visitors interact with our website by collecting and reporting statistical information pseudonymously. That means that eg. your IP address is scrambled in such a way that it will always be the same upon each subsequent visit to our site, so that Google can process the visit as a return visit. This helps with basic statistics, but also is a factor in how well we rank in future searches. Many returning visitors means that you like our site and that is a ranking element.
      Due to the ECJ striking down the  EU-US Privacy Shield agreement, this leaves us with a open gap. The resulting implications and actions to take are not yet clear. However, when agreeing to statistics cookies, you agree that your data may be processed in the United States under less strict privacy laws and that your data will be exposed to all associated risks. Such risks include the US government being able to investigate you, simply for being a non-US citizen due to provision 702 of the FISA act, which they are able to do anyway, with or without the cookie. Also, the laws in the United States are less strict with regards to selling information to third parties.
    • Marketing cookies
      Marketing cookies are used to track you across websites. The intention is to display ads that are relevant and engaging for you and thereby more valuable for publishers and third party advertisers. At this point we do not allow ads to display on our site, so no third-party trackers are defined on our site. We may add a 1st party (us) tracker to our site at any time.

    Actual cookies used

    Necessary cookies (all sites in site scope)

    Name     Contents Expiration Reason for the cookie
    Session cookie (displayed as a long series of numbers and letters) The active session ID When you close your broser, clear your cookie's cache in your browser or after 60 minutes of inactivity on the site. The cookie may remain in your machine but is no longer valid after the mentioned tile of inactivity    

    The browser cookie is simply a random string of characters to identify the visitor. There are no personally identifable details in the cookie and no real data of use at all. The cookie is marked as a 'session' type of cookie, which means it will expire (be deleted automatically) when the browser is closed or cleaned by the browser after a set period of non-use; for instance, you haven't visited a page on the site that has used the cookie for 1 week. This latter case is useful for people that leave their computer running and never close their browser.

    The use of a cookie is what gives your website a short-term memory. By providing it with each request, Joomla can look up the history of the current viewing session in the database record below.

    cookieconsent_status allow 1 year This cookie stores that you have consented to the use of cookies on our site. It is there to avoid that you have to give your consent again at every page load.

    Preferences cookies

    Site Name     Contents Expiration Reason for the cookie
    gerttaeymans.consulting None at this stage N/A N/A   N/A
    tymansgroup.com None at this stage N/A N/A N/A
             
             

    Statistical cookies

    Site Name     Contents Expiration Reason for the cookie
    All Scope _ga Google Analytics type and account identifier 2 years This cookie identifies our domain (gerttaeymans.consulting) and sends visit information to Google. information may include, but not limited to: browser identifiable information, page visited, visit duration, etc. This information does not contain user identifiable information
    All Scope _gat_gtag_UA_140807308_3 Google Analytics type and account identifier 2 years This cookie also identifies our domain (gerttaeymans.consulting) and sends visit information to Google. information may include, but not limited to: browser identifiable information, page visited, visit duration, etc. This information does not contain user identifiable information
    All Scope _gid Google Analytics type and account identifier 1 day This cookie also identifies our domain (gerttaeymans.consulting) and sends visit information to Google. information may include, but not limited to: browser identifiable information, page visited, visit duration, etc. This information does not contain user identifiable information
             
             

    Marketing cookies

    Name     Contents Expiration Reason for the cookie
    None at this stage N/A N/A N/A
           
           

     

    Managing cookies

    You are not required to accept any cookies . Our cookies toolbar allows you to fine tune which cookies you accespt or want to revoke consent for. The resulting experience may however be affected by your decision not to accept cookies.

    Eg. not accepting or revoking consent for the “Necessary” category cookies will result in your inability to log into the site, even if you have previously accepted the cookies and paid for service.

    Not accepting or revoking consent for “Preference” category cookies may impede on your ability to watch instructional videos on our site, even if you have previously accepted the cookies and paid for service.

    Not accepting or revoking consent for ‘Statistical” category cookies will result in us not seeing where visitors stay longer or shorter on our site. While the immediate experience will not degrade for you, it may impede us in better understanding where we need to improve our service, thereby denying you a potentially improved experience in the future.

    Not accepting or revoking consent for “Marketing” category cookies may result in you seeing irrelevant ads, if we make the decision to allow carefully selected partners to offer their services through our site.

    Removing cookies from your device

    You can delete all cookies that are already on your device by clearing the browsing history of your browser. This will remove all cookies from all websites you have visited.

    Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).

    Managing site-specific cookies

    For more detailed control over site-specific cookies, check the privacy and cookie settings in your preferred browser

    Blocking cookies

    You can set most modern browsers to prevent any cookies being placed on your device, but you may then have to manually adjust some preferences every time you visit a site/page. And some services and functionalities may not work properly at all (e.g. profile logging-in).

    Succeed With Digital Strategy Execution

    • Buy Link or Shortcode: {j2store}527|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Customer Relationship Management
    • Parent Category Link: /customer-relationship-management
    • Rising customer expectations and competitive pressures have accelerated the pace at which organizations are turning to digital transformation to drive revenue or cut costs.
    • Many digital strategies are not put into action, and instead sit on the shelf. A digital strategy that is not translated into specific projects and initiatives will provide no value to the organization.
    • Executing a digital strategy is easier said than done: IT often lacks the necessary framework to create a roadmap, or fails to understand how new applications can enable the vision outlined in the strategy.

    Our Advice

    Critical Insight

    • A digital strategy needs a clear roadmap to succeed. Too many digital strategies are lofty statements of objective with no clear avenue for actual execution: create a digital strategy application roadmap to avoid this pitfall.
    • Understand the art of execution. Application capabilities are rapidly evolving: IT must stand ready to educate the business on how new applications can be used to pursue the digital strategy.

    Impact and Result

    • IT must work with the business to parse specific technology drivers from the digital strategy, distill strategic requirements, and create a prescriptive roadmap of initiatives that will close the gaps between the current state and the target state outlined in the digital strategy. Doing so well is a path to the CIO’s office.
    • To better serve the organization, IT leaders must stay abreast of key application capabilities and trends. Exciting new developments such as artificial intelligence, IoT, and machine learning have opened up new avenues for process digitization, but IT leaders need to make a concerted effort to understand what modern applications bring to the table for technology enablement of the digital strategy.
    • Taking an agile approach to application roadmap development will help to provide a clear path forward for tackling digital strategy execution, while also allowing for flexibility to update and iterate as the internal and external environment changes.

    Succeed With Digital Strategy Execution Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should have a structured approach to translating your digital strategy to specific application initiatives, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Parse digital strategy drivers

    Parse specific technology drivers out of the formal enterprise digital strategy.

    • Succeed With Digital Strategy Execution – Phase 1: Parse Your Digital Strategy for Critical Technology Drivers

    2. Map drivers to enabling technologies

    Review and understand potential enabling applications.

    • Succeed With Digital Strategy Execution – Phase 2: Map Your Drivers to Enabling Applications

    3. Create the application roadmap to support the digital strategy

    Use the drivers and an understanding of enabling applications to put together an execution roadmap that will support the digital strategy.

    • Succeed With Digital Strategy Execution – Phase 3: Create an Application Roadmap That Supports the Digital Strategy
    • Digital Strategy Roadmap Tool
    • Application Roadmap Presentation Template
    • Digital Strategy Communication and Execution Plan Template
    [infographic]

    Workshop: Succeed With Digital Strategy Execution

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Validate the Digital Strategy

    The Purpose

    Review and validate the formal enterprise digital strategy.

    Key Benefits Achieved

    Confirmation of the goals, objectives, and direction of the organization’s digital strategy.

    Activities

    1.1 Review the initial digital strategy.

    1.2 Determine gaps.

    1.3 Refine digital strategy scope and vision.

    1.4 Finalize digital strategy and validate with stakeholders.

    Outputs

    Validated digital strategy

    2 Parse Critical Technology Drivers

    The Purpose

    Enumerate relevant technology drivers from the digital strategy.

    Key Benefits Achieved

    List of technology drivers to pursue based on goals articulated in the digital strategy.

    Activities

    2.1 Identify affected process domains.

    2.2 Brainstorm impacts of digital strategy on technology enablement.

    2.3 Distill critical technology drivers.

    2.4 Identify KPIs for each driver.

    Outputs

    Affected process domains (based on APQC)

    Critical technology drivers for the digital strategy

    3 Map Drivers to Enabling Applications

    The Purpose

    Relate your digital strategy drivers to specific, actionable application areas.

    Key Benefits Achieved

    Understand the interplay between the digital strategy and impacted application domains.

    Activities

    3.1 Build and review current application inventory for digital.

    3.2 Execute fit-gap analysis between drivers and current state inventory.

    3.3 Pair technology drivers to specific enabling application categories.

    Outputs

    Current-state application inventory

    Fit-gap analysis

    4 Understand Applications

    The Purpose

    Understand how different applications support the digital strategy.

    Understand the art of the possible.

    Key Benefits Achieved

    Knowledge of how applications are evolving from a features and capabilities perspective, and how this pertains to digital strategy enablement.

    Activities

    4.1 Application spotlight: customer experience.

    4.2 Application spotlight: content and collaboration.

    4.3 Application spotlight: business intelligence.

    4.4 Application spotlight: enterprise resource planning.

    Outputs

    Application spotlights

    5 Build the Digital Application Roadmap

    The Purpose

    Create a concrete, actionable roadmap of application and technology initiatives to move the digital strategy forward.

    Key Benefits Achieved

    Clear, concise articulation of application roadmap for supporting digital that can be communicated to the business.

    Activities

    5.1 Build list of enabling projects and applications.

    5.2 Create prioritization criteria.

    5.3 Build the digital strategy application roadmap.

    5.4 Socialize the roadmap.

    5.5 Delineate responsibility for roadmap execution.

    Outputs

    Application roadmap for the digital strategy

    RACI chart for digital strategy roadmap execution

    Manage Your Chromebooks and MacBooks

    • Buy Link or Shortcode: {j2store}167|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: End-User Computing Devices
    • Parent Category Link: /end-user-computing-devices

    Windows is no longer the only option. MacBooks and Chromebooks are justified, but now you have to manage them.

    • If you have modernized your end-user computing strategy, you may have Windows 10 devices as well as MacBooks.
    • Virtual desktop infrastructure (VDI) and desktop as a service (DaaS) are becoming popular. Chromebooks may be ideal as a low-cost interface into DaaS for your employees.
    • Managing Chromebooks can be particularly challenging as they grow in popularity in the education sector.

    Our Advice

    Critical Insight

    Managing end-user devices may be accomplished with a variety of solutions, but many of those solutions advocate integration with a Microsoft-friendly solution to take advantage of features such as conditional access, security functionality, and data governance.

    Impact and Result

    • Many solutions are available to manage end-user devices, and they come with a long list of options and features. Clarify your needs and define your requirements before you purchase another endpoint management tool. Don’t purchase capabilities that you may never use.
    • Use the associated Endpoint Management Selection Tool spreadsheet to identify your desired endpoint solution features and compare vendor solution functionality based on your desired features.

    Manage Your Chromebooks and MacBooks Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Manage Your Chromebooks and MacBooks deck – MacBooks and Chromebooks are growing in popularity in enterprise and education environments, and now you have to manage them.

    Explore options, guidance and some best practices related to the management of Chromebooks and MacBooks in the enterprise environment and educational institutions. Our guidance will help you understand features and options available in a variety of solutions. We also provide guidance on selecting the best endpoint management solution for your own environment.

    • Manage Your Chromebooks and MacBooks Storyboard

    2. Endpoint Management Selection Tool – Select the best endpoint management tool for your environment. Build a table to compare endpoint management offerings in relation to the features and options desired by your organization.

    This tool will help you determine the features and options you want or need in an endpoint management solution.

    • Endpoint Management Selection Tool
    [infographic]

    Further reading

    Manage Your Chromebooks and MacBooks

    Financial constraints, strategy, and your user base dictate the need for Chromebooks and MacBooks – now you have to manage them in your environment.

    Analyst Perspective

    Managing MacBooks and Chromebooks is similar to managing Windows devices in many ways and different in others. The tools have many common features, yet they struggle to achieve the same goals.

    Until recently, Windows devices dominated the workplace globally. Computing devices were also rare in many industries such as education. Administrators and administrative staff may have used Windows-based devices, but Chromebooks were not yet in use. Most universities and colleges were Windows-based in offices with some flavor of Unix in other areas, and Apple devices were gaining some popularity in certain circles.

    That is a stark contrast compared to today, where Chromebooks dominate the classrooms and MacBooks and Chromebooks are making significant inroads into the enterprise environment. MacBooks are also a common sight on many university campuses. There is no doubt that while Windows may still be the dominant player, it is far from the only one in town.

    Now that Chromebooks and MacBooks are a notable, if not significant, part of the education and enterprise environments, they must be afforded the same considerations as Windows devices in those environments when it comes to management. The good news is that there is no lack of available solutions for managing these devices, and the endpoint management landscape is continually evolving and improving.

    This is a picture of P.J. Ryan, Research Director, Infrastructure & Operations, Info-Tech Research Group

    P.J. Ryan
    Research Director, Infrastructure & Operations
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • You modernized your end-user computing strategy and now have Windows 10 devices as well as MacBooks.
    • Virtual desktop infrastructure (VDI) and desktop as a service (DaaS) are becoming popular. Chromebooks would be ideal as a low-cost interface into DaaS for your employees.
    • You are responsible for the management of all the new Chromebooks in your educational district.
    • Windows is no longer the only option. MacBooks and Chromebooks are justified, but now you have to manage them.

    Common Obstacles

    • Endpoint management solutions typically do a great job at managing one category of devices, like Windows or MacBooks, but they struggle to fully manage alternative endpoints.
    • Multiple solutions to manage multiple devices will result in multiple dashboards. A single view would be better.
    • One solution may not fit all, but multiple solutions is not desirable either, especially if you have Windows devices, MacBooks, and Chromebooks.

    Info-Tech's Approach

    • Use the tools at your disposal first – don't needlessly spend money if you don't have to. Many solutions can already manage other types of devices to some degree.
    • Use the integration capabilities of endpoint management tools. Many of them can integrate with each other to give you a single interface to manage multiple types of devices while taking advantage of additional functionality.
    • Don't purchase capabilities you will never use. Using 80% of a less expensive tool is economically smarter than using 10% of a more expensive tool.

    Info-Tech Insight

    Managing end-user devices may be accomplished with a variety of solutions, but many of those solutions advocate integration with a Microsoft-friendly solution to take advantage of features such as conditional access, security functionality, and data governance.

    Insight Summary

    Insight 1

    Google Admin Console is necessary to manage Chromebooks, but it can be paired with other tools. Implementation partnerships provide solutions to track the device lifecycle, track the repair lifecycle, sync with Google Admin Console as well as PowerSchool to provide a more complete picture of the user and device, and facilitate reminders to return the device, pay fees if necessary, pick up a device when a repair is complete, and more.

    Insight 2

    The Google Admin Console allows admins to follow an organizational unit (OU) structure very similar to what they may have used in Microsoft's Active Directory environment. This familiarity makes the task of administering Chromebooks easier for admins.

    Insight 3

    Chromebook management goes beyond securing and manipulating the device. Controls to protect the students while online, such as Safe Search and Safe Browsing, should also be implemented.

    Insight 4

    Most companies choose to use a dedicated MacBook management tool. Many unified endpoint management (UEM) tools can manage MacBooks to some extent, but admins tend to agree that a MacBook-focused endpoint management tool is best for MacBooks while a Windows-based endpoint management tool is best for Windows devices.

    Insight 5

    Some MacBook management solutions advocate integration with Windows UEM solutions to take advantage of Microsoft features such as conditional access, security functionality, and data governance. This approach can also be applied to Chromebooks.

    Chromebooks

    Chromebooks had a respectable share of the education market before 2020, but the COVID-19 pandemic turbocharged the penetration of Chromebooks in the education industry.

    Chromebooks are also catching the attention of some decision makers in the enterprise environment.

    "In 2018, Chromebooks represented an incredible 60 percent of all laptop or tablet devices in K-12 -- up from zero percent when the first Chromebook launched during the summer break in 2011."
    – "Will Chromebooks Rule the Enterprise?" Computerworld

    "Chromebooks were the best performing PC products in Q3 2020, with shipment volume increasing to a record-high 9.4 million units, up a whopping 122% year-on-year."
    – Android Police

    "Until the pandemic, Chrome OS' success was largely limited to U.S. schools. Demand in 2020 appears to have expanded beyond that small but critical part of the U.S. PC market."
    – Geekwire

    "In addition to running a huge number of Chrome Extensions and Apps at once, Chromebooks also run Android, Linux and Windows apps."
    – "Will Chromebooks Rule the Enterprise?" Computerworld

    Managing Chromebooks

    Start with the Google Admin Console (GAC)

    GAC is necessary to initially manage Chrome OS devices.

    GAC gives you a centralized console that will allow you to:

    • Create organizational units
    • Add your Chromebook devices
    • Add users
    • Assign users to devices
    • Create groups
    • Create and assign policies
    • Plus more

    GAC can facilitate device management with features such as:

    • Control admin permissions
    • Encryption and update settings
    • App deployment, screen timeout settings
    • Perform a device wipe if required
    • Audit user activity on a device
    • Plus more

    Device and user addition, group and organizational unit creation and administration, applying policies to devices and users – does all this remind you of your Active Directory environment?

    GAC lets you administer users and devices with a similar approach.

    Managing Chromebooks

    Use Active Directory to manage Chromebooks.

    • Enable Active Directory (AD) management from within GAC and you will be able to integrate your Chromebook devices with your AD environment.
    • Devices will be visible in both the GAC and AD environment.
    • Use Windows Group Policy to manage devices and to push policies to users and devices.
    • Users can use their AD username and password to sign into Chromebook devices.
    • GAC can still be used for devices that are not synced with AD.

    Chromebooks can also be managed through these approved partners:

    • Cisco Meraki
    • Citrix XenMobile
    • IBM MaaS360
    • ManageEngine Mobile Device Manager Plus
    • VMware Workspace ONE

    Source: Google

    You must be running the Chrome Enterprise Upgrade and have any licenses required by the approved partner to take advantage of this management option. The partner admin policies supersede GAC.

    If you stop using the approved partner admin console to manage your devices, the polices and settings in GAC will immediately take over the devices.

    Microsoft still has the market share when it comes to device sales, and many administrators are already familiar with Microsoft's Active Directory. Google took advantage of that familiarity when it designed the Google Admin Console structure for users, groups, and organizational units.

    Chromebook Deployment

    Chromebook deployment becomes a challenge when device quantities grow. The enrollment process can be time consuming, and every device must be enrolled before it can be used by an employee or a student. Many admins enlist their full IT teams to assist in the short term. Some vendor partners may assist with distribution options if staffing levels permit. Recent developments from Google have opened additional options for device enrollment beyond the manual enrollment approach.

    Enrolling Chromebooks comes down to one of two approaches:

    1. Manually enrolling one device at a time
      • Users can assist by entering some identifying details during the enrollment if permitted.
      • Some third-party solutions exist, such as USB drives to reduce repetitive keystrokes or hubs to facilitate manually enrolling multiple Chromebooks simultaneously.
    2. Google's Chrome Enterprise Upgrade or the Chrome Education Upgrade
      • This allows you to let your users enroll devices after they accept the end-user license agreement.
      • You can take advantage of Google's vendor partner program and use a zero-touch deployment method where the Chromebook devices automatically receive the assigned policies, apps, and settings as soon as the device is powered on and an authorized user signs in.
      • The Enterprise Upgrade and the Education Upgrade do come with an annual cost per device, which is currently less than US$50.
      • The Enterprise and Education Upgrades come with other features as well, such as enhanced security.

    Chromebooks are automatically assigned to the top-level organizational unit (OU) when enrolled. Devices can be manually moved to another OU, but admins can also create enrollment policies to place newly enrolled devices in a specific OU or have the device locate itself in the same OU as the user.

    Chromebooks in Education

    GAC is also used with Education-licensed devices

    Most of the settings and features previously mentioned are also available for Education-licensed devices and users. Enterprise-specific features will not be available to Education licenses. (Active Directory integration with Education licenses, for example, is accomplished using a different approach)

    • Groups, policies, administrative controls, app deployment and management, adding devices and users, creating organizational units, and more features are all available to Education Admins to use.

    Education device policies and settings tend to focus more on protecting the students with controls such as:

    • Disable incognito mode
    • Disable location tracking
    • Disable external storage devices
    • Browser based protections such as Safe Search or Safe Browsing
    • URL blocking
    • Video input disable for websites
    • App installation prevention, auto re-install, and app blocking
    • Forced re-enrollment to your domain after a device is wiped
    • Disable Guest Mode
    • Restrict who can sign in
    • Audit user activity on a device

    When a student takes home a Chromebook assigned to them, that Chromebook may be the only computer in the household. Administrative polices and settings must take into account the fact that the device may have multiple users accessing many different sites and applications when the device is outside of the school environment.

    Chromebook Management Extended

    An online search for Chromebook management solutions will reveal several software solutions that augment the capabilities of the Google Admin Console. Many of these solutions are focused on the education sector and classroom and student options, although the features would be beneficial to enterprises and educational organizations alike.

    These solutions assist or augment Chromebook management with features such as:

    • Ability to sync with Google Admin Console
    • Ability to sync with student information systems, such as PowerSchool
    • Financial management, purchase details, and chargeback
    • Asset lifecycle management
    • 1:1 Chromebook distribution management
    • Repair programs and repair process management
    • Check-out/loan program management
    • Device distribution/allocation management, including barcode reader integration
    • Simple learning material distribution to the classroom for teachers
    • Facilitate GAC bulk operations
    • Manage inventory of non-IT assets such as projectors, TVs, and other educational assets
    • Plus more

    "There are many components to managing Chromebooks. Schools need to know which student has which device, which school has which device, and costs relating to repairs. Chromebook Management Software … facilitates these processes."
    – VIZOR

    MacBooks

    • MacBooks are gaining popularity in the Enterprise world.
    • Some admins claim MacBooks are less expensive in the long run over Windows-based PCs.
    • Users claim less issues when using a MacBook, and overall, companies report increased retention rates when users are using MacBooks.

    "Macs now make up 23% of endpoints in enterprises."
    – ComputerWeekly.com

    "When given the choice, no less than 72% of employees choose Macs over PCs."
    – "5 Reasons Mac is a must," Jamf

    "IBM says it is 3X more expensive to manage PCs than Macs."
    – Computerworld

    "74% of those who previously used a PC for work experienced fewer issues now that they use a Mac"
    – "Global Survey: Mac in the Enterprise," Jamf

    "When enterprise moves to Mac, staff retention rates improve by 20%. That's quite a boost! "
    – "5 Reasons Mac is a must," Jamf

    Managing MacBooks

    Can your existing UEM keep up?

    Many Windows unified endpoint management (UEM) tools can manage MacBooks, but most companies choose to use a dedicated MacBook management tool.

    • UEM tools that are primarily Windows focused do not typically go deep enough into the management capabilities of non-Windows devices.
    • Admins have noted limitations when it comes to using Windows UEM tools, and reasons they prefer a dedicated MacBook management solution include:
      • Easier to use
      • Faster response times when deploying settings and policies
      • Better control over notification settings and lock screen settings.
      • Easier Apple Business Manager (ABM) integration and provisioning.
    • Note that not every UEM will have the same limitations or advantages. Functionality is different between vendor products.

    Info-Tech Insight

    Most Windows UEM tools are constantly improving, and it is only a matter of time before they rival many of the dedicated MacBook management tools out there.

    Admins tend to agree that a Windows UEM is best for Windows while an Apple-based UEM is best for Apple devices.

    Managing MacBooks

    The market for "MacBook-first" management solutions includes a variety of players of varying ages such as:

    • Jamf
    • Kandji
    • Mosyle
    • SimpleMDM
    • Others

    MacBook-focused management tools can provide features such as:

    • Encryption and update settings
    • App deployment and lifecycle management
    • Remote device wipe, scan, shutdown, restart, and lock
    • Zero touch deployment and support
    • Location tracking
    • Browser content filtering
    • Enable, hide/block, or disable built-in features
    • Configure Wi-Fi, VPN, and certificate-based settings
    • Centralized dashboard with device and app listings as well as individual details
    • Data restrictions
    • Plus more

    Unified endpoint management (UEM) solutions that can provide MacBook management to some degree include (but are not limited to):

    • Intune
    • Ivanti
    • Endpoint Central
    • WorkspaceOne

    Dedicated solutions advocate integration with UEM solutions to take advantage of conditional access, security functionality, and data governance features.

    Jamf and Microsoft entered into a collaboration several years ago with the intention of making the MacBook management process easier and more secure.

    Microsoft Intune and Jamf Pro: Better together to manage and secure Macs
    Microsoft Conditional Access with Jamf Pro ensures that company data is only accessed by trusted users, on trusted devices, using trusted apps. Jamf extends this Enterprise Mobile + Security (EMS) functionality to Mac, iPhone and iPad.
    – "Microsoft Intune and Jamf Pro," Jamf

    Endpoint Management Selection Tool
    Activity

    There are many solutions available to manage end-user devices, and they come with a long list of options and features. Clarify your needs and define your requirements before you purchase another endpoint management tool. Don't purchase capabilities that you may never use.

    Use the Endpoint Management Selection Tool to identify your desired endpoint solution features and compare vendor solution functionality based on your desired features.

    1. List out the desired features you want in an endpoint solution for your devices and record those features in the first column. Use the features provided, or add your own and edit or delete the existing ones if necessary.
    2. List your selected endpoint management solution vendors in each of the columns in place of "Vendor 1," "Vendor 2," etc.
    3. Fill out the spreadsheet by changing the corresponding desired feature cell under each vendor to a "yes" or "no" based on your findings while investigating each vendor solution.
    4. When you have finished your investigation, review your spreadsheet to compare the various offerings and pros and cons of each vendor.
    5. Select your endpoint management solution.

    Endpoint Management Selection Tool

    In the first column, list out the desired features you want in an endpoint solution for your devices. Use the features provided if desired, or add your own and edit or delete the existing ones if necessary. As you look into various endpoint management solution vendors, list them in the columns in place of "Vendor 1," "Vendor 2," etc. Use the "Desired Feature" list as a checklist and change the values to "yes" or "no" in the corresponding box under the vendors' names. When complete, you will be able to look at all the features and compare vendors in a single table.

    Desired Feature Vendor 1 Vendor 2 Vendor 3
    Organizational unit creation Yes No Yes
    Group creation Yes Yes Yes
    Ability to assign users to devices No Yes Yes
    Control of administrative permissions Yes Yes Yes
    Conditional access No Yes Yes
    Security policies enforced Yes No Yes
    Asset management No Yes No
    Single sign-on Yes Yes Yes
    Auto-deployment No Yes No
    Repair lifecycle tracking No Yes No
    Application deployment Yes Yes No
    Device tracking Yes Yes Yes
    Ability to enable encryption Yes No Yes
    Device wipe Yes No Yes
    Ability to enable/disable device tracking No No Yes
    User activity audit No No No

    Related Info-Tech Research

    this is a screenshot from Info-Tech's Modernize and Transform Your End-User Computing Strategy.

    Modernize and Transform Your End-User Computing Strategy
    This project helps support the workforce of the future by answering the following questions: What types of computing devices, provisioning models, and operating systems should be offered to end users? How will IT support devices? What are the policies and governance surrounding how devices are used? What actions are we taking and when? How do end-user devices support larger corporate priorities and strategies?

    Best Unified Endpoint Management (UEM) Software 2022 | SoftwareReviews
    Compare and evaluate unified endpoint management vendors using the most in-depth and unbiased buyer reports available. Download free comprehensive 40+ page reports to select the best unified endpoint management software for your organization.

    Best Enterprise Mobile Management (EMM) Software 2022 | (softwarereviews.com)
    Compare and evaluate enterprise mobile management vendors using the most in-depth and unbiased buyer reports available. Download free comprehensive 40+ page reports to select the best enterprise mobile management software for your organization.

    Bibliography

    Bridge, Tom. "Macs in the enterprise – what you need to know". Computerweekly.com, TechTarget. 27 May 2022. Accessed 12 Aug. 2022.
    Copley-Woods, Haddayr. "5 reasons Mac is a must in the enterprise". Jamf.com, Jamf. 28 June 2022. Accessed 16 Aug. 2022.
    Duke, Kent. "Chromebook sales skyrocketed in Q3 2020 with online education fueling demand." androidpolice.com, Android Police. 16 Nov 2020. Accessed 10 Aug. 2022.
    Elgin, Mike. "Will Chromebooks Rule the Enterprise? (5 Reasons They May)". Computerworld.com, Computerworld. 30 Aug 2019. Accessed 10 Aug. 2022.
    Evans, Jonny. "IBM says it is 3X more expensive to manage PCs than Macs". Computerworld.com, Computerworld. 19 Oct 2016. Accessed 23 Aug. 2022.
    "Global Survey: Mac in the Enterprise". Jamf.com, Jamf. Accessed 16 Aug. 2022.
    "How to Manage Chromebooks Like a Pro." Vizor.cloud, VIZOR. Accessed 10 Aug. 2022.
    "Manage Chrome OS Devices with EMM Console". support.google.com, Google. Accessed 16 Aug. 2022.
    Protalinski, Emil. "Chromebooks outsold Macs worldwide in 2020, cutting into Windows market share". Geekwire.com, Geekwire. 16 Feb 2021. Accessed 22 Aug. 2022.
    Smith, Sean. "Microsoft Intune and Jamf Pro: Better together to manage and secure Macs". Jamf.com, Jamf. 20 April 2022. Accessed 16 Aug. 2022.

    Manage Third-Party Service Security Outsourcing

    • Buy Link or Shortcode: {j2store}539|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations
    • A lack of high-skill labor increases the cost of internal security, making outsourcing more appealing.
    • It is unclear what processes could or should be outsourced versus what functions should remain in-house.
    • It is not feasible to have 24/7/365 monitoring in-house for most firms.

    Our Advice

    Critical Insight

    • You are outsourcing support, not accountability, unless you preface that with your customer.
    • For most of you, you won’t have a choice – you’ll have to outsource high-end security skills to meet future needs.
    • Third-party service providers may be able to more effectively remediate threats because of their large, disparate customer base and wider scope.

    Impact and Result

    • Documented obligations and processes. This will allow you to determine which solution (outsourcing vs. insourcing) allows for the best use of resources, and maintains your brand reputation.
    • A list of variables and features to rank potential third-party providers vs. internal delivery to find which solution provides the best fit for your organization.
    • Current limitations of your environment and the limitations of third parties identified for the environments you are looking to mature.
    • Security responsibilities determined that can be outsourced, and which should be outsourced in order to gain resource allocation and effectiveness, and to improve your overall security posture.
    • The limitations or restrictions for third-party usage understood.

    Manage Third-Party Service Security Outsourcing Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to understand how to avoid common mistakes when it comes to outsourcing security, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. What to outsource

    Identify different responsibilities/functions in your organization and determine which ones can be outsourced. Complete a cost analysis.

    • Manage Third-Party Service Security Outsourcing – Phase 1: What to Outsource
    • Insourcing vs. Outsourcing Costing Tool

    2. How to outsource

    Identify a list of features for your third-party provider and analyze.

    • Manage Third-Party Service Security Outsourcing – Phase 2: How to Outsource
    • MSSP Selection Tool
    • Checklist for Third-Party Providers

    3. Manage your third-party provider

    Understand how to align third-party providers to your organization.

    • Manage Third-Party Service Security Outsourcing – Phase 3: Manage Your Third-Party Provider
    • Security Operations Policy for Third-Party Outsourcing
    • Third-Party Security Policy Charter Template
    [infographic]

    Develop Your Agile Approach for a Successful Transformation

    • Buy Link or Shortcode: {j2store}163|cart{/j2store}
    • member rating overall impact: 9.2/10 Overall Impact
    • member rating average dollars saved: $86,469 Average $ Saved
    • member rating average days saved: 16 Average Days Saved
    • Parent Category Name: Development
    • Parent Category Link: /development
    • Your organization wants to shorten delivery time and improve quality by adopting Agile delivery methods.
    • You know that Agile transformations are complex and difficult to implement.
    • Your organization may have started using Agile, but with only limited success.
    • You want to maximize your Agile transformation’s chances of success.

    Our Advice

    Critical Insight

    • Agile transformations are more likely to be successful when the entire organization understands Agile fundamentals, principles, and practices; the “different way of working” that Agile requires; and the role each person plays in its success.

    Impact and Result

    • Understand the “what and why” of Agile.
    • Identify your organization’s biggest Agile pain points.
    • Gain a deeper understanding of Agile principles and practices, and apply these to your Agile pain points.
    • Create a list of action items to address your organization’s Agile challenges.

    Develop Your Agile Approach for a Successful Transformation Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify common Agile challenges

    Identify your organization's biggest Agile pain points so you can focus attention on those topics that are impacting your Agile capabilities the most.

    • Develop Your Agile Approach for a Successful Transformation – Phases 1-2

    2. Establish a solid foundation for Agile delivery

    Ensure that your organization has a solid understanding of Agile principles and practices to help ensure your Agile transformation is successful. Understand Agile's different way of working and identify the steps your organization will need to take to move from traditional Waterfall delivery to Agile.

    • Roadmap for Transition to Agile

    3. Backlog Management Module: Manage your backlog effectively

    The Backlog Management Module helps teams develop a better understanding of backlog management and user story decomposition. Improve your backlog quality by implementing a three-tiered backlog with quality filters.

    4. Scrum Simulation Module: Simulate effective Scrum practices

    The Scrum Simulation Module helps teams develop a better understanding of Scrum practices and the behavioral blockers affecting Agile teams and organizational culture. This module features two interactive simulations to encourage a deeper understanding of good Scrum practices and Agile principles.

    • Scrum Simulation Exercise (Online Banking App)

    5. Estimation Module: Improve product backlog item estimation

    The Estimation Module helps teams develop a better understanding of Agile estimation practices and how to apply them. Teams learn how Agile estimation and reconciliation provide reliable planning estimates.

    6. Product Owner Module: Establish an Effective Product Owner Role

    The Product Owner Module helps teams understand product management fundamentals and a deeper understanding of the product owner role. Teams define their product management terminology, create quality filters for PBIs moving through the backlog, and develop their product roadmap approach for key audiences.

    7. Product Roadmapping Module: Create effective product roadmaps

    The Product Roadmapping Module helps teams understand product road mapping fundamentals. Teams learn to effectively use the six tools of Product Roadmapping.

    [infographic]

    Further reading

    Develop Your Agile Approach for a Successful Transformation

    Understand Agile fundamentals, principles, and practices so you can apply them effectively in your organization.

    Analyst Perspective

    Understand Agile fundamentals, principles, and practices so you can apply them effectively in your organization.

    Pictures of Alex Ciraco and Hans Eckman

    Alex Ciraco and Hans Eckman
    Application Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • Your organization wants to shorten delivery time and improve quality by adopting Agile delivery methods.
    • You know that Agile transformations are complex and difficult to implement.
    • Your organization may have started using Agile, but with only limited success.
    • You want to maximize your Agile transformation's chances of success.

    Common Obstacles

    • People seem to have different, conflicting, or inadequate knowledge of Agile principles and practices.
    • Your organization is not seeing the full benefits that Agile promises, and project teams aren't sure they are "doing Agile right."
    • Confusion and misinformation about Agile is commonplace in your organization.

    Info-Tech's Approach

    • Use our Common Agile Challenges Survey to identify your organization's Agile pain points.
    • Leverage this blueprint to level-set the organization on Agile fundamentals.
    • Address your survey's biggest Agile pain points to see immediate benefits and improvements in the way you practice Agile in your organization.

    Info-Tech Insight

    Agile transformations are more likely to be successful when the entire organization genuinely understands Agile fundamentals, principles and practices, as well as the role each person plays in its success. Focus on developing a solid understanding of Agile practices so your organization can "Be Agile", not just "Do Agile".

    Info-Tech's methodology

    1. Identify Common Agile Challenges

    2. Establish a Solid Foundation for Agile Delivery

    3. Agile Modules

    Phase Steps

    1.1 Identify common agile challenges

    2.1 Align teams with Agile fundamentals

    2.2 Interpret your common Agile challenges survey results

    2.3 (Optional) Move stepwise to iterative Agile delivery

    2.4 Identify insights and team feedback

    • Backlog Management Module:
      Manage Your Backlog Effectively
    • Scrum Simulation Module:
      Simulate Effective Scrum Practices
    • Estimation Module:
      Improve Product Backlog Item Estimation
    • Product Owner Module:
      Establish an Effective Product Owner Role
    • Product Roadmapping Module: Create Effective Product Roadmaps
    Phase Outcomes

    Understand common challenges associated with Agile transformations and identify your organization's struggles.

    Establish and apply a uniform understanding of Agile fundamentals and principles.

    Create a roadmap for your transition to Agile delivery and prioritized challenges.

    Foster deeper understanding of Agile principles and practices to resolve pain points.

    Develop your agile approach for a successful transformation

    Everyone's Agile journey is not the same.

    agile journey for a successful transformation

    Application delivery continues to fall short

    78% of IT professionals believe the business is "usually" or "always" out of sync with project requirements.
    Source: "10 Ways Requirements Can Sabotage Your Projects Right From the Start"

    Only 34% of software is rated as both important and effective by users.

    Source: Info-Tech's CIO Business Vision Diagnostic

    Agile DevOps is a progression of cultural, behavioral, and process changes. It takes time.

    An image of the trail to climb Mount Everest, with the camps replaced by the main steps of the agile approach to reaching Nirvana.

    Enhancements and maintenance are misunderstood

    an image showing the relationship between enhancements and maintenance.

    Source: "IEEE Transactions on Software Engineering"

    Why Agile/DevOps? It's about time to value

    Leaders and stakeholders are frustrated with long lead times to implement changes. Agile/DevOps promotes smaller, more frequent releases to start earning value sooner.

    A frequency graph showing the Time to delivering value depends on Frequency of Releases

    Time to delivering value depends on Frequency of Releases

    Embrace change, don't "scope creep" it

    64% of IT professionals adopt Agile to enhance their ability to manage changing priorities.

    71% of IT professionals found their ability to manage changing priorities improved after implementing Agile.

    Info-Tech Insight

    Traditional delivery processes work on the assumption that product requirements will remain constant throughout the SDLC. This results in delayed delivery of product enhancements which are critical to maintaining a positive customer experience.

    Adapted from: "12th Annual State of Agile Report"

    Agile's four core values

    "…while there is value in the items on the right, we value the items on the left more."
    – Source: "The Agile Manifesto"

    We value. . .

    Individuals and Interactions

    OVER

    Processes and Tools

    Working Software

    OVER

    Comprehensive Documentation

    Customer Collaboration

    OVER

    Contract Negotiation

    Responding to Change

    OVER

    Following a Plan

    Being Agile

    OVER

    Being Prescriptive

    Harness Agile's cultural advantages

    Collaboration

    • Team members leverage all their experience working toward a common goal.

    Iterations

    • Cycles provide opportunities for more product feedback.

    Continual Improvement

    • Self-managing teams continually improve their approach for the next iteration.

    Prioritization

    • The most important needs are addressed in the current iteration.

    Compare Waterfall and Agile – the "what" (how are they different?)

    This is an example of the Waterfall Approach.

    A "One and Done" Approach (Planning & Documentation Based)
    Elapsed time to deliver any value: Months to years

    This is an example of the Agile Approach

    An "Iterative" Approach (Empirical/Evidence Based)
    Elapsed time to deliver any value: Weeks

    Be aware of common myths around Agile

    1. … solve development and communication issues.
    2. … ensure you will finish requirements faster.
    3. … mean you don't need planning and documentation.

    "Although Agile methods are increasingly being adopted in globally distributed settings, there is no panacea for success."
    – "Negotiating Common Ground in Distributed Agile Development: A Case Study Perspective."

    "Without proper planning, organizations can start throwing more resources at the work which spirals into the classic Waterfall issues of managing by schedule."
    – Kristen Morton, Associate Implementation Architect,
    OneShield Inc., Info-Tech Interview

    Agile* SDLC

    With shared ownership instead of silos, we can deliver value at the end of every iteration (aka sprint)

    An image of the Agile SDLC Approach.

    * There are many Agile methodologies to choose from, but Scrum is by far the most widely used (and is shown above).

    Key Elements of the Agile SDLC

    • You are not "one-and-done." There are many short iterations with constant feedback.
    • There is an empowered product owner. This is a single authoritative voice that represents stakeholders.
    • There is a fluid product backlog. This enables prioritization of requirements "just-in-time."
    • Cross-functional, self-managing team. This team makes commitments and is empowered by the organization to do so.
    • Working, tested code at the end of each sprint. Value becomes more deterministic along sprint boundaries.
    • Demonstrate to stakeholders. Allow them to see and use the functionality and provide necessary feedback.
    • Feedback is being continuously injected back into the product backlog. This shapes the future of the solution.
    • Continuous improvement through sprint retrospectives.
    • "Internally Governed" when done right (the virtuous cycle of sprint-demo-feedback).

    A backlog stores and organizes PBIs at various stages of readiness

    A well-formed backlog can be thought of as a DEEP backlog:

    • Detailed Appropriately: Product backlog items (PBIs) are broken down and refined as necessary.
    • Emergent: The backlog grows and evolves over time as PBIs are added and removed.
    • Estimated: The effort a PBI requires is estimated at each tier.
    • Prioritized: The PBIs value and priority are determined at each tier.

    (Perforce, 2018)

    An image showing the Ideas; Qualified; Ready; funnel leading to the sprint approach.

    Outline the criteria to proceed to the next tier via quality filters

    Expand the concepts of defining "ready" and "done" to include the other stages of a PBIs journey through product planning.

    An image showing the approach you will use to Outline the criteria to proceed to the next tier via quality filters

    Info-Tech Insight: A quality filter ensures quality is met and teams are armed with the right information to work more efficiently and improve throughput.

    Deliverables

    Many steps in this blueprint are accompanied by supporting deliverables to help you accomplish your goals.

    Common Agile Challenges Survey
    Survey the organization to understand which of the common Agile challenges the organization is experiencing

    A screenshot from Common Agile Challenges Survey

    Roadmap for Transition to Agile
    Identify steps you will take to move your organization toward Agile delivery

    A screenshot from Roadmap for Transition to Agile

    Blueprint benefits

    IT Benefits

    Business Benefits

    • Consistent Agile delivery teams.
    • Delivery prioritized with business needs and committed work is achievable.
    • Improved ability to adjust future delivery cycles to meet changing business, market, and end-user needs.
    • Increased alignment and stability of resources with products and technology areas.
    • Reduction in the mean time to delivery of product backlog items.
    • Reduction in technical debt.
    • Better delivery alignment with enterprise goals, vision, and outcomes.
    • Improved coordination with product owners and stakeholders.
    • Quantifiable value realization following each release.
    • Product decisions made at the right time and with the right input.
    • Improved team morale and productivity.
    • Improved operational efficiency and process automation.
    • Increased employee retention and quality of new hires.
    • Reduction in accumulated project risk.

    Measure the value of this blueprint

    Implementing quality and consistent Agile practices improves SDLC metrics and reduces time to value.

    • Use Select and Use SDLC Metrics Effectivelyto track and measure the impact of Agile delivery. For example:
      • Reduction in PBI wait time
      • Improve throughput
      • Reduction in defects and defect severity
    • Phase 1 helps you prepare and send your Common Agile Challenges Survey.
    • Phase 2 builds a transformation plan aligned with your top pain points.

    Align Agile coaching and practices to address your key pain points identified in the Common Agile Challenges Survey.

    A screenshot from Common Agile Challenges Survey

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

    Guided Implementation

    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

    Workshop

    "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

    Consulting

    "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks used throughout all four options

    Guided Implementation

    What does a typical GI on this topic look like?

    This is an image of the eight calls which will take place over phases 1-3.

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is between 6 to 8 calls over the course of 1 to 2 months.

    Workshop Overview

    Contact your account representative for more information.
    workshops@infotech.com 1-888-670-8889

    Phases 1-2
    1.5 - 3.0 days estimated

    Backlog Management
    0.5 - 1.0 days estimated

    Scrum Simulation
    1.25 - 2.25 days estimated

    Estimation
    1.0 - 1.25 days estimated

    Product Owner
    1.0 - 1.75 days estimated

    Product Roadmapping
    0.5 - 1.0 days estimated

    Establish a Solid Foundation for Agile Delivery

    Define the
    IT Target State

    Assess the IT
    Current State

    Bridge the Gap and
    Create the Strategy

    Establish an Effective Product Owner Role

    Create Effective Product Roadmaps

    Activities

    1.1 Gather Agile challenges and gaps
    2.1 Align teams with Agile fundamentals
    2.2 Interpret your common Agile challenges survey results
    2.3 (Optional) Move stepwise to iterative Agile delivery
    2.4 Identify insights and team feedback

    1. User stories and the art of decomposition
    2. Effective backlog management and refinement
    3. Identify insights and team feedback
    1. Scrum sprint planning and retrospective simulation
    2. Pass the balls – sprint velocity game
    1. Improve product backlog item estimation
    2. Agile estimation fundamentals
    3. Understand the wisdom of crowds
    4. Identify insights and team feedback
    1. Understand product management fundamentals
    2. The critical role of the product owner
    3. Manage effective product backlogs and roadmaps
    4. Identify insights and team feedback
    1. Identify your product roadmapping pains
    2. The six "tools" of product roadmapping
    3. Product roadmapping exercise

    Deliverables

    1. Identify your organization's biggest Agile pain points.
    2. Establish common Agile foundations.
    3. Prioritize support for a better Agile delivery approach.
    4. Plan to move stepwise to iterative Agile delivery.
    1. A better understanding of backlog management and user story decomposition.
    1. Scrum sprint planning and retrospective simulation
    2. Pass the balls – sprint velocity game
    1. Improve product backlog item estimation
    2. Agile estimation fundamentals
    3. Understand the wisdom of crowds
    4. Identify insights and team feedback
    1. Understand product management fundamentals
    2. The critical role of the product owner
    3. Manage effective product backlogs and roadmaps
    4. Identify insights and team feedback
    1. Understand product vs. project orientation.
    2. Understand product roadmapping fundamentals.

    Agile Modules

    For additional assistance planning your workshop, please refer to the facilitation planning tool in the appendix.

    Related Info-Tech Research

    Mentoring for Agile Teams
    Get practical help and guidance on your Agile transformation journey.

    Implement DevOps Practices That Work
    Streamline business value delivery through the strategic adoption of DevOps practices.

    Deliver on Your Digital Product Vision
    Build a product vision your organization can take from strategy through execution.

    Deliver Digital Products at Scale
    Deliver value at the scale of your organization through defining enterprise product families.

    Phase 1

    Phase 1

    Phase 2

    Agile Modules

    1.1 Identify common Agile challenges

    2.1 Align teams with Agile fundamentals

    2.2 Interpret your common Agile challenges survey results

    2.3 (Optional) Move stepwise to iterative Agile delivery

    2.4 Identify insights and team feedback

    • Backlog Management Module: Manage Your Backlog Effectively
    • Scrum Simulation Module: Simulate Effective Scrum Practices
    • Estimation Module: Improve Product Backlog Item Estimation
    • Product Owner Module: Establish an Effective Product Owner Role
    • Product Roadmapping: Create Effective Product Roadmaps

    This phase will walk you through the following activities:

    • Decide who will participate in the Common Agile Challenges Survey
    • Compile the results of the survey to identify your organization's biggest pain points with Agile

    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Develop Your Agile Approach for a Successful Transformation

    Step 1.1

    Identify common Agile challenges

    Activities

    1.1 Distribute Common Agile Challenges Survey and collect results

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of your organization's Agile pain points.

    Focus Agile support where it is most needed

    A screenshot from Common Agile Challenges Survey

    Info-Tech Insight

    There isn't one approach that cures all the problems your Agile teams are facing. First, understand these common challenges, then develop a plan to address the root causes.

    Use Info-Tech's Common Agile Challenges Survey to determine common issues and what problems individual teams are facing. Use the Agile modules and supporting guides in this blueprint to provide targeted support on what matters most.

    Exercise 1.1.1 Distribute Common Agile Challenges Survey

    30 minutes

    1. Download Survey Template: Info-Tech Common Agile Challenges Survey template.
    2. Create your own local copy of the Common Agile Challenges Survey by using the template. The Common Agile Challenges Survey will help you to identify which of the many common Agile-related challenges your organization may be facing.
    3. Decide on the teams/participants who will be completing the survey. It is best to distribute the survey broadly across the organization and include participants from several teams and roles.
    4. Copy the link for your local survey and distribute it for participants to complete (we suggest giving them one week to complete it).
    5. Collect the consolidated survey results in preparation for the next phase.
    6. NOTE: Using this survey template requires having access to Microsoft Forms. If you do not have access to Microsoft Forms, an Info-Tech analyst can perform the survey for you.

    Output

    • Your organization's biggest Agile pain points

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Record the results in the Roadmap for Transition to Agile Template

    Phase 2

    Establish a Solid Foundation for Agile Delivery

    Phase 1

    Phase 2

    Agile Modules

    1.1 Identify common Agile challenges

    2.1 Align teams with Agile fundamentals

    2.2 Interpret your common Agile challenges survey results

    2.3 (Optional) Move stepwise to iterative Agile delivery

    2.4 Identify insights and team feedback

    • Backlog Management Module: Manage Your Backlog Effectively
    • Scrum Simulation Module: Simulate Effective Scrum Practices
    • Estimation Module: Improve Product Backlog Item Estimation
    • Product Owner Module: Establish an Effective Product Owner Role
    • Product Roadmapping: Create Effective Product Roadmaps

    This phase will walk you through the following activities:

    • Gain a fundamental understanding of Agile
    • Understand why becoming Agile is hard
    • Identify steps needed to become more Agile
    • Understand your biggest Agile pain points

    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Step 2.1

    Align teams with Agile fundamentals

    Activities

    2.1.1 Share what Agile means to you
    2.1.2 (Optional) Contrast two delivery teams
    2.1.3 (Optional) Dissect the Agilist's Oath
    2.1.4 (Optional) Create your prototype definitions of ready
    2.1.5 (Optional) Create your prototype definitions of done
    2.1.6 Identify the challenges of implementing agile in your organization

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of what Agile is and why we do it.

    Exercise 2.1.1 Share what Agile means to you

    30-60 minutes

    1. What is Agile? Why do we do it?
    2. As a group, discuss and capture your thoughts on:
      1. What is Agile (its characteristics, practices, differences from alternatives, etc.)?
      2. Why do we do it (its drivers, benefits, advantages, etc.)?
    3. Capture your findings in the table below:

    What is Agile?

    Why do we do it?

    (e.g. Agile mindset, principles, and practices)

    (e.g. benefits)

    Output

    • Your current understanding of Agile and its benefits

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Why Agile/DevOps? It's about time to value

    Leaders and stakeholders are frustrated with long lead times to implement changes. Agile/DevOps promotes smaller, more frequent releases to start earning value sooner.

    A graph demonstrating the increased frequency of release expected over time, from 1960 - present

    Time to delivering value depends on frequency of releases.
    Source: 5Q Partners

    The pandemic accelerated the speed of digital transformation

    With the massive disruption preventing people from gathering, businesses shifted to digital interactions with customers.

    December 2019 - 36%; acceleration of 3 years; July 2020 - 58%.

    Companies also accelerated the pace of creating digital or digitally enhanced products and services.

    December 2019 - 35%; acceleration of 3 years; July 2020 - 55%.

    (McKinsey, 2020 )

    "The Digital Economy incorporates all economic activity reliant on or significantly enhanced by the use of digital inputs, including digital technologies, digital infrastructure, digital services and data."
    (OECD Definition)

    What does "elite" DevOps look like?

    This is an image of an annotated table showing what elite devops looks like.

    Where are you now?
    Where do You Want to Be?

    * Google Cloud/Accelerate State of DevOps 2021

    Realize and sustain value with DevOps

    Businesses with elite DevOps practices…

    973x more frequent faster lead time code deployments from commit to deploy, 3x 6570x lower change failure rate faster time to recover.

    Waterfall vs. Agile – the "what" (How are they different?)

    This is an example of the Waterfall Approach.

    A "One and Done" Approach (Planning & Documentation Based)
    Elapsed time to deliver any value: Months to years

    This is an example of the Agile Approach

    An "Iterative" Approach (Empirical/Evidence Based)
    Elapsed time to deliver any value: Weeks

    (Optional) Exercise 2.1.2 A tale of two teams

    Discussion (5-10 minutes)

    As a group, discuss how these teams differ

    Team 1:
    An image of the business analyst passing the requirements baton to the architect runner.

    Team 2:
    An image of team of soldiers carrying a heavy log up a beach

    Image Credit: DVIDS

    Discuss differences between these teams:
    • How are they different?
    • How would you coach/train/manage/lead?
    • How does team members' behavior differ?
    • How would you measure each team?
    What would have to happen at your organization to make working like this possible?

    Output

    • How your organization can support Agile behavior and mindset

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Dissect the Agilist's Oath

    Read and consider each element of the oath.

    • As a member of this Scrum team, I recognize that we are all equally and collectively responsible for the success of this project.
    • Success is defined as achieving the best possible outcome for our stakeholders given the constraints of time, money, and circumstances we will face.
    • We will achieve this by working collaboratively with our product owner to regularly deliver high-quality, working, tested code that can be demonstrated, and we will adjust our path forward based on the feedback we receive.
    • I will holistically embrace the concept of "good enough for now" into my work practices, because I know that waiting for the best/perfect solution does not yield optimal results.
    • Collectively, we will work to holistically minimize risk for the project across all phases and disciplines.
    • My primary role will be _____ [PO, SM, BA, Dev, Arch, Test, Ops, etc.], but I will contribute wherever and however best serves the current needs of the project.
    • I recognize that working in Agile/Scrum is not an excuse to ignore important things like adequate design and documentation. Collectively, we will ensure that these things are completed incrementally to a level of detail and quality which adequately serves the organization and stakeholders.
    • We are a team, and we will succeed or fail as one.

    Exercise 2.1.3 (Optional) Dissect the Agilist's Oath

    30 minutes

    1. Each bullet point in the Agilist's Oath is chosen to convey one of eight key messages about Agile practices and the mindset change that's required by everyone involved.
    2. As a group, discuss the "message" for each bullet point in the Agilist's Oath. Then identify which of them would be "easy" and "hard" to achieve in your organization.
    • As a member of this Scrum team, I recognize that we are all equally and collectively responsible for the success of this project.
    • Success is defined as achieving the best possible outcome for our stakeholders given the constraints of time, money, and circumstances we will face.
    • We will achieve this by working collaboratively with our product owner to regularly deliver high-quality, working, tested code that can be demonstrated, and we will adjust our path forward based on the feedback we receive.
    • I will holistically embrace the concept of "good enough for now" into my work practices, because I know that waiting for the best/perfect solution does not yield optimal results.
    • Collectively, we will work to holistically minimize risk for the project across all phases and disciplines.
    • My primary role will be _____ [PO, SM, BA, Dev, Arch, Test, Ops, etc.], but I will contribute wherever and however best serves the current needs of the project.
    • I recognize that working in Agile/Scrum is not an excuse to ignore important things like adequate design and documentation. Collectively, we will ensure that these things are completed incrementally to a level of detail and quality which adequately serves the organization and stakeholders.
    • We are a team, and we will succeed or fail as one.

    Which aspects of the Agilist's Oath are "easy" in your org?

    Which aspects of the Agilist's Oath are "hard" in your org?

    Output

    • How your organization can support Agile behavior and mindset

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Be aware of common myths around Agile

    Agile does not . . . .

    1. … solve development and communication issues.
    2. … ensure you will finish requirements faster.
    3. … mean you don't need planning and documentation.

    "Although Agile methods are increasingly being adopted in globally distributed settings, there is no panacea for success."
    – "Negotiating Common Ground in Distributed Agile Development: A Case Study Perspective."

    "Without proper planning, organizations can start throwing more resources at the work which spirals into the classic Waterfall issues of managing by schedule."
    – Kristen Morton, Associate Implementation Architect,
    OneShield Inc., Info-Tech Interview

    Agile's four core values

    "…while there is value in the items on the right, we value the items on the left more."
    – Source: "The Agile Manifesto"

    We value. . .

    Individuals and Interactions

    OVER

    Processes and Tools

    Working Software

    OVER

    Comprehensive Documentation

    Customer Collaboration

    OVER

    Contract Negotiation

    Responding to Change

    OVER

    Following a Plan

    Being Agile

    OVER

    Being Prescriptive

    Consider the traditional/Waterfall SDLC

    With siloes and handoffs, valuable product is delivered only at the end of an extended project lifecycle.

    This is an image of the Traditional Waterfall SDLC approach

    View additional transition models in the appendix

    Agile* SDLC

    With shared ownership instead of silos, we can deliver value at the end of every iteration (aka sprint)

    Key Elements of the Agile SDLC

    • You are not "one-and-done". There are many short iterations with constant feedback.
    • There is an empowered product owner. This is a single authoritative voice that represents stakeholders.
    • There is a fluid product backlog. This enables prioritization of requirements "just-in-time"
    • Cross-functional, self-managing team. This team makes commitments and is empowered by the organization to do so.
    • Working, tested code at the end of each sprint. Value becomes more deterministic along sprint boundaries.
    • Demonstrate to stakeholders. Allow them to see and use the functionality and provide necessary feedback.
    • Feedback is being continuously injected back into the product backlog. This shapes the future of the solution.
    • Continuous improvement through sprint retrospectives.
    • "Internally Governed" when done right (the virtuous cycle of sprint-demo-feedback).

    This is a picture of the Agile SDLC approach.

    * There are many Agile methodologies to choose from, but Scrum (shown above) is by far the most widely used.

    Scrum roles and responsibilities

    Product Owner

    Scrum Master

    Team Members

    Responsible

    • For identifying the product features and their importance in the final deliverable.
    • For refining and reprioritizing the backlog that identifies which features will be delivered in the next sprint based on business importance.
    • For clearing blockers and escalations when necessary.
    • For leading scrums, retrospectives, sprint reviews, and demonstrations.
    • For team building and resolving team conflicts.
    • For creating, testing, deploying, and supporting deliverables and valuable features.
    • For self-managing. There is no project manager assigning tasks to each team member.

    Accountable

    • For delivering valuable features to stakeholders.
    • For ensuring communication throughout development.
    • For ensuring high-quality deliverables for the product owner.

    Consulted

    • By the team through collaboration, rather than contract negotiation.
    • By the product owner on resolution of risks.
    • By the team on suggestions for improvement.
    • By the scrum master and product owner during sprint planning to determine level of complexity of tasks.

    Informed

    • On the progress of the current sprint.
    • By the team on work completed during the current sprint.
    • On direction of the business and current priorities.

    Scrum ceremonies

    Are any of these challenges for your organization? Done When:

    Project Backlog Refinement (PO & SM): Prepare user stories to be used in the next two to three future sprints. User stories are broken down into small manageable pieces of work that should not span sprints. If a user story is too big for a sprint, it is broken down further here. The estimation of the user story is examined, as well as the acceptance criteria, and each is adjusted as necessary from the Agile team members' input.

    Regularly over the project's lifespan

    Sprint Planning (PO, SM & Delivery Team): Discuss the work for the upcoming sprint with the business. Establish a clear understanding of the expectations of the team and the sprint. The product owner decides if priority and content of the user stories is still accurate. The development team decides what they believe can be completed in the sprint, using the user stories, in priority order, refined in backlog refinement.

    At/before the start of each sprint

    Daily Stand-Up (SM & Delivery Team): Coordinate the team to communicate progress and identify any roadblocks as quickly as possible. This meeting should be kept to fifteen minutes. Longer conversations are tabled for a separate meeting. These are called "stand-ups" because attendees should stay standing for the duration, which helps keep the meeting short and focused. The questions each team member should answer at each meeting: What did I do since last stand-up? What will I do before the next stand-up? Do I have any roadblocks?

    Every day during the sprint

    Sprint Demo (PO, SM, Delivery Team & Stakeholders): Review and demonstrate the work completed in the sprint with the business (demonstrate working and tested code which was developed during the sprint and gather stakeholder feedback).

    At the end of each sprint

    Sprint Retrospective (SM & Delivery Team & PO): Discuss how the sprint worked to determine if anything can be changed to improve team efficiency. The intent of this meeting is not to find/place blame for things that went wrong, but instead to find ways to avoid/alleviate pain points.

    At the end of each sprint

    Sample delivery sprint calendar

    The following calendar illustrates a two-week Scrum cadence (including ceremonies). This diagram is for illustrative purposes only. The length of the sprint and timing of ceremonies may differ from delivery team to delivery team based on their needs and schedules.

    An image of a sample sprint delivery calendar

    Sample delivery sprint calendar

    The following calendar illustrates a three-week Scrum cadence (including ceremonies). This diagram is for illustrative purposes only. The length of the sprint and timing of ceremonies may differ from delivery team to delivery team based on their needs and schedules.

    An image of a sample sprint delivery calendar

    Ensure your teams have the right information

    Implement and enforce your definition of ready at each stage of planning. Ensure your teams understand the required tasks by clarifying the definition of done.*

    Ready

    Done
    • The request has a defined problem, and the value is understood.
    • The request is documented, and the owner is identified.
    • Business and IT roles are committed to participating in estimation and planning activities.
    • Estimates and plans are made and validated with IT teams and business representatives.
    • Stakeholders and decision makers accept the estimates and plans as well as the related risks.
    • Estimates and plans are documented and slated for future review.

    * Note that your definitions of ready and done may vary from project to project, and they should be decided on collectively by the delivery team at the beginning of the project (part of setting their "norms") and updated if/when needed.

    Exercise 2.1.4 (Optional) Create definition of ready and done for an oil change

    10-15 minutes

    Step 1:

    1. As a group, create a definition of ready and done for doing an oil change (this will help you to understand the nature and value of a definition of ready and done using a relatable example):

    Definition of Ready

    Checklist:

    Definition of Done

    Checklist – For each user story:

    The checklist of things that must be true/done to begin the oil change.

    • We have the customer's car and keys
    • We know which grade of oil the customer wants

    The checklist of things that must be true/done at the end of the oil change.

    • The oil has been changed
    • A reminder sticker has been placed on windshield

    Exercise 2.1.4 (Optional) Create your prototype definitions of ready

    30-60 minutes

    Step 2:

    1. As a group, review the two sample definitions of ready below and select the one you consider to be the best starting point for your prototype definition of ready.

    Definition of Ready SAMPLE 1:

    Checklist – For each user story:

    • Technical and business risks are identified.
    • Resources are available for development.
    • Story has been assigned to a sprint/iteration.
    • Organizational business value is defined.
    • A specific user has been identified.
    • Stakeholders and needs defined.
    • Process impacts are identified.
    • Data needs are defined.
    • Business rules and non-functional requirements are identified.
    • Acceptance criteria are ready.
    • UI design work is ready.
    • Story has been traced to the project, epic, and sprint goal.

    Definition of Ready SAMPLE 2:

    Checklist – For each user story:

    • The value of story to the user is clearly indicated.
    • The acceptance criteria for story have been clearly described.
    • User story dependencies identified.
    • User story sized by delivery team.
    • Scrum team accepts user experience artifacts.
    • Performance criteria identified, where appropriate.
    • Person who will accept the user story is identified.
    • The team knows how to demo the story.

    Output

    • Prototype definitions of ready and done for your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.1.4 (Optional) Create your prototype definitions of ready

    30-60 minutes

    Step 3:

    1. As a group, using the selected sample as your starting point, decide what changes need to be made (keep/add/delete/modify):

    Definition of Ready Checklist – For each user story:

    Disposition

    The value of story to the user is clearly indicated.

    Keep as is

    The acceptance criteria for story have been clearly described. Keep as is
    User story dependencies identified. Modify to: "Story has been traced to the project, epic, and sprint goal"
    User story sized by delivery team. Modify to: "User Stories have been sized by the Delivery team using Story Points"
    Scrum team accepts user experience artifacts. Keep as is
    Performance criteria identified, where appropriate. Keep as is
    Person who will accept the user story is identified.

    Delete

    The team knows how to demo the story. Keep as is

    Add: "Any performance related criteria have been identified where appropriate"

    Add: "Any data model related changes have been identified where needed"

    Output

    • Prototype definitions of ready and done for your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.1.4 (Optional) Create your prototype definitions of ready

    30-60 minutes

    Step 4:

    1. As a group, capture and agree on your prototype definition of ready*:

    Definition of Ready

    Checklist – For each user story:

    User stories and related requirements contain clear descriptions of what is expected of a given functionality. Business value is identified.

    • The value of the story to the user is clearly indicated.
    • The acceptance criteria for the story have been clearly described.
    • Story has been traced to the project, epic, and sprint goal.
    • User stories have been sized by the delivery team using story points.
    • Scrum team accepts user experience artifacts.
    • Performance criteria identified, where appropriate.
    • The team knows how to demo the story.
    • Any performance-related criteria have been identified where appropriate.
    • Any data-model-related changes have been identified where needed.

    Record the results in the Roadmap for Transition to Agile Template

    * This checklist helps Agile teams determine if the stories in their backlog are ready for sprint planning. As your team gains experience with Agile, tailor this list to your needs and follow it until the practice becomes second nature.

    Output

    • Prototype definitions of ready and done for your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.1.5 (Optional) Create your prototype definitions of done

    30-60 minutes

    Step 5:

    1. As a group, review the two sample definitions of ready below and select the one you consider to be the best starting point for your prototype definition of ready:

    SAMPLE 1:

    Definition of Done Checklist – For each user story:

    • Design complete
    • Code compiles
    • Static code analysis has been performed and passed
    • Peer reviewed with coding standards passed
    • Code merging completed
    • Unit tests and smoke tests are done/functional (preferably automated)
    • Meets the steps identified in the user story
    • Unit & QA test passed
    • Usability testing completed
    • Passes functionality testing including security testing
    • Data validation has been completed
    • Ready to be released to the next stage

    SAMPLE 2:

    Definition of Done Checklist – For each user story:

    • Work was completed in a way that a professional would say they are satisfied with their work.
    • Work has been seen by multiple team members.
    • Work meets the criteria of satisfaction described by the customer.
    • The work is part of a package that will be shared with the customer as soon as possible.
    • The work and any learnings from doing the work have been documented.
    • Completion of the work is known by and visible to all team members.
    • The work has passed all quality, security, and completeness checks as defined by the team.

    Output

    • Prototype definitions of ready and done for your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.1.4 (Optional) Create your prototype definitions of done

    30-60 minutes

    Step 6:

    1. As a group, using the selected sample as your starting point, decide what changes need to be made (keep/add/delete/modify):

    Definition of Ready Checklist – For each user story:

    Disposition

    • Work was completed in a way that a professional would say they are satisfied with their work.
    Keep as is
    • Work has been seen by multiple team members.
    Delete
    • Work meets the criteria of satisfaction described by the customer.
    Modify to: "All acceptance criteria for the user story have been met"
    • The work is a part of a package that will be shared with the customer as soon as possible.
    Modify to: "The user story is ready to be demonstrated to Stakeholders"
    • The work and any learnings from doing the work has been documented.
    Keep as is
    • Completion of the work is known by and visible to all team members.
    Keep as is
    • The work has passed all quality, security, and completeness checks as defined by the team.
    Modify to: "Unit, smoke and regression testing has been performed (preferably automated), all tests were passed"
    Add: "Any performance related criteria associated with the story have been met"

    Output

    • Prototype definitions of ready and done for your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.1.4 (Optional) Create your prototype definitions of done

    30-60 minutes

    Step 7:

    1. As a group, capture and agree on your prototype Definition of Done*:

    Definition of Done

    Checklist – For each user story:

    When the user story is accepted by the product owner and is ready to be released.

    • Work was completed in a way that a professional would say they are satisfied with their work.
    • All acceptance criteria for the user story have been met.
    • The user story is ready to be demonstrated to stakeholders.
    • The work and any learnings from doing the work have been documented.
    • Completion of the work is known by and visible to all team members.
    • Unit, smoke, and regression testing has been performed (preferably automated), and all tests were passed.
    • Any performance-related criteria associated with the story have been met.

    Record the results in the Roadmap for Transition to Agile Template

    * This checklist helps Agile teams determine if the stories in their backlog are ready for sprint planning. As your team gains experience with Agile, tailor this list to your needs and follow it until the practice becomes second nature.

    Output

    • Prototype definitions of ready and done for your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Getting to "Agile DevOps Nirvana" is hard, but it's worth it.

    An image of the trail to climb Mount Everest, from camps 1-4

    Agile DevOps is a progression of cultural, behavioral, and process changes.
    It takes time.

    An image of the trail to climb Mount Everest, with the camps replaced by the steps to deploy Agile, to reach Agile/Devops Nirvana

    Agile DevOps may be hard, but it's worth it…

    It turns out Waterfall is not as good at reducing risk and ensuring delivery after all.

    CHAOS RESOLUTION BY AGILE VERSUS WATERFALL
    Size Method Successful Challenged Failed
    All Size Projects Agile 39% 52% 9%
    Waterfall 11% 60% 29%

    Standish Group; CHAOS REPORT 2015

    "I believe in this [Waterfall] concept, but the implementation described above is risky and invites failure."

    – Winston W. Royce

    Compare Waterfall to Agile

    Waterfall

    Agile

    Roles and Responsibilities

    Silo your resources

    Defined/segregated responsibilities

    Handoffs between siloes via documents

    Avoid siloes

    Collective responsibility

    Transitions instead of handoffs

    Belief System

    Trust the process

    Assign tasks to individuals

    Trust the delivery team

    Assign ownership/responsibilities to the team

    Planning Approach

    Create a detailed plan before work begins

    Follow the plan

    High level planning only

    The plan evolves over project lifetime

    Delivery Approach

    One and done (big bang delivery at end of project)

    Iterative delivery (regularly demonstrate working code)

    Governance Approach

    Phases and gates

    Artifacts and approvals

    Demo working tested code and get stakeholder feedback

    Support delivery team and eliminate roadblocks

    Approach to Stakeholders

    Involved at beginning and end of project

    "Arm's length" relationship with delivery team

    Involved throughout project (sprint by sprint)

    Closely involved with delivery team (through full time PO)

    Approach to Requirements/Scope

    One-time requirements gathering at start of project

    Scope is fixed at beginning of project ("carved in stone")

    On going requirements gathering and refinement over time

    Scope is roughly determined at beginning (expect change)

    Approach to Changing Requirements

    Treats change like it is "bad"

    Onerous CM process (discourages change)

    Scope changes "require approval" and are disruptive

    Accepts change as natural part of development.

    Light Change Management process (change is welcome)

    Scope changes are handled like all changes

    Hybrid SDLC: Wagile/Agilfall/WaterScrumFall

    Valuable product delivered in multiple releases

    A picture of a hybrid waterfall - Agile approach.

    If moving directly from Waterfall to Agile is too much for your organization, this can be a valuable interim step (but it won't give you the full benefits of Agile, so be careful about getting stuck here).

    Exercise 2.1.6 Identify the challenges of implementing Agile in your organization

    30-60 minutes

    1. As a group, discuss:
      1. Why being Agile may be difficult in your organization?
      2. What are some of the roadblocks and speed bumps you may face?
      3. What incremental steps might the organization take toward becoming Agile?

    Record the results in the Roadmap for Transition to Agile Template

    Output

    • Why being Agile is hard in your organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Step 2.2

    Align teams with Agile fundamentals

    Activities

    2.2.1 Review the results of your Common Agile Challenges Survey (30-60 minutes)
    2.2.2 Align your support with your top five challenges

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify your organization's biggest Agile pain points.

    Be aware of common Agile challenges

    The road to Agile is filled with potholes, speedbumps, roadblocks, and brick walls!

    1. Establish an effective product owner role (PO)
    2. Uncertainty about minimum viable product (MVP)
    3. How non-Agile teams (like architecture, infosec, operations, etc.) work with Agile teams
    4. Project governance/gating process
    5. What is the role of a PM/PMO in Agile?
    6. How to budget/plan Agile projects
    7. How to contract and work with an Agile vendor
    8. An Agile skills deficit (e.g. new-to-Agile teams who have difficulty "doing Agile right")
    9. General resistance to change in the organization
    10. Lack of Agile training, piloting, and coaching
    11. Different Agile approaches are used by different teams
    12. Backlog management and user story decomposition challenges
    13. Quality assurance challenges
    14. Hierarchical management practices and organization boundaries
    15. Difficulty with establishing autonomous Agile teams
    16. Lack of management support for Agile
    17. Poor Agile estimation practices
    18. Difficulty creating effective product roadmaps in Agile
    19. How do we know when an Agile project is ready to go live?
    20. Sprint goals are not being consistently met, or sprint deliverables that are full of bugs

    Exercise 2.2.1 Review the results of your Common Agile Challenges Survey

    30-60 minutes

    1. Using the results of your Common Agile Challenges Survey, fill in the bar chart with your top five pain points:

    A screenshot from Common Agile Challenges Survey

    Output

    • Your organization's biggest Agile pain points identified and prioritized

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.2.2 Align your support with your top five challenges

    30 minutes

    Using the Agile Challenges support mapping on the following slides, build your transformation plan and supporting resources. You can build your plan by individual team results or as an enterprise approach.

    Priority Agile Challenge Module Name and Sequence
    1
    1. Agile Foundations
    2. ?
    2
    1. Agile Foundations
    2. ?
    3
    1. Agile Foundations
    2. ?
    4
    1. Agile Foundations
    2. ?
    5
    1. Agile Foundations
    2. ?

    Output

    • Your organization's Agile Challenges transformation plan

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Map challenges to supporting modules

    Agile Challenges

    Supporting Resources

    Difficulty establishing an effective product owner (PO) or uncertainty about the PO role

    Modules:

    • Agile Foundations
    • Establish an Effective Product Owner Role
    Uncertainty about minimum viable product (MVP) and how to identify your MVP

    Modules:

    • Agile Foundations
    • Simulate Effective Scrum Practices
    How non-Agile teams (like architecture, info sec, operations, etc.) work with Agile teams

    Modules:

    • Agile Foundations
    • Work With Non-Agile Teams (Future)
    Project Governance/Gating processes that are unfriendly to Agile

    Modules:

    • Agile Foundations
    • Establish Agile-Friendly Gating (Future)
    Uncertainty about the role of a PM/PMO in Agile

    Modules:

    • Agile Foundations
    • Understand the role of PM/PMO in Agile Delivery (Future)
    Uncertainty about how to budget/plan Agile projects

    Modules:

    • Agile Foundations
    • Simulate Effective Scrum Practices
    • Understand Budgeting and Funding for Agile Delivery (Future)
    Creating an Agile friendly RFP/Contract (e.g. how to contract and work with an Agile vendor)

    Modules:

    • Agile Foundations
    • Work Effectively with Agile Vendors (Future)

    Note: Modules listed as (Future) are in development and may be available in draft format.

    Map challenges to supporting modules

    Agile Challenges

    Supporting Resources

    An Agile skills deficit (e.g. new-to-Agile teams who have difficulty "doing Agile right")

    Modules:

    • Agile Foundations
    General resistance in the organization to process changes required by Agile

    Modules:

    • Agile Foundations
    • Manage Organizational Change to Support Agile Delivery (Future)
    Lack of Agile training, piloting and coaching being offered by the organization

    Modules:

    • Agile Foundations
    Different Agile approaches are used by different teams, making it difficult to work together

    Modules:

    • Agile Foundations
    • Build Your Scrum Playbook (Future)
    Backlog management challenges (e.g. how to manage a backlog, and make effective use of Epics, Features, User Stories, Tasks and Bugs)

    Modules:

    • Agile Foundations
    • Manage Your Backlog Effectively
    Quality Assurance challenges (testing not being done well on Agile projects)

    Modules:

    • Agile Foundations
    • Establish Effect Quality Assurance for Agile Delivery (Future);
    • Use Test Automation Effectively (Future)
    Hierarchical management practices and organization boundaries make it difficult to be Agile

    Modules:

    • Agile Foundations
    • Manage Organizational Change to Support Agile Delivery (Future)

    Note: Modules listed as (Future) are in development and may be available in draft format.

    Map challenges to supporting modules

    Agile Challenges

    Supporting Resources

    Difficulty with establishing autonomous Agile teams (self managing, cross functional teams that are empowered by the organization to deliver)

    Modules:

    • Agile Foundations
    • Manage Organizational Change to Support Agile Delivery (Future)
    Lack of management support for Agile

    Modules:

    • Agile Foundations
    • Manage Organizational Change to Support Agile Delivery (Future)
    Poor understanding of Agile estimation techniques and how to apply them effectively

    Modules:

    • Agile Foundations
    • Estimation Module
    Difficulty creating effective product roadmaps in Agile

    Modules:

    • Agile Foundations
    • Product Roadmapping Tool
    How do we know when an Agile project is ready to go live

    Modules:

    • Agile Foundations
    • Decide When to Go Live (Future)
    Sprint goals are not being consistently met, or Sprint deliverables that are full of bugs

    Modules:

    • Agile Foundations
    • Establish Effect Quality Assurance for Agile Delivery (Future);
    • Use Test Automation Effectively (Future)

    Note: Modules listed as (Future) are in development and may be available in draft format.

    Map challenges to supporting blueprints

    Agile Challenges

    Supporting Resources

    Difficulty establishing an effective product owner (PO) or uncertainty about the PO role

    Blueprints: Build a Better Product Owner; Managing Requirements in an Agile Environment

    Uncertainty about minimum viable product (MVP) and how to identify your MVP

    Blueprints: Deliver on Your Digital Product Vision; Managing Requirements in an Agile Environment

    How non-Agile teams (like architecture, info sec, operations, etc.) work with Agile teams

    Blueprints: Create a Horizontally Optimized SDLC to Better Meet Business Demands, Extend Agile Practices Beyond IT, Implement DevOps Practices That Work; Build Your BizDevOps Playbook, Embed Security into the DevOps Pipeline

    Project Governance/Gating processes that are unfriendly to Agile

    Blueprints: Streamline Your Management Process to Drive Performance, Drive Business Value With a Right-Sized Project Gating Process

    Uncertainty about the role of a PM/PMO in Agile

    Blueprints: Define the Role of Project Management in Agile and Product-Centric Delivery, Create a Horizontally Optimized SDLC to Better Meet Business Demands

    Uncertainty about how to budget/plan Agile projects

    Blueprints: Identify and Reduce Agile Contract Risk

    Creating an Agile friendly RFP/Contract (e.g. how to contract and work with an Agile vendor)

    Blueprints: Identify and Reduce Agile Contract Risk

    Note: Modules listed as (Future) are in development and may be available in draft format.

    Map challenges to supporting blueprints

    Agile Challenges

    Supporting Resources

    An Agile skills deficit (e.g. new-to-Agile teams who have difficulty "doing Agile right")

    Blueprints: Perform an Agile Skills Assessment; Mentoring for Agile Teams

    General resistance in the organization to process changes required by Agile

    Blueprints: Master Organizational Change Management Practices

    Lack of Agile training, piloting and coaching being offered by the organization

    Blueprints: Perform an Agile Skills Assessment; Mentoring for Agile Teams

    Different Agile approaches are used by different teams, making it difficult to work together

    Blueprints: Create a Horizontally Optimized SDLC to Better Meet Business Demands, Extend Agile Practices Beyond IT

    Backlog management challenges (e.g. how to manage a backlog, and make effective use of epics, features, user stories, tasks and bugs)

    Blueprints: Deliver on Your Digital Product Vision, Managing Requirements in an Agile Environment

    Quality Assurance challenges (testing not being done well on Agile projects)

    Blueprints: Build a Software Quality Assurance Program, Automate Testing to Get More Done

    Hierarchical management practices and organization boundaries make it difficult to be Agile

    Blueprints: Master Organizational Change Management Practices

    Map challenges to supporting blueprints

    Agile Challenges

    Supporting Resources

    Difficulty with establishing autonomous Agile teams (self managing, cross functional teams that are empowered by the organization to deliver)

    Blueprints: Master Organizational Change Management Practices

    Lack of management support for Agile

    Blueprints: Master Organizational Change Management Practices

    Poor understanding of Agile estimation techniques and how to apply them effectively

    Blueprints: Estimate Software Delivery with Confidence, Managing Requirements in an Agile Environment

    Difficulty creating effective product roadmaps in Agile

    Blueprints: Deliver on Your Digital Product Vision

    How do we know when an Agile project is ready to go live

    Blueprints: Optimize Applications Release Management,Drive Business Value With a Right-Sized Project Gating Process, Managing Requirements in an Agile Environment

    Sprint goals are not being consistently met, or sprint deliverables that are full of bugs

    Blueprints: Build a Software Quality Assurance Program, Automate Testing to Get More Done, Managing Requirements in an Agile Environment

    Step 2.3

    Move stepwise to iterative Agile delivery (Optional)

    Activities

    2.3.1 (Optional) Identify a hypothetical project
    2.3.2 (Optional) Capture your traditional delivery approach
    2.3.3 (Optional) Consider what a two-phase delivery looks like
    2.3.4 (Optional) Consider what a four-phase delivery looks like
    2.3.5 (Optional) Consider what a four-phase delivery with monthly sprints looks like
    2.3.6 (Optional) Decide on your target state and the steps required to get there

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Understand the changes that must take place in your organization to support a more Agile delivery approach.

    Moving stepwise from traditional to Agile

    Your transition to Agile and more frequent releases doesn't need to be all at once. Organizations may find it easier to build toward smaller iterations.

    An image of the stepwise approach to adopting Agile.

    Exercise 2.3.1 (Optional) Identify a hypothetical project

    15-30 minutes

    1. As a group, consider some typical, large, mission-critical system deliveries your organization has done in the past (name a few as examples).
    2. Imagine a project like this has been assigned to your team, and the plan calls for delivering the system using your traditional delivery approach and taking two years to complete.
    3. Give this imaginary project a name (e.g. traditional project, our project).

    Name of your imaginary 2-year long project:

    e.g. Big Bang ERP

    Brief Project Description:

    e.g. Replace home-grown legacy ERP with a modern COTS product in a single release scheduled to be delivered in 24 months

    Record this in the Roadmap for Transition to Agile Template

    Info-Tech Best Practice

    For best results, complete these sub-exercises with representatives from as many functional areas as possible
    (e.g. stakeholders, project management, business analysis, development, testing, operations, architecture, infosec)

    Output

    • An imaginary delivery project that is expected to take 2 years to complete

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.2 (Optional) Capture your traditional delivery approach

    30 minutes

    1. As a group, discuss and capture the high-level steps followed (after project approval) in your traditional delivery approach using the table below and on the next page.

    Step

    Description

    Who is involved

    1
    • Gather detailed requirements (work with project stakeholders to capture all requirements of the system and produce a Detailed Requirements Document)

    PM, Business Analysts, Stakeholders, etc.

    2
    • Produce a Detailed Design Document (develop a design that will meet all requirements identified in the Detailed Requirements Document)
    • Produce a Detailed Test Plan for acceptance of the system
    • Produce a Detailed Project Plan for the system delivery
    • Perform threat and privacy assessment (using the detailed requirements and design documents, perform a Threat Risk Assessment and Privacy Impact Analysis)
    • Submit detailed design to Architecture Review Board
    • Provide Operations with full infrastructure requirements
    PM, Architects, InfoSec, ARB, Operations, etc.
    3
    • Develop software (follow the Detailed Design Document and develop a system which meets all requirements)
    • Perform Unit Testing on all modules of the system as they are developed
    PM, Developers, etc.
    4
    • Create Production Environment based on project specification
    • Perform Integration testing of all modules to ensure the system works as designed
    • Produce an Integration Test Report capturing the results of testing and any deficiencies
    PM, Testers, etc.
    5
    • Fix all Sev 1 and Sev 2 deficiencies found during Integration Testing
    • Perform regression testing
    • Perform User Acceptance Testing as per the Detailed Test Plan
    PM, Developers, Testers, Stakeholders, etc.
    6
    • Product Deployment Plan
    • Perform User and Operations Training
    • Produce updated Threat Risk Assessment and Privacy Impact Analysis
    • Seek CAB (Change Approval Board) approval to go live
    PM, Developers, Testers, Operations, InfoSec, CAB, etc.
    7
    • Close out and Lessons Learned
    • Verify value delivery
    PM, etc.

    Output

    • The high-level steps in your current (traditional) delivery approach and who is involved in each step

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.2 (Optional) Capture your traditional delivery approach

    Step

    Description

    Who is involved

    1
    • Gather detailed requirements (work with project stakeholders to capture all requirements of the system and produce a Detailed Requirements Document)

    PM, Business Analysts, Stakeholders, etc.

    2
    • Produce a Detailed Design Document (develop a design that will meet all requirements identified in the Detailed Requirements Document)
    • Produce a Detailed Test Plan for acceptance of the system
    • Produce a Detailed Project Plan for the system delivery
    • Perform threat and privacy assessment (using the detailed requirements and design documents, perform a Threat Risk Assessment and Privacy Impact Analysis)
    • Submit detailed design to Architecture Review Board
    • Provide Operations with full infrastructure requirements
    PM, Architects, InfoSec, ARB, Operations, etc.
    3
    • Develop software (follow the Detailed Design Document and develop a system which meets all requirements)
    • Perform Unit Testing on all modules of the system as they are developed
    PM, Developers, etc.
    4
    • Create Production Environment based on project specification
    • Perform Integration testing of all modules to ensure the system works as designed
    • Produce an Integration Test Report capturing the results of testing and any deficiencies
    PM, Testers, etc.
    5
    • Fix all Sev 1 and Sev 2 deficiencies found during Integration Testing
    • Perform regression testing
    • Perform User Acceptance Testing as per the Detailed Test Plan
    PM, Developers, Testers, Stakeholders, etc.
    6
    • Product Deployment Plan
    • Perform User and Operations Training
    • Produce updated Threat Risk Assessment and Privacy Impact Analysis
    • Seek CAB (Change Approval Board) approval to go live
    PM, Developers, Testers, Operations, InfoSec, CAB, etc.
    7
    • Close out and Lessons Learned
    • Verify value delivery
    PM, etc.

    Output

    • The high-level steps in your current (traditional) delivery approach and who is involved in each step

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.3 (Optional) Consider what a two-phase delivery looks like

    30 minutes

    1. As a group, imagine that project stakeholders tell you two years is too long to wait for the project, and they want to know if they can have something (even if it's not the whole thing) in production sooner.
    2. Now imagine that you are able to convince the stakeholders to work with you to do the following:
      1. Identify their most important project requirements.
      2. Work with you to describe a valuable subset of the project requirements which reflect about ½ of all features they need (call this Phase 1).
      3. Work with you to get this Phase 1 of the project into production in about 1 year.
      4. Agree to leave the remaining requirements (e.g. the less important ones) until Phase 2 (second year of project).
    3. As a group, identify:
      1. How hard this would be for your organization to do, on a scale of 1 to 10.
      2. Identify what changes are needed to make this happen (consider people, processes, and technology).
      3. Capture your results using the table on the following slide.

    Output

    • The high-level steps in your current (traditional) delivery approach and who is involved in each step

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.3 (Optional) Consider what a two-phase delivery looks like

    30 minutes

    1. What would be needed to let you deliver a two-year project in two one-year phases considering people, process, and technology?

    People

    Processes

    Technology

    • e.g. Stakeholders would need to make hard decisions about which features are more valuable/important than others (and stick to them)
    • e.g. Delivery team and stakeholders would need to work closely together to determine what is a feasible and valuable set of features which can go live in Phase 1
    • e.g. Operations will need to be prepared to support Phase 1 (earlier than before), and then support an updated system after Phase 2
    • e.g. No significant change to traditional processes other than delivering in two phases
    • e.g. Need to decide whether requirements for the full project need to be gathered up front, or do you just do Phase 1, and then Phase 2
    • e.g. No significant changes other than we need a production environment sooner, and infrastructure requirements for the full project may be different from what is needed just for Phase 1

    How difficult would this be to achieve in your organization? (1-easy, 10-next to impossible)

    e.g. 2

    Output

    • Understand how your organization would deliver a large project in two phases

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.4 (Optional) Consider what a four-phase delivery looks like

    30 minutes

    1. Now, imagine that project stakeholders tell you that even one year is still too long to wait for something of value in production, and they want to know if they can have something (even if it's not the whole thing) in production sooner.
    2. Now imagine that you are able to convince the stakeholders to work with you to do the following:
      1. From the "Phase 1" requirements in Exercise 2.3.3, they will identify the most important ones that they need first.
      2. They will work with you to describe a valuable subset of these project requirements which reflect about ½ of all features they need (call this Phase 1A).
      3. They will work with you to get this Phase 1A of the project into production in about six months.
      4. Agree to leave all the remaining requirements (e.g. the less important ones) until later phases.
    1. As a group, identify:
      1. How hard this would be for your organization to do, on a scale of 1 to 10?
      2. Identify what changes are needed to make this happen (consider people, processes, and technology).
      3. Capture your results using the table on the following slide.

    Output

    • Understand how your organization would deliver a large project in two phases

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.4 (Optional) Consider what a four-phase delivery looks like

    30 minutes

    1. What more would be needed to let you deliver a two-year project in four, six-month phases considering people, process, and technology?

    People

    Processes

    Technology

    • e.g. Stakeholders would need to make even harder (and faster) decisions about which features are most valuable/important than others.
    • e.g. Because we will be delivering releases so quickly, we'll ask the stakeholders to nominate a "primary contact" who can make decisions on requirements for each phase (also to answer questions from the project team, when needed, so they aren't slowed down).
    • e.g. Delivery team and the "primary contact" would work closely together to determine what is a feasible and valuable set of features to go live within Phase 1A, and then repeat this for the remaining Phases.
    • e.g. Operations will need to be prepared to support Phase 1A (even earlier than before), and then support the remaining phases. Ask them to dedicate someone as primary contact for this series of releases, and who provides guidance/support as needed.

    e.g. Heavy and time-consuming process steps (e.g. architecture reviews, data modelling, infosec approvals, change approval board) will need to be streamlined and made more "iteration-friendly."

    e.g. Gather detailed requirements only for Phase 1A, and leave the rest as high-level requirements to be more fully defined at the beginning of each subsequent phase.

    • e.g. We will need (at a minimum) a Production, and a Pre-production environment set up (and earlier in the project lifecycle) and solid regression testing at the end of each phase to ensure the latest Release doesn't break anything.
    • e.g. Since we will be going into production multiple times over this 2-year project, we should consider using automation (e.g. automated build, automated regression testing, and automated deployment).

    How difficult would this be to achieve in your organization? (1-easy, 10-next to impossible)

    e.g. 5

    Output

    • Understand how your organization would deliver a large project in two phases

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.5 (Optional) Consider what a four-phase delivery with monthly sprints looks like

    30 minutes

    1. Now, imagine that project stakeholders tell you that they are happy with the six-month release approach (e.g. expect to go live four times over the two-year project, with each release providing increased functionality), but they want to see your team's progress frequently between releases.
    2. Additionally, stakeholders tell you that instead of asking you to provide the traditional monthly project status reports, they want you to demonstrate whatever features you have built and work for the system on a monthly basis. This will be done in the form of a demonstration to a selected list of stakeholders each month.
    3. Each month, your team must show working, tested code (not prototypes or mockups, unless asked for) and demonstrate how this month's deliverable brings value to the business.
    4. Furthermore, the stakeholders would like to be able to test out the system each month, so they can play with it, test it, and provide feedback to your team about what they like and what they feel needs to change.
    5. To help you to achieve this, the stakeholders designate their primary contact as the "product owner" (PO) who will be dedicated to the project and will help your team to decide what is being delivered each month. The PO will be empowered by the stakeholders to make decisions on scope and priority on an expedited basis and will also answer questions on their behalf when your team needs guidance.
    6. You agree with the stakeholders these one-month deliverables will be called "sprints."

    Output

    • Understand how your organization would deliver a large project in two phases

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.5 (Optional) Consider what a four-phase delivery with monthly sprints looks like

    30 minutes

    1. What more would be needed to let you deliver a two-year project in 24 one-month sprints (plus four six-month releases) considering people, process, and technology?

    People

    Processes

    Technology

    • e.g. The team will need to work closely with the product owner (and/or stakeholders) on a continuous basis to understand requirements and their relative priority
    • e.g. Stakeholders will need to be available for demos and testing at the end of each sprint, and provide feedback to the team as quickly as possible
    • e.g. all functional siloes within IT (e.g. analysts, architects, infosec, developers, testers, operations) will need to work hand in hand on a continuous basis to deliver working tested code into a demo/test environment at the end of each sprint
    • e.g. there isn't enough time in each sprint to have team members working in siloes, instead, we will need to work together as a team to ensure that all aspects of the sprint (requirements, design, build, test, etc.) are worked on as needed (team is equally and collectively responsible for delivery of each sprint)
    • e.g. We can't deliver much in 1-month sprints if we work in siloes and are expected to do traditional documentation and handoffs (e.g. requirements document), so we will use a fluid project backlog instead of requirements documents, we will evolve our design iteratively over the course of the many sprints, and we will need to streamline the CAB process to allow for faster (more frequent) deployments
    • e.g. We will need to evolve the system's data model iteratively over the course of many sprints (rather than a one-and-done approach at the beginning of the project)
    • e.g. We will need to quickly decide the scope to be delivered in each sprint (focusing on highest value functionality first). Each sprint should have a well-defined "goal" that the team is trying to achieve
    • We will need any approval processes (e.g. architecture review, infosec review, CAB approval) to be streamlined and simplified in order to support more frequent and iterative deployment of the system
    • e.g. We will need to maximize our use of automation (build, test, and deploy) in order to maximize what we can deliver in each sprint (Note: the ROI on automation is much higher when we deliver in sprints than in a one-and-done delivery because we are iterating repeatedly over the course of the project
    • e.g. We will need to quickly stand-up environments (dev, test, prod, etc.) and to make changes/enhancements to these environments quickly (it makes sense to leverage infrastructure as a service [IaaS] techniques here)
    • e.g. We will need to automate our security related testing (e.g. static and dynamic security testing, penetration testing, etc.) so that it can be run repeatedly before each release moves into production. We may need to evolve this automated testing with each sprint depending on what new features/functions are being delivered in each release

    How difficult would this be to achieve in your organization? (1-easy, 10-next to impossible)

    e.g. 8

    Output

    • Understand how your organization would deliver a large project in two phases

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.6 (Optional) Define the steps to reach your target state

    30 minutes

    1. From Exercises 2.3.1-2.3.5, identify your current state on the stepwise transition from traditional to Agile (e.g. one-and-done).
    2. Then, identify your desired future state (e.g. 24 one-month sprints with six-month releases).
    3. Now, review your people, process, and technology changes identified in Exercises 2.3.1-2.3.5 and create a roadmap for this transition using the table on the next slide.

    Identify your current state from Exercises 2.3.1-2.3.5

    e.g. One-and-done

    Identify your desired state from Exercises 2.3.1-2.3.5

    e.g. 24x1 Month Sprints

    Output

    • A roadmap and timeline for adopting a more Agile delivery approach

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.3.6 (Optional) Define the steps to reach your target state

    30 minutes

    1. Fill in the table below with your next steps. Identify who will be responsible for each step along with the timeline for completion: "Now" refers to steps you will take in the immediate future (e.g. days to weeks), "Next" refers to steps you will take in the medium term (e.g. weeks to months), and "Later" refers to long-term items (e.g. months to years).

    Now

    Next Later

    What are you going to do now?

    What are you going to do very soon?

    What are you going to do in the future?

    Roadmap Item

    Who

    Date

    Roadmap Item

    Who

    Date

    Roadmap Item

    Who

    Date

    Work with Stakeholders to identify a product owner for the project.

    AC

    Jan 1

    Break down full deliverable into 4 phases with high level requirements for each phase

    DL

    Feb 15

    Work with operations to set up Dev, Test, Pre-Prod, and Prod environments for first phase (make use of automation/scripting)

    DL

    Apr 15

    Work with PO and stakeholders to help them understand Agile approach

    Jan 15

    Work with PO to create a project backlog for the first phase deliverable

    JK

    Feb 28

    Work with QA group to select and implement test automation for the project (start with smoke and regression tests)

    AC

    Apr 30

    Work with project gating body, architecture, infosec and operations to agree on incremental deliveries for the project and streamlined activities to get there

    AC

    Mar 15

    Record the results in the Roadmap for Transition to Agile Template

    Output

    • A roadmap and timeline for adopting a more Agile delivery approach

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Step 2.4

    Identify insights and team feedback

    Activities

    2.4.1 Identify key insights and takeaways
    2.4.2 Perform an exit survey

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify your key insights and takeaways from Phase 2

    Exercise 2.4.1 Identify key insights and takeaways

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What key insights have participants gained from the intro to Agile presentation?
      2. What if any takeaways do participants feel are needed as a result of the presentation?
      3. What changes need to be made in the organization to support/enhance Agile adoption?
    2. Capture your findings in the table below:
    What key insights have you gained? What takeaways have you identified?
    • (e.g. better understanding of Agile mindset, principles, and practices)
    • (e.g. how you can improve/spread Agile practices in the organization)

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Exercise 2.4.2 Perform an exit survey

    30 minutes

    1. Wrap up this section by addressing any remaining questions participants still have.
    2. Create your local exit survey by copying the template using the link below. Then copy and distribute your local survey link.
    3. Collect the consolidated survey results in preparation for your next steps.
    4. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst can send the survey for you. Alternatively, this survey can be done with sticky notes and a pen and paper to calculate the outcomes.

    Download Survey Template:

    Develop Your Agile Approach Exit Survey Template

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Agile Modules

    Prioritize Agile support with your top challenges

    Backlog Management

    Scrum Simulation

    Estimation

    Product Owner

    Product Roadmapping

    1: User stories and the art of decomposition

    2: Effective backlog management & refinement

    3: Identify insights and team feedback

    1: Scrum sprint planning and retrospective simulation

    2: Pass the balls – sprint velocity game

    1: Improve product backlog item estimation

    2: Agile estimation fundamentals

    3: Understand the wisdom of crowds

    4: Identify insights and team feedback

    1: Understand product management fundamentals

    2: The critical role of the product owner

    3: Manage effective product backlogs and roadmaps

    4: Identify insights and team feedback

    1: Identify your product roadmapping pains

    2: The six "tools" of product roadmapping

    3: Product roadmapping exercise

    Organizations often struggle with numerous pain points around Agile delivery.
    The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.

    Agile modules provide supporting activities:
    Each module provides guidance and supporting activities related to a specific Agile challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Backlog Management Module

    Manage your backlog effectively

    Activities

    Backlog 1.1 Identify your backlog and user story decomposition pains
    Backlog 1.2 What are user stories and why do we use them?
    Backlog 1.3 User story decomposition: password reset
    Backlog 1.4 (Optional) Decompose a real epic

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of backlog management and user story decomposition.

    Backlog Exercise 1.1 Identify your backlog and user story decomposition pains

    30-60 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What specific challenges you are facing with backlog management
      2. What specific challenges you are facing with user story decomposition
    1. Capture your findings in the table below:

    What are your specific backlog management and user story decomposition challenges?

    • (e.g. We have trouble telling the difference between epics, features, user stories, and tasks)
    • (e.g. We often don't finish all user stories in a sprint because some of them turn out to be too big to complete in one sprint)

    Output

    • Your specific backlog management and user story decomposition challenges

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    User stories and the art of decomposition

    User stories are core to Agile delivery.

    Good user story decomposition practices are key to doing Agile effectively.

    Agile doesn't use traditional "shoulds" and "shalls" to capture requirements

    Backlog Exercise 1.2 What are user stories and why do we use them?

    30-60 minutes

    1. User stories are a simple way of capturing requirements in Agile and have the form:

    Why do we capture requirements as user stories (what value do they provide)?

    How do they differ from traditional (should/shall) requirements (and are they better)?

    What else stands out to you about user stories?

    as a someone I want something so that achieve something.

    Example:
    As a banking customer, I want to see the current balance of my accounts so that I can know how much money I have in each account.

    Output

    • A better understanding of user stories and why they are used in Agile delivery

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    User stories are "placeholders for conversations"

    User stories enable collaboration and conversations to fully determine actual business requirements over time.

    e.g. As a banking customer, I want to see the current balance of my accounts so that I can know how much money I have in each account.

    Requirements, determined within the iterations, outline the steps to complete the story: how the user will access their account, the types of funds allowed, etc.

    User stories allow the product owners to prioritize and manage the product needs (think of them as "virtual sticky notes").

    User stories come in different "sizes"

    These items form a four-level hierarchy: epics, features, user stories, and tasks.
    They are collectively referred to as product backlog items or (PBIs)

    A table with the following headings: Agile; Waterfall; Relationship; Definition

    The process of taking large PBIs (e.g. epics and features) and breaking them down in to small PBIs (e.g. user stories and tasks) is called user story decomposition and is often challenging for new-to-Agile teams

    Backlog Exercise 1.3 User story decomposition: password reset

    30-60 minutes

    1. As a group, consider the following feature, which describes a high-level requirement from a hypothetical system:
      • FEATURE: As a customer, I want to be able to set and reset my password, so that I can transact with the system securely.
    2. Imagine your delivery team tells you that this is user story is too large to complete in one sprint, so they have asked you to decompose it into smaller pieces. Work together to break this feature down into several smaller user stories:
    User Story 1: User Story 2: User Story 3:
    As A I Want So That. As A I Want So That. As A I Want So That.

    Output

    • An epic which has been decomposed into smaller user stories which can be completed independently

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Backlog Exercise 1.3 User story decomposition: password reset

    Epic: As a customer, I want to be able to set and reset my password, so that I can transact securely.

    A single epic can be broken down into multiple user stories

    User Story 1: User Story 2: User Story 3: User Story 4:
    This is a picture of user story 1 This is a picture of user story 2 This is a picture of user story 3 This is a picture of user story 4

    Acceptance Criteria:
    Given that the customer has a password that they want to change,
    When the administrator clicks reset password on the admin console,
    Then the system will change the password and send it to the user.

    Acceptance Criteria:
    Given that the customer has a password that they want to change,
    When they click reset password in the system,
    Then the system will allow them to choose a new password and will save it the password and send it to the user.

    Acceptance Criteria:
    Given that the customer has not logged onto the system before,
    When they initially log in,
    Then the system will prompt them to change their password.

    Acceptance Criteria:
    Given that a password is stored in the database,
    When anyone looks at the password field in the database,
    Then the actual password will not be visible or easily decrypted.

    Are enablers included in your backlogs? Should they be?

    An enabler is any support activity needed to provide the means for future functionality. Enablers build out the technical foundations (e.g. architecture) of the product and uphold technical quality standards.

    Your audience will dictate the level of detail and granularity you should include in your enabler, but it is a good rule of thumb to stick to the feature level.

    Enablers

    Description

    Enabler Epics

    Non-functional and other technical requirements that support your features (e.g. data and system requirements)

    Enabler Capabilities of Features

    Enabler Stories

    Consider the various types of enabler

    Exploration

    Architectural

    Any efforts toward learning customer or user needs and creation of solutions and alternatives. Exploration enablers are heavily linked to learning milestones.

    Any efforts toward building components of your architecture. These will often be linked to delivery teams other than your pure development team.

    Infrastructure

    Compliance

    Any efforts toward building various development and testing environments. Again, these are artifacts that will relate to other delivery teams.

    Any efforts toward regulatory and compliance requirements in your development activities. These can be both internal and external.

    Source: Scaled Agile, "Enablers."

    Create, split, and bundle your PBIs

    The following questions can be helpful in dissecting an epic down to the user story level. The same line of thinking can also be useful for bundling multiple small PBIs together.

    An image showing how to Create, split, and bundle your PBIs

    Backlog Exercise 1.4 (Optional)
    Decompose a real epic

    30 minutes

    1. As a group, select a real epic or feature from one of your project backlogs which needs to be decomposed:
    2. Work together to decompose this epic down into several smaller features and/or user stories (user stories must be small enough to reasonably be completed within a sprint):

    Epic to be decomposed:

    As a ____ I want _____ so that ______

    User Story 1: User Story 2: User Story 3:
    As A I Want So That. As A I Want So That. As A I Want So That.

    Output

    • A real epic from your project backlog which has been decomposed into smaller features and user stories

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Backlog Management Module

    Manage your backlog effectively

    Activities

    Backlog 2.1 Identify enablers and blockers

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Backlog PBI filters.
    • A better understanding of backlog types and levels.

    Effective backlog management and refinement

    Working with a tiered backlog

    an image showing the backlog tiers: New Idea; Ideas; Qualified; Ready - sprint.

    Use a tiered approach to managing your backlog, and always work on the highest priority items first.

    Distinguish your specific goals for refining in the product backlog vs. planning for a sprint itself

    Often backlog refinement is used interchangeably or considered a part of sprint planning. The reality is they are very similar, as the required participants and objectives are the same however, there are some key differences.

    An image of a Venn diagram comparing Backlog Refinement to sprint Planning.

    A better way to view them is "pre-planning" and "planning."

    A backlog stores and organizes PBIs at various stages of readiness

    A well-formed backlog can be thought of as a DEEP backlog:

    • Detailed Appropriately: Product backlog items (PBIs) are broken down and refined as necessary.
    • Emergent: The backlog grows and evolves over time as PBIs are added and removed.
    • Estimated: The effort a PBI requires is estimated at each tier.
    • Prioritized: The PBIs value and priority are determined at each tier.

    (Perforce, 2018)

    An image showing the Ideas; Qualified; Ready; funnel leading to the sprint approach.

    Backlog tiers facilitate product planning steps

    An image of the product planning steps facilitated by Backlog Tiers

    Each activity is a variation of measuring value and estimating effort to validate and prioritize a PBI.

    A PBI meets our definition of done and passes through to the next backlog tier when it meets the appropriate criteria. Quality filters should exist between each tier.

    Backlog Exercise 2.1 Build a starting checklist of quality filters

    60 minutes

    1. Quality filters provide a checklist to ensure each Product Backlog Item (PBI) meets our definition of Done and is ready to move to the next backlog group (status).
    2. Create a checklist of basic descriptors that must be completed between each backlog level.
    3. If you completed this exercise in a different Module, review and update it here.
    4. Use this information to start your product strategy playbook in Deliver on Your Digital Product Vision.

    An image of the backlog tiers, identifying where product backlog and sprint backlog are

    Output

    • List of enablers and blockers to establishing product owners

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Outline the criteria to proceed to the next tier via quality filters

    Expand the concepts of defining "ready" and "done" to include the other stages of a PBIs journey through product planning.

    An image showing the approach you will use to Outline the criteria to proceed to the next tier via quality filters

    Info-Tech Insight: A quality filter ensures quality is met and teams are armed with the right information to work more efficiently and improve throughput.

    Define product value by aligning backlog delivery with roadmap goals

    In each product plan, the backlogs show what you will deliver. Roadmaps identify when and in what order you will deliver value, capabilities, and goals.

    Facilitator slides: Explaining MVP

    Notes and Instructions

    The primary intent of this exercise is to explain the complex notion of MVP (it is one of the most misunderstood and contentious issues in Agile delivery). The exercise is intended to explain it in a simple and digestible way that will fundamentally change participants' understanding of MVP.

    Note that the slide contains animations.

    Imagine that your stakeholder tells you they want a blue 4-door sedan (consider this our "MVP" at this point), and you decide to build it the traditional way. As you build it (tires, then frame, then body, then joint body with frame and install engine), the stakeholder doesn't have anything they can use, and so they are only happy (and able to get value) at the end when the entire car is finished (point out the stakeholder "faces" go from unhappy to happy in the end).
    Animation 1:
    When we use Agile methods, we don't want to wait until the end before we have something the stakeholders can use. So instead of waiting until the entire car is completed, we decide our first iteration will be to give the stakeholder "a simple (blue) wheeled transportation device"…namely a skateboard that they can use for a little while (it's not a car, but it is something the stakeholder can use to get places).
    Animation 2:
    After the stakeholder has tried out the skateboard, we ask for feedback. They tell us the skateboard helped them to get around faster than walking, but they don't like the fact that it is so hard to maintain your balance on it. So, we add a handle to the skateboard to turn it into a scooter. The stakeholder then uses the scooter for a while. Stakeholder feedback says staying balanced on the scooter is much easier, but they don't have a place to put groceries when they go shopping, so can we do something about that?
    (Continued on next slide…)

    Facilitator slides: Explaining MVP

    Notes and Instructions
    Animation 3:
    Next, we build the stakeholder a bicycle and let them use it for a while before asking for feedback. The stakeholder tells us they love the bicycle, but they admit they get tired on long trips, so is there something we can do about that?
    Animation 4:
    So next we add a motor to the bicycle to turn it into a motorcycle, and again we give it to the stakeholder to use for a while. When we ask the stakeholder for feedback, they tell us that they love the motorcycle so much because they love the feeling of the wind in their hair, they've decided that they no longer want a 4-door sedan, but instead would prefer a blue 2-door convertible.
    Animation 5:
    And so, for our last iteration, we build the stakeholder what they actually wanted (a blue 2-door convertible) instead of what they asked for (a blue 4-door sedan), and we see that they are happier than they would have been if we had delivered the traditional way.

    INSIGHTS:

    • An MVP cannot be fully known at the beginning of a project (it is the "journey" of creating the MVP with stakeholders that defines what it looks like in the end).
    • Sometimes, stakeholders don't (or can't) know what they want until they see it.
    • There is no "straight path" to your MVP, you determine the path forward based on what you learned in the previous iterations.
    • This approach is part of the "power of Agile" and demonstrates why Agile can produce better outcomes and happier stakeholders.

    Understanding minimum viable product

    NOT Like This:

    This is a series of images. The top half of the image, shows building a car by starting with the wheels. The bottom Image shows the progression from skateboard, to scooter, to bike, to motorcycle, to car.

    It's Like This:

    Use iterations to maximize value delivery

    An image showing how to use iterations to maximize value delivery.

    Use iterations to reduce accumulated risk

    An image showing how to use iterations to reduce accumulated risk.

    Understanding MVP
    (always be ready to go live)

    A great and wise pharaoh hires two architects to build his memorial pyramids.

    An image shows two architects contribution to pyramid construction.

    Understanding MVP
    (always be ready to go live)

    Several years go by, and then…

    The pharaoh is on his death bed.

    Backlog Management Module

    Manage your backlog effectively

    Activities

    Backlog 3.1 Identify key insights and takeaways
    Backlog 3.2 Perform exit survey and capture results

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify your key insights and takeaways.

    Backlog Exercise 3.1 Identify key insights and takeaways

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What key insights have participants gained from the Intro to Agile presentation?
      2. What if any takeaways do participants feel are needed as a result of the presentation?
      3. What changes need to be made in the organization to support/enhance Agile adoption?
    2. Capture your findings in the table below:

    What key insights have you gained?

    What takeaways have you identified?

    • (e.g. better understanding of Agile mindset, principles, and practices)
    • (e.g. how you can improve/spread Agile practices in the organization)

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Backlog Exercise 3.2 Perform an exit survey

    30 minutes

    1. Wrap up this section by addressing any remaining questions participants still have.
    2. Create your local exit survey by copying the template using the link below. Then copy and distribute your local survey link.
    3. Collect the consolidated survey results in preparation for your next steps.
    4. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst can send the survey for you. Alternatively, this survey can be done with sticky notes and a pen and paper to calculate the outcomes.

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Download Survey Template:

    Develop Your Agile Approach Exit Survey Template

    Agile Modules

    Prioritize Agile support with your top challenges

    Backlog Management

    Scrum Simulation

    Estimation

    Product Owner

    Product Roadmapping

    1: User stories and the art of decomposition

    2: Effective backlog management & refinement

    3: Identify insights and team feedback

    1: Scrum sprint planning and retrospective simulation

    2: Pass the balls – sprint velocity game

    1: Improve product backlog item estimation

    2: Agile estimation fundamentals

    3: Understand the wisdom of crowds

    4: Identify insights and team feedback

    1: Understand product management fundamentals

    2: The critical role of the product owner

    3: Manage effective product backlogs and roadmaps

    4: Identify insights and team feedback

    1: Identify your product roadmapping pains

    2: The six "tools" of product roadmapping

    3: Product roadmapping exercise

    Organizations often struggle with numerous pain points around Agile delivery.
    The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.

    Agile modules provide supporting activities:
    Each module provides guidance and supporting activities related to a specific Agile challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Scrum Simulation Module

    Scrum sprint planning and retrospective simulation

    Activities

    1.1 Identify your scrum pains
    1.2 Review scrum simulation intro
    1.3 Create a mock backlog
    1.4 Review sprint 0
    1.5 Determine a budget and timeline
    1.6 Understand minimum viable product
    1.7 Plan your first sprint
    1.8 Do a sprint retrospective
    1.9 "What if" exercise (understanding what a fluid backlog really means)
    1.10 A sprint 1 example
    1.11 Simulate more sprints

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of Scrum (particularly backlog management and user story decomposition).

    Facilitator slides: Scrum Simulation Introduction

    Introduction Tab

    Talk to the nature of the Scrum team:

    • Collective ownership/responsibility for delivery.
    • The organization has given you great power. With great power comes great responsibility.
    • You may each be specialists in some way, but you need to be prepared to do anything the project requires (no one goes home until everyone can go home).
    • Product owner: Special role, empowered by the organization to act as a single, authoritative voice for stakeholders (again great power/responsibility), determines requirements and priorities, three ears (business/stakeholders/team), holds the vision for the project, answer questions from the team (or finds someone who can answer questions), must balance autonomy with stakeholder needs, is first among equals on the Scrum team, is laser-focused on getting the best possible outcome with the resources, money, and circumstances ← PO acts as the "pathfinder" for the project.
    • Talk about the criticality and qualities of the PO: well-respected, highly collaborative, wise decision maker, a "get it done" type (healthy bias toward immediacy), has a vision for product, understands stakeholders, can get stakeholders' attention when needed, is dedicated full-time to the project, can access help when needed, etc.
    • The rest of you are the delivery team (have avoided singling out an SM for this – not needed for the exercise – but SM is the servant leader/orchestra conductor for the delivery team. The facilitator should act as a pseudo-SM for this exercise).

    Speak about the "bank realizes that the precise scope of the first release can only be fully known at the end of the project" statement and what it means.

    Discuss exercise and everyone's roles (make sure everyone clear), make it as realistic as possible. Your level of participation will determine how much value you get.

    Discuss any questions the participants might have about the background section on the introduction tab. The exercise has been defined in a way that minimizes the scope and complexity of the work to be done by assuming there are existing web-capable services exposed to the bank's legacy system(s) and that the project is mostly about putting a deployable web front end in place.

    Speak about "definition of done": Why was it defined this way? What are the boundaries? What happens if we define it to be only up to unit testing?

    Facilitator slides: Scrum Simulation, Create a Mock Backlog

    Create a Mock Backlog Tab

    This exercise is intended to help participants understand the steps involved in creating an initial backlog and deciding on their MVP.

    Note: The output from this exercise will not be used in the remainder of the simulation (a backlog for the simulation already exists on tab Sprint 0) so don't overdo it on this exercise. Do enough to help the participants understand the basic steps involved (brainstorm features and functions for the app, group them into epics, and decide which will be in- and out-of-scope for MVP). Examples have been provided for all steps of this exercise and are shown in grey to indicate they should be replaced by the participants.

    Step 1: Have all participants brainstorm "features and functions" that they think should be available in the online banking app (stop once you have what feels like a "good enough" list to move on to the next step) – these do not need to be captured as user stories just yet.

    Step 2: Review the list of features and functions with participants and decide on several epics to capture groups of related features and functions (bill payments, etc.). Think of these as forming the high-level structure of your requirements. Now, organize all the features and functions from Step 1, into their appropriate epic (you can identify as many epics as you like, but try to keep them to a minimum).

    Step 3: Point out that on the Introduction tab, you were told the bank wants the first release to go live as soon as possible. So have participants go over the list of features and functions and identify those that they feel are most important (and should therefore go into the first release – that is, the MVP), and which they would leave for future releases. Help participants think critically and in a structured way about how to make these very hard decisions. Point out that the product owner is the ultimate decision maker here, but that the entire team should have input into the decision. Point out that all the features and functions that make up the MVP will be referred to as the "project backlog," and all the rest will be known as the "product backlog" (these are of course, just logical separations, there is only one physical backlog).

    Step 4: This step is optional and involves asking the participants to create user stories (e.g. "As a __, I want ___ so that ___") for all the epics and features and functions that make up their chosen MVP. This step is to get them used to creating user stories, because they will need to get used to doing this. Note that many who are new to Agile often have difficulty writing user stories and end up overdoing it (e.g. providing a long-winded list of things in the "I want ___" part of the user story for an epic) or struggling to come up with something for the "so that ____" part). Help them to get good at quickly capturing the gist of what should be in the user story (the details come later).

    Facilitator slides: Scrum Simulation, Budget and Timeline

    Project Budget and Timeline

    Total Number of Sprints = 305/20 = 15.25 → ROUND UP TO 16 (Why? You can't do a "partial sprint" – plus, give yourself a little breathing room.)

    Cost Per Sprint = 6 x $75 x 8 x 10 = $36,000

    Total Timeline = 16 * 2 = 32 Weeks

    Total Cost of First Release = $36,000 x 16 = $572,000

    Talk about the "commitment" a Scrum delivery team makes to the organization ("We can't tell you exactly what we will deliver, but based on what we know, if you give the team 32 weeks, we will deliver something like what is in the project backlog – subject to any changes our stakeholder tell us are needed"). Most importantly, the team commits to doing the most important backlog items first, so if we run out of time, the unfinished work will be the least valuable user stories. Lastly, to keep to the schedule/timeline, items may move in and out of the project backlog – this is part of the normal and important "horse trading" that takes place on health Agile projects.

    Speak to the fact that this approach allows you to provide a "deterministic" answer about how long a project will take and how much it will cost while keeping the project requirements flexible.

    Facilitator slides: Scrum Simulation, Sprint 0

    Sprint 0 Tab

    This is an unprioritized list, organized to make sense, and includes a user story (plus some stuff), and "good enough estimates" – How good?... Eh! (shoulder shrug)
    Point out the limited ("lazy") investment → Agile principle: simplicity, the art of maximizing the work not done.
    Point out that only way to really understand a requirement is to see a working example (requirements often change once the stakeholders see a working example – the "that's not what I meant" factor).

    Estimates are a balancing act (good enough that we understand the overall approximate size of this, and still acknowledges that more details will have to wait until we decide to put that requirement into a Sprint – remember, no one knows how long this project is going to take (or even what the final deliverable will look like) so don't over invest in estimates here.)

    Sprint velocity calculation is just a best guess → be prepared to find that your initial guess was off (but you will know this early rather than at the end of the project). This should lead to a healthy discussion about why the discrepancy is happening (sprint retrospectives can help here). Note: Sprint velocity doesn't assume working evenings and weekends!

    Speak to the importance of Sprint velocity being based on a "sustainable pace" by the delivery team. Calculations that implicitly expect sustained overtime in order to meet the delivery date must be avoided. Part of the power of Agile comes from this critical insight. Critical → Your project's execution will need to be adjusted to accommodate the actual sprint velocity of the team!

    Point out the "project backlog" and separation from the "product backlog" (and no sprint backlog yet!).

    Point out the function/benefits of the backlog:

    • A single holding place for all the work that needs to be done (so you don't forget/ignore anything).
    • Can calculate how much work is left to do.
    • A mechanism for prioritizing deliverables.
    • A list of placeholders for further discussion.
    • An evolving list that will grow and shrink over time.
    • A "living document" that must be maintained over the course of the project.

    Talk about large items in backlog (>20 pts) and how to deal with them (do we need to break them up now?).

    Give participants time to review the backlog: Questions/What would you be doing if this were real/We're going to collectively work through this backlog.
    Sprint 0 is your opportunity to: get organized as a team, do high level design, strategize on approach, think about test data, environments, etc. – it is the "Ready-Set" in "Ready-Set-Go."
    Think about doing a High/Med/Low value determination for each user story.

    Simulation Exercise 1.1 Identify your Scrum pains

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      • What specific challenges are you facing with your Scrum practices?
    2. Capture your findings in the table below:

    What are your specific Scrum challenges?

    • (e.g. We don't know how to decide on our minimum viable product (MVP), or what to start working on first)
    • (e.g. We don't have a product owner assigned to the project)
    • (e.g. Our daily standups often take 30-60 minutes to complete)
    • (e.g. We heard Scrum was supposed to reduce the number of meetings we have, but instead, meetings have increased)
    • (e.g. We don't know how to determine the budget for an Agile project)

    Output

    • Your specific Scrum related challenges

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.2 Review Scrum Simulation intro

    30 minutes

    1. Ask participants to read the Introduction tab in the Scrum Simulation Exercise(5 minutes)
    2. Discuss and answer any questions the participants may have about the introduction (5 minutes)
    3. Discuss the approach your org would use to deliver this using their traditional approach (5 minutes)

    This is an image of the Introduction tab in the Scrum Simulation Exercise

    How would your organization deliver this using their traditional approach?

    1. Capture all requirements in a document and get signoff from stakeholders
    2. Create a detailed design for the entire system
    3. Build and test the system
    4. Deploy it into production

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Simulation Exercise 1.3 Create a mock backlog

    30-60 minutes

    Step 1: Brainstorm "Features and Functions" that the group feels would be needed for this app

    Capture anything that you feel might be needed in the Online Banking Application:

    • See account balances
    • Pay a bill online
    • Set up payees for online bill payments
    • Make a deposit online
    • See a history of account transactions
    • Logon and logoff
    • Make an e-transfer
    • Schedule a bill payment for the future
    • Search for a transaction by payee/date/amount/etc.
    • Register for app
    • Reset password

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • Create a mock initial backlog for the simulated project

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.3 Create a mock backlog

    30-60 minutes

    Step 2: Identify your epics

    1. Categorize your "Features and Functions" list into several epics for the application:

    Epics

    "Features and Functions" in This Epic

    Administration

    - Logon and logoff
    - Register for app
    - Reset password

    Accounts

    - See account balances
    - See a history of account transactions
    - Search for a transaction by payee/date/amount

    Bill payments

    - Set up payees for online bill payments
    - Pay a bill online
    - Schedule a bill payment for the future

    Deposits

    - Make a deposit online

    E-transfers

    - Make an e-transfer

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • Create a mock initial backlog for the simulated project

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.3 Create a mock backlog

    30-60 minutes

    Step 3: Identify your MVP

    1. Decide which "Features and Functions" will be in your MVP and which will be delivered in future releases:

    YOUR MVP (Project Backlog)

    Epics

    "Features and Functions" in This Epic

    Administration

    - Logon and logoff
    - Register for app

    Accounts

    - See account balances
    - See a history of account transactions

    Bill payments

    - Set up payees for online bill payments
    - Pay a bill online

    FOR FUTURE RELEASES (Product Backlog)

    Epics

    In Scope

    Deposits- Make a deposit online
    Accounts- Search for a transaction by payee/date/amount/etc.
    Bill payments- Schedule a bill payment for the future

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • Create a mock initial backlog for the simulated project

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.3 Create a mock backlog

    30-60 minutes

    Step 3: Identify your MVP

    1. Decide which "Features and Functions" will be in your MVP and which will be delivered in future releases:

    YOUR MVP EPICS

    Epics

    "Features and Functions" in This Epic

    Administration

    - Logon and logoff
    - Register for app

    Accounts

    - See account balances
    - See a history of account transactions

    Bill payments

    - Set up payees for online bill payments
    - Pay a bill online

    YOUR MVP USER STORIES

    Epics

    In Scope

    Logon and LogoffAs a user, I want to logon/logoff the app so I can do my banking securely
    Register for AppAs a user, I want to register to use the app so I can bank online
    See Account BalancesAs a user, I want to see my account balances so that I know my current financial status
    See a History of Account TransactionsAs a user, I want to see a history of my account transactions, so I am aware of where my money goes
    Set up Payees for Online Bill PaymentsAs a user, I want to set up payees so that I can easily pay my bills
    Pay a Bill OnlineAs a user, I want to pay bills online, so they get paid on time

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • Create a mock initial backlog for the simulated project

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.4 Review
    Sprint 0

    The Online Banking Application of the spreadsheet for Sprint 0.

    Step 1: Set aside the Mock Backlog just created (you will be using the Backlog on Sprint 0 for remainder of exercise).
    Step 2: Introduce and walk through the Backlog on the Sprint 0 tab in the Scrum Simulation Exercise.
    Step 3: Discuss and answer any questions the participants may have about the Sprint 0 tab.
    Step 4: Capture any important issues or clarifications from this discussion in the table below.

    Important issues or clarifications from the Sprint 0 tab:

    • (e.g. What is the difference between the project backlog and the product backlog?)
    • (e.g. What do we do with user stories that are bigger than our sprint velocity?)
    • (e.g. Has the project backlog been prioritized?)
    • (e.g. How do we decide what to work on first?)

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • Understand Sprint 0 for Scrum Simulation Exercise

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.4 Review
    Sprint 0

    30-60 minutes

    1. Using the information found on the Sprint 0 tab, determine the projected timeline and cost for this project's first release:

    GIVEN

    Total Story Points in Project Backlog (First Release): 307 Story Points
    Expected Sprint Velocity: 20 Story Points/Sprint
    Total Team Size (PO, SM and 4-person Delivery Team): 6 People
    Blended Hourly Rate Per Team Member (assume 8hr day): $75/Hour
    Sprint Duration: 2 Weeks

    DETERMINE

    Expected Number of Sprints to Complete Project Backlog:
    Cost Per Sprint ($):
    Total Expected Timeline (weeks):
    Total Cost of First Release:

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • How to determine expected cost and timeline for an Agile project

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    The Estimation Cone of Uncertainty

    The Estimation Cone of Uncertainty

    Simulation Exercise 1.6 Understanding minimum viable products (MVP)

    30 minutes

    1. Discuss your current understanding of MVP.

    How do you describe/define MVP?

    • (Discuss/capture your understanding of minimum viable product)

    Note: Refer to the facilitator slides for more guidance on how to deliver this exercise

    Output

    • Capture your current understanding of Minimum Viable Product

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Facilitator slides: Explaining MVP

    Notes and Instructions

    The primary intent of this exercise is to explain the complex notion of MVP (it is one of the most misunderstood and contentious issues in Agile delivery). The exercise is intended to explain it in a simple and digestible way that will fundamentally change participants' understanding of MVP.
    Note that the slide contains animations.

    Imagine that your stakeholder tells you they want a blue 4-door sedan (consider this our "MVP" at this point), and you decide to build it the traditional way. As you build it (tires, then frame, then body, then joint body with frame and install engine), the stakeholder doesn't have anything they can use, and so they are only happy (and able to get value) at the end when the entire car is finished (point out the stakeholder "faces" go from unhappy to happy in the end).

    Animation 1:
    When we use Agile methods, we don't want to wait until the end before we have something the stakeholders can use. So instead of waiting until the entire car is completed, we decide our first iteration will be to give the stakeholder "a simple (blue) wheeled transportation device"…namely a skateboard that they can use for a little while (it's not a car, but it is something the stakeholder can use to get places).

    Animation 2:
    After the stakeholder has tried out the skateboard, we ask for feedback. They tell us the skateboard helped them to get around faster than walking, but they don't like the fact that it is so hard to maintain your balance on it. So, we add a handle to the skateboard to turn it into a scooter. The stakeholder then uses the scooter for a while. stakeholder feedback says staying balanced on the scooter is much easier, but they don't have a place to put groceries when they go shopping, so can we do something about that?

    (Continued on next slide…)

    Facilitator slides: Explaining MVP

    Notes and Instructions

    Animation 3:
    So next we build the stakeholder a bicycle and let them use it for a while before asking for feedback. The stakeholder tells us they love the bicycle, but they admit they get tired on long trips, so is there something we can do about that?

    Animation 4:
    So next we add a motor to the bicycle to turn it into a motorcycle, and again we give it to the stakeholder to use for a while. When we ask the stakeholder for feedback, they tell us that they LOVE the motorcycle so much, and that because they love the feeling of the wind in their hair, they've decided that they no longer want a 4-door sedan, but instead would prefer a blue 2-door convertible.

    Animation 5:
    And so, for our last iteration, we build the stakeholder what they wanted (a blue 2-door convertible) instead of what they asked for (a blue 4-door sedan), and we see that they are happier than they would have been if we had delivered the traditional way.

    INSIGHTS:
    An MVP cannot be fully known at the beginning of a project (it is the "journey" of creating the MVP with stakeholders that defines what it looks like in the end).
    Sometimes, stakeholders don't (or can't) know what they want until they see it.
    There is no "straight path" to your MVP, you determine the path forward based on what you learned in the previous iterations.
    This approach is part of the "power of Agile" and demonstrates why Agile can produce better outcomes and happier stakeholders.

    Understanding minimum viable product

    NOT Like This:

    This is a series of images. The top half of the image, shows building a car by starting with the wheels. The bottom Image shows the progression from skateboard, to scooter, to bike, to motorcycle, to car.

    It's Like This:

    Use iterations to maximize value delivery

    An image showing how to use iterations to maximize value delivery

    Use iterations to reduce accumulated risk

    An image showing how to use iterations to reduce accumulated risk.

    Understanding MVP
    (always be ready to go live)

    A great and wise pharaoh hires two architects to build his memorial pyramids.

    An image shows two architects contribution to pyramid construction.

    Understanding MVP
    (always be ready to go live)

    Several years go by, and then…

    The pharaoh is on his death bed.

    Simulation Exercise 1.7 Plan your first sprint

    30-60 minutes

    Step 1: Divide participants into independent Scrum delivery teams (max 7-8 people per team) and assign a PO (5 minutes)
    Step 2: Instruct each team to work together to decide on their "MVP strategy" for delivering this project (10-15 minutes)
    Step 3: Have each team decide on which user stories they would put in their first sprint backlog (5-10 minutes)
    Step 4: Have each team report on their findings. (10 minutes)

    Describe your team's "MVP strategy" for this project (Explain why you chose this strategy):

    Identify your first sprint backlog (Explain how this aligns with your MVP strategy):

    What, if anything, did you find interesting, insightful or valuable by having completed this exercise:

    Output

    • Experience deciding on an MVP strategy and creating your first sprint backlog

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.8 Do a sprint retrospective

    30-60 minutes

    Step 1: Thinking about the work you did in Exercise 3.2.7, identify what worked well and what didn't
    Step 2: Create a list of "Start/Stop/Continue" items using the table below
    Step 3: Present your list and discuss with other teams

    1. Capture findings in the table below:

    Start:
    (What could you start doing that would make Sprint Planning work better?)

    Stop:
    (What didn't work well for the team, and so you should stop doing it?)

    Continue:
    (What worked well for the team, and so you should continue doing?)

    Output

    • Experience performing a sprint retrospective

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.9 "What if" exercise (understanding what a fluid backlog really means)

    30-60 minutes

    1. As a team, consider what you would do in each of the following scenarios (treat each one as an independent scenario rather than cumulative):

    Scenario:

    How would you deal with this:

    After playing with and testing the Sprint 1 deliverable, your stakeholders find several small bugs that need to be fixed, along with some minor changes they would like made to the system. The total amount of effort to address all of these is estimated to be 4 story points in total.

    (e.g. First and foremost, put these requests into the Project Backlog, then…)

    Despite your best efforts, your stakeholders tell you that your Sprint 1 deliverable missed the mark by a wide margin, and they have major changes they want to see made to it.

    Several stakeholders have come forward and stated that they feel strongly that the "DEPOSIT – Deposit a cheque by taking a photo" User Story should be part of the first release, and they would like to see it moved from the Product Backlog to the project backlog (Important Note: they don't want this to change the delivery date for the first release)

    Output

    • A better understanding of how to handle change using a fluid project backlog

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.10 A Sprint 1 example

    30-60 minutes

    1. Consider the following example of what your Sprint 1 deliverable could be:

    An example of what your Sprint 1 deliverable could be.

    Output

    • Better understanding of an MVP strategy

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.10 A Sprint 1 example

    30-60 minutes

    1. As a group, discuss this approach, including:
      1. The pros and cons of the approach.
      2. Is this a shippable increment?
      3. What more would you need to do to make it a shippable increment?
    2. Capture your findings in the table below:

    Discussion

    Output

    • Better understanding of an MVP strategy

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 1.11 Simulate more sprints

    30-60 minutes

    1. As a group, continue to simulate more sprints for the online banking app:
      1. Simulate the planning, execution, demo, and retro stages for additional sprints
      2. Stop when you have had enough
    2. Capture your learnings in the table below:

    Discussion and learnings

    Output

    • Better understanding of an MVP strategy

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Scrum Simulation Module

    Simulate effective scrum practices

    Activities

    2.1 Execute the ball passing sprints

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Model and understand behavioral blockers and patterns affecting Agile teams and organizational culture.

    Pass the balls – sprint velocity game

    Goal 1. Pass as many balls as possible (Story Points) through the system during each sprint.
    Goal 2. Improve your estimation and velocity after each retrospective.

    Backlog

    An image of Sprint, passing balls from one individual to another until you reach the completion point.

    Points Completed

    Rules:

    1. Two people cannot touch the ball at the same time.
    2. Only the first and last person can hold more than one ball at a time.
    3. Every person on the Delivery Team must touch the ball at least once per sprint.
    4. Each team must record its results during the retrospective.

    Scoring:

    1. One point for every ball that completes the system.
    2. Minus one point for every dropped ball.

    Epic 1: 3 sprints

    1. 1-minute Planning
    2. 2-minute Sprints
    3. 1-minute Retrospective

    Group Retrospective
    Epic 2: 3 sprints (repeat)

    1. 1-minute Planning
    2. 2-minute Sprints
    3. 1-minute Retrospective

    Simulation Exercise 1.11 Simulate more sprints

    30-60 minutes

    Goal 1: Pass as many balls (Story Points) through the system during each sprint.
    Goal 2: Improve your estimation and velocity after each retrospective.

    1. Epic 1: 3 sprints
      1. 1-minute Planning
      2. 2-minute Sprints
      3. 1-minute Retrospective
    2. Group Retrospective
    3. Epic 2: 3 sprints
      1. 1-minute Planning
      2. 2-minute Sprints
      3. 1-minute Retrospective
    4. Group Retrospective
    5. Optionally repeat for additional sprints with team configurations or scenarios

    Rules:

    1. Two people cannot touch the ball at the same time.
    2. Only the first and last person can hold more than one ball at a time.
    3. Every person on the delivery team must touch the ball at least once per sprint.
    4. Each team must record its results during the retrospective.

    Scoring:

    1. One point for every ball that completes the system.
    2. Minus one point for every dropped ball.

    Output

    • Understand basic estimation, sprint, and retrospective techniques.
    • Experience common Agile behavior challenges.

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Facilitator slides: Sprint velocity game

    Goal:

    Pass as many balls as possible through the system during each cycle.

    Game Setup

    • Divide into teams of 8-16 people. If you have a smaller group, form one team rather than two smaller teams to start. The idea is to cause chaos with too many people in the delivery flow. See alternate versions for adding additional Epics with smaller teams.
    • Read out the instructions and ensure teams understand each one. Note that no assistance will be given during the sprints.

    Use your phone's timer to create 2-minute cycles:

    • 1-minute sprint planning
    • 2-minute delivery sprint
    • 1-minute retrospective and results recording
    • Run 3-4 cycles, then stop for a facilitated discussion of their observations and challenges.
    • Begin epic 2 and run for 3-4 more cycles.

    Facilitator slides: Sprint velocity game

    • Game Cycles
      • Epic 1: 3 complete cycles
      • 1-minute Planning
      • 2-minute Sprints
      • 1-minute Sprint retrospective
    • Group Retrospective
      • Discuss each sprint, challenges, and changes made to optimize throughput.
    • Epic 2: 3 complete cycles
      • 1-minute Planning
      • 2-minute Sprints
      • 1-minute Sprint retrospective
    • Group Retrospective
      • Discuss each sprint, challenges, and changes made to optimize throughput.
    • Game Rules
      • Each ball must have airtime. No ball cannot touch two people at the same time.
      • No person can hold more than one ball at a time.
      • Ball must be passed by every person on a team.
      • You may not pass a ball to a person directly to the person on your left or right.
      • Each team must keep score and record their results during the Retrospective.
    • Scoring
      • 1 point for every ball that completes the system.
      • Minus 1 point for every dropped ball.

    Facilitator slides: Sprint velocity game

    Facilitator Tips

    • Create a feeling of competition to get the teams to rush and work against each other. The goal is to show how this culture must be broken in Agile and DevOps. Then challenge the teams against natural silos and not focus on enterprise goals.
    • Create false urgency to increase stress, errors, and breakdowns in communication.
    • Look for patterns of traditional delivery and top-down management that limit delivery. These will emerge naturally, and teams will fall back into familiar patterns under stress.
    • Look for key lessons you want to reinforce and bring out ball game examples to help teams relate to something that is easier to understand.

    Alternate Versions

    • Run Epic 1 as one team, then have them break into typical Agile teams of 4-9 people. Compare results.
    • Run Epics with different goals: How would their approach change?
      • Fastest delivery
      • Highest production
      • Lowest defect rate
    • Have teams assign a scrum master to coordinate delivery. A scrum master and product owner are part of the overall team, but not part of the delivery team. They would not need to pass balls during each sprint.
    • Increase sprint time. Discuss right sizing sprint to complete work.
    • Give each team different numbers of balls, but don't tell them. Alternately, start each team with half as many balls, then double for Epic 2. Discuss how the sprint backlog affected their throughput.

    Facilitator slides: Sprint velocity game

    Trends to Look For and Discuss

    • False constraints - patterns where teams unnecessarily limited themselves.
    • Larger teams could have divided into smaller working teams, passing the balls between working groups.
    • Instructions did not limit that "team" meant everyone in the group. They could have formed smaller groups to process more work. LEAN
    • Using the first sprint for planning only. More time to create a POC.
    • Teams will start communicating but will grow silent, especially in later sprints. Stress interactions over the process.
    • Borrowing best practices from other teams.
    • Using retrospectives to share ideas with other teams. Stress needs to align with the company's goals, not just the team's goals.
    • How did they treat dropped balls? Rejected as errors, started over (false constraint), or picked up and continued?

    Trends to Look For and Discuss

    • Did individuals dominate the planning and execution, or did everyone feel like an equal member of the team?
    • Did they consider assigning a scrum master? The scrum master and product owner are part of the overall team, but not part of the Delivery Team. They would not need to pass balls during each Sprint.
    • What impacted their expected number of balls completed? Did it help improve quality or was it a distraction?
    • What caused their improvement in velocity? Draw the connection between how teams must work together and the need for stability.
    • Discuss the overall goal and constraints. Did they understand what the desired outcome was? Where did they make assumptions? Add talking points:
      • What if the goal was overall completed balls?
      • What if it was zero defect? No dropped balls.
      • What if it was the fastest delivery? Each ball through the system in the shortest time? Were they timing each ball?

    Scrum Simulation Module

    Simulate effective scrum practices

    Activities

    3.1 Identify key insights and takeaways

    3.2 Perform exit survey and capture results

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify your key insights and takeaways

    Simulation Exercise 3.1
    Identify key insights and takeaways

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What key insights have participants gained from the Intro to Agile presentation?
      2. What if any takeaways do participants feel are needed as a result of the presentation?
      3. What changes need to be made in the organization to support/enhance Agile adoption?
    2. Capture your findings in the table below:

    What key insights have you gained?

    What takeaways have you identified?

    • (e.g. better understanding of Agile mindset, principles, and practices)
    • (e.g. how you can improve/spread Agile practices in the organization)

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Simulation Exercise 3.2
    Perform an exit survey

    30 minutes

    1. Wrap up this section by addressing any remaining questions participants still have.
    2. Create your local exit survey by copying the template using the link below. Then copy and distribute your local survey link.
    3. Collect the consolidated survey results in preparation for your next steps.
    4. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst can send the survey for you. Alternatively, this survey can be done with sticky notes and a pen and paper to calculate the outcomes.

    Download Survey Template:

    Develop Your Agile Approach Exit Survey Template

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Agile Modules

    Prioritize Agile support with your top challenges

    Backlog Management

    Scrum Simulation

    Estimation

    Product Owner

    Product Roadmapping

    1: User stories and the art of decomposition

    2: Effective backlog management & refinement

    3: Identify insights and team feedback

    1: Scrum sprint planning and retrospective simulation

    2: Pass the balls – sprint velocity game

    1: Improve product backlog item estimation

    2: Agile estimation fundamentals

    3: Understand the wisdom of crowds

    4: Identify insights and team feedback

    1: Understand product management fundamentals

    2: The critical role of the product owner

    3: Manage effective product backlogs and roadmaps

    4: Identify insights and team feedback

    1: Identify your product roadmapping pains

    2: The six "tools" of product roadmapping

    3: Product roadmapping exercise

    Organizations often struggle with numerous pain points around Agile delivery.
    The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.

    Agile modules provide supporting activities:

    Each module provides guidance and supporting activities related to a specific Agile Challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.

    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Estimation Module

    Improve product backlog item estimation

    Activities

    1.1 Identify your estimation pains

    1.2 (Optional) Why do we estimate?

    1.3 How do you estimate now?

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of Agile estimation practices and how to apply them.

    Establish consistent Agile estimation fundamentals

    an image of a hierarchy answering the question What is an estimate.

    Know the truth about estimates and their potential pitfalls.

    Then, understand how Agile estimation works to avoid these pitfalls.

    Estimation Exercise 1.1 Identify your estimation pains

    30-60 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What specific challenges are you facing with your estimation practices today
      2. Capture your findings in the table below:

    What are your specific Estimation challenges?

    • (e.g. We don't estimate consistently)
    • (e.g. Our estimates are usually off by a large margin)
    • (e.g. We're not sure what approach to use when estimating)

    Output

    • Your specific estimation related challenges

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Exercise 1.2 (Optional) Why do we estimate?

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      1. Why do we do estimates?
      2. What value/merit do estimates have?
    2. Capture your findings in the table below:

    Why would/should you do estimates?

    • (e.g. Our stakeholders need to know how long it will take to deliver a given feature/function)

    Output

    • Better understanding of the need for estimates

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Exercise 1.2 (Optional) Why do we estimate?

    30 minutes

    1. Estimation has its merits
    2. Here are some sample reasons for estimates:
      • "Estimates allow us to predict when a sprint goal will be met, and therefore when a substantial increment of value will be delivered."
      • "Our estimates help our stakeholders plan ahead. They are part of the value we provide."
      • "Estimates help us to de-risk scope of uncertain size and complexity."
      • "Estimated work can be traded in and out of scope for other work of similar size. Without estimates, you can't trade."
      • "The very process of estimation adds value. When we estimate we discuss requirements in more detail and gain a better understanding of what is needed."
      • "Demonstrates IT's commitment to delivering valuable products and changes."
      • "Supports business ambitions with customers and stakeholders."
      • "Helps to build a sustainable value-delivery cadence."

    Source: DZone, 2013.

    Output

    • Better understanding of the need for estimates

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Exercise 1.3 How do you estimate now?

    30 minutes

    1. As a group, speak about now you currently estimate in your organization.
    2. Capture your findings in the table below:

    Why would/should you do estimates?

    • (e.g. We don't do estimates)
    • (e.g. We ask the person assigned to each task in the project plan to estimate how long it will take)

    Output

    • Your current estimation approach

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Module

    Improve product backlog item estimation

    Activities

    2.1 (Optional) Estimate a real PBI

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of Agile estimation practices and how to apply them.

    Don't expect your estimates to be accurate!

    The average rough order of magnitude estimates for software are off by is up to 400%.
    Source: Boehm, 1981

    Estimate inaccuracy has many serious repercussions on the project and organization

    66%

    Average cost overrun(1)

    33%

    Average schedule overrun (1)

    17%

    Average benefits shortfall)1)

    (1) % of software projects with given issue

    Source: McKinsey & Company, 2012

    The Estimation Cone of Uncertainty

    The Estimation Cone of Uncertainty

    What is Agile estimation?

    There is no single Agile estimation technique. When selecting an approach, adopt an Agile estimation technique that works for your organization, and don't be afraid to adapt it to your circumstances. Remember: all estimates are wrong, so use them with care and skepticism.

    • Understands and accepts the limitations of any estimation process.
    • Leverages good practices to counteract these limitations (e.g. wisdom of crowds, quality-first thinking).
    • Doesn't over-invest in individual estimate accuracy (but sees their value "in aggregate").
    • Approach can change from project to project or team to team and evolves/matures over the project lifespan.
    • Uses the estimation process as an effective tool to:
      • Make commitments about what can be accomplished in a sprint (to establish capacity).
      • Convey a measure of progress and rough expected completion dates to stakeholders (including management).

    Info-Tech Insight

    All estimates are wrong, but some can be useful (leverage the "wisdom of crowds" to improve your estimation practices).

    There are many Agile estimation techniques to choose from…

    Consensus-Building Techniques
    Planning Poker

    Most popular by far (stick with one of these unless there is a good reason to consider others)

    This approach uses the Delphi method, where a group collectively estimates the size of a PBI, or user stories, with cards numbered by story points. See our Estimate Software Delivery With Confidence blueprint.

    T-Shirt Sizing

    This approach involves collaboratively estimating PBIs against a non-numerical system (e.g. small, medium, large). See DZone and C# Corner for more information.

    Dot Voting

    This approach involves giving participants a set number of dot stickers or marks and voting on the PBIs (and options) to deliver. See Dotmocracy and Wikipedia for more information.

    Bucket System

    This approach categorizes PBIs by placing them into defined buckets, which can then be further broken down through dividing and conquering. See Agile Advice and Crisp's Blog for more information.

    Affinity Mapping

    This approach involves the individual sizing and sorting of PBIs, and then the order of these PBIs are collaboratively edited. The grouping is then associated with numerical estimates or buckets if desired. See Getting Agile for more information.

    Ordering Method

    This approach involves randomly ordering items on a scale ranging from low to high. Each member will take turns moving an item one spot lower or higher where it seems appropriate. See Apiumhub, Sheidaei Blog (variant), and SitePoint (Relative Mass Valuation) for more information.

    Ensure your teams have the right information

    Estimate accuracy and consistency improve when it is clear what you are estimating (definition of ready) and what it means to complete the PBI (definition of done).
    Be sure to establish and enforce your definition of ready/done throughout the project.

    Ready

    Done
    • The value of the story to the user is indicated.
    • The acceptance criteria for the story have been clearly described.
    • Person who will accept the user story is identified.
    • The team knows how to demo the story…
    • Design complete, code compiles, static code analysis has been performed and passed.
    • Peer reviewed with coding standards passed.
    • Unit test and smoke test are done/functional (preferably automated).
    • Passes functionality testing including security testing…

    What are story points?

    Many organizations use story point sizing to estimate their PBIs
    (e.g. epics, features, user stories, and tasks)

    • A story point is a (unitless) measure of the relative size, complexity, risk, and uncertainty, of a PBI.
    • Story points do not correspond to the exact number of hours it will take to complete the PBI.
    • When using story points, think about them in terms of their size relative to one another.
    • The delivery team's sprint velocity and capacity should also be tracked in story points.

    How do you assign a point value to a user story? There is no easy answer outside of leveraging the experience of the team. Sizes are based on relative comparisons to other PBIs or previously developed items. Example: "This user story is 3 points because it is expected to take 3 times more effort than that 1-point user story."Therefore, the measurement of a story point is only defined through the team's experience, as the team matures.

    Can you equate a point to a unit of time? First and foremost, for the purposes of backlog prioritization, you don't need to know the time, just its size relative to other PBIs. For sprint planning, release planning, or any scenario where timing is a factor, you will need to have a reasonably accurate sprint capacity determined. Again, this comes down to experience.

    "Planning poker" estimation technique

    Leverage the wisdom of crowds to improve your estimates

    an image of the user story points and the Fibonacci sequence

    Planning poker: This approach uses the Delphi method, where a group collectively estimates the size of a PBI or user story, using cards with story points on them.

    Materials: Each participant has deck of cards, containing the numbers of the Fibonacci sequence.

    Typical Participants: Product owner, scrum master (usually acts as facilitator), delivery team.

    Steps:

    1. The facilitator will select a user story.
    2. The product owner answers any questions about the user story from the group.
    3. The group makes their first round of estimates, where each participant individually selects a card without showing it to anyone, and then all selections are revealed at once.
    4. If there is consensus, the facilitator records the estimate and moves onto step 1 for another user story.
    5. If there are discrepancies, the participants should state their case for their selection (especially high or low outliers) and engage in constructive debate.
    6. The group makes an additional round of estimates, where step 3-6 are completed until there is a reasonable consensus.
    7. If the consensus is the user story is too large to fit into a sprint or too poorly defined, then the user story should be decomposed or rewritten.

    Estimation Exercise 2.1 (Optional) Estimate a real PBI

    30-60 minutes

    Step 1: As a group, select a real epic, feature, or user story from one of your project backlogs which needs to be estimated:

    PBI to be Estimated:

    As a ____ I want _____ so that ______

    Step 2: Select one person in your group to act as the product owner and discuss/question the details of the selected PBI to improve your collective understanding of the requirement (the PO will do their best to explain the PBI and answer any questions).
    Step 3: Make your first round of estimates using either T-shirt sizing or the Fibonacci sequence. Be sure to agree on the boundaries for these estimates (e.g. "extra-small" (XS) is any work that can be completed in less than an hour, while "extra-large" (XL) is anything that would take a single person a full sprint to deliver – a similar approach could be used for Fibonacci where a "1" is less than an hour's work, and "21" might be a single person for a full sprint). Don't share your answer until everyone has had a chance to decide on their Estimate value for the PBI.
    Step 4: Have everyone share their chosen estimate value and briefly explain their reasoning for the estimate. If most estimate values are the same/similar, allow the group to decide whether they have reached a "collective agreement" on the estimate. If not, repeat step 3 now that everyone has had a chance to explain their initial Estimate.
    Step 5: Capture the "collective" estimate for the PBI here:

    Our collective estimate for this PBI:

    e.g. 8 story points

    Output

    • A real PBI from your project backlog which has estimated using planning poker

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Module

    Improve product backlog item estimation

    Activities

    3.1 Guess the number of jelly beans (Round 1) (15 minutes)
    3.2 Compare the average of your guesses (15 minutes)
    3.3 Guess the number of gumballs (Round 2) (15 minutes)
    3.4 Compare your guesses against the actual number

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • A better understanding of why Agile estimation and reconciliation provides reliable estimates for planning.

    Facilitator Slides: Agile Estimation (Wisdom of Crowds Exercise – Rounds 1 and 2)

    Notes and Instructions

    The exercise is intended to mimic the way Planning Poker is performed in Agile Estimation. Use the exercise to demonstrate the power of the Wisdom of Crowds and how, in circumstances where the exact answer to a question is not known, asking several people for their opinion often produces more accurate results than most/any individual opinion.

    Some participants will tend to "shout out an answer" right away, so be sure to tell participants not to share their answers until everyone has had an opportunity to register their guess (this is particularly important in Round 1, where we are trying to get unvarnished guesses from the participants).

    In Round 1:

    • Be sure to emphasize that participants are guessing the total number of jelly beans in the jar (sometimes people think it is just the number visible)
    • Once all guesses are gathered and you've calculated the error for them (and the average guess), review the results with participants (Note: the actual number of jelly beans in the jar is 1600 (it is "greyed out" on the bottom line of the table – you can make it visible by turning off the grey highlight on that cell in the table)
    • Most of the time, the average guess will be closer to the actual than most (if not all) individual guesses (but be prepared for the fact that this doesn't always happen – this is especially true when the number of participants is small)
    • When discussing the results, ask participants to share the "method" they used to make their guess (particularly those who were closest to the actual). This part of the exercise can help them to make more accurate guesses in Round 2

    In Round 2:

    • Note that this time, participants are guessing the total number of visible gumballs in the image (both whole and partial gumballs are counted)
    • Once all guesses are gathered and you've calculated the error for them (and the average guess), review the results with participants (Note: the actual number of visible gumballs is 1600 (it is "greyed out" on the bottom line of the table – you can make it visible by turning off the grey highlight on that cell in the table)
    • Most of the time, the average guess will be closer to the actual in Round 2 than it was in Round 1
    • Talk to participants about the outcomes and how the results varied from Round 1 to Round 2, along with any interesting insights they may have gained from the exercise

    Estimation Exercise 3.1 Guess the number of jelly beans (Round 1)

    15 minutes

    1. Option 1: Microsoft Forms
      1. Create your own local survey by copying the template using the link below.
      2. Add the local Survey link to the exercise instructions or send the link to the participants.
      3. Give the participants 2-3 minutes to complete their guesses.
      4. Collect the consolidated Survey responses and calculate the results on the next slide.
      5. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst or Workshop Specialist can set up the survey for you.
    2. Option 2: Embedded Excel table
      1. On the results slide, double-click the table to open the embedded Excel worksheet.
      2. Record each participant's guess in the table.
    3. Alternatively, this survey can be done with sticky notes, a pen, paper, and a calculator to determine the outcomes.

    Download Survey Template:

    Info-Tech Wisdom of the Crowd 1 (Jelly Bean Guess

    Output

    • An appreciation for the power of the wisdom of crowds

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Exercise 3.1 Guess the number of jelly beans (Round 1)

    15 minutes

    1. Guess the total number of jelly beans in the entire container (not just the ones you can see).
    2. Be sure not to share your guess with anyone else.
    3. It doesn't matter how you settle on your guess ("gut feel" is fine, so is being "scientific" about it, as well as everything in between).
    4. Again, please don't share your guess (or even how you settled on your guess) with anyone else (this exercise relies on independent guesses).

    See slide notes for instructions.

    Output

    • An appreciation for the power of the wisdom of crowds

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Exercise 3.2 Compare the average of your guesses

    15 minutes

    A blank table for you to compare the average of your guesses at the number of Jellybeans in the Jar.

    See slide notes for instructions.

    Output

    • An appreciation for the power of the wisdom of crowds

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Guess the number of gumballs

    • Option 1: Microsoft Forms
      • Create your own local survey by copying the template using the link below.
      • Add the local Survey link to the exercise instructions or send the link to the participants.
      • Give the participants 2-3 minutes to complete their guesses.
      • Collect the consolidated Survey responses and calculate the results on the next slide.
      • NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst or Workshop Specialist can set up the survey for you.
    • Option 2: Embedded Excel table
      • On the results slide, double-click the table to open the embedded Excel worksheet.
      • Record each participant's guess in the table.
    • Alternatively, this survey can be done with sticky notes, a pen, paper, and a calculator to determine the outcomes.

    Download Survey Template:

    Info-Tech Wisdom of the Crowd 2 (Gumball Guess)

    Output

    • An appreciation for the power of the wisdom of crowds

    Participants

    • PM's, PO's and SM's
    • Delivery Managers
    • Delivery Teams
    • Business Stakeholders
    • Senior Leaders
    • Other Interested Parties

    Estimation Exercise 3.3 Guess the number of gumballs (Round 2)

    15 minutes

    1. Guess the total number of gumballs visible in the photo shown on the right.
    2. Again, please don't share your guess with anyone.

    Output

    • An appreciation for the power of the wisdom of crowds

    Participants

    • PM's, PO's and SM's
    • Delivery Managers
    • Delivery Teams
    • Business Stakeholders
    • Senior Leaders
    • Other Interested Parties

    Estimation Exercise 3.2 Compare the average of your guesses

    15 minutes

    A blank table for you to compare the average of your guesses at the number of Jellybeans in the Jar.

    See slide notes for instructions.

    Output

    • An appreciation for the power of the wisdom of crowds

    Participants

    • PM's, PO's and SM's
    • Delivery Managers
    • Delivery Teams
    • Business Stakeholders
    • Senior Leaders
    • Other Interested Parties

    Estimation Module

    Improve product backlog item estimation

    Activities

    4.1 Identify key insights and takeaways
    4.2 Perform exit survey and capture results

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify your key insights and takeaways.

    Estimation Exercise 4.2
    Identify key insights and takeaways

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What key insights have participants gained from the Intro to Agile presentation?
      2. What if any takeaways do participants feel are needed as a result of the presentation?
      3. What changes need to be made in the organization to support/enhance Agile adoption?
    2. Capture your findings in the table below:

    What key insights have you gained?

    What takeaways have you identified?

    • (e.g. better understanding of Agile mindset, principles, and practices)
    • (e.g. how you can improve/spread Agile practices in the organization)

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Estimation Exercise 4.2
    Perform an exit survey

    30 minutes

    1. Wrap up this section by addressing any remaining questions participants still have.
    2. Create your local exit survey by copying the template using the link below. Then copy and distribute your local survey link.
    3. Collect the consolidated survey results in preparation for your next steps.
    4. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst can send the survey for you. Alternatively, this survey can be done with sticky notes and a pen and paper to calculate the outcomes.

    Download Survey Template:

    Develop Your Agile Approach Exit Survey Template

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Agile Modules

    Prioritize Agile support with your top challenges

    Backlog Management

    Scrum Simulation

    Estimation

    Product Owner

    Product Roadmapping

    1: User stories and the art of decomposition

    2: Effective backlog management & refinement

    3: Identify insights and team feedback

    1: Scrum sprint planning and retrospective simulation

    2: Pass the balls – sprint velocity game

    1: Improve product backlog item estimation

    2: Agile estimation fundamentals

    3: Understand the wisdom of crowds

    4: Identify insights and team feedback

    1: Understand product management fundamentals

    2: The critical role of the product owner

    3: Manage effective product backlogs and roadmaps

    4: Identify insights and team feedback

    1: Identify your product roadmapping pains

    2: The six "tools" of product roadmapping

    3: Product roadmapping exercise

    Organizations often struggle with numerous pain points around Agile delivery.
    The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.

    Agile modules provide supporting activities:

    Each module provides guidance and supporting activities related to a specific Agile Challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.

    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Product Owner Module

    Establish an effective product owner role

    Activities

    1.1 Identify your product owner pains
    1.2 What is a "product"? Who are your "consumers"?
    1.3 Define your role terminology

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Understand product management fundamentals.
    • Define your product management roles and terms.

    Product owners ensure we delivery the right changes, for the right people, at the right time.

    The importance of assigning an effective and empowered product owner to your Agile projects cannot be overstated.

    What is a product?

    A tangible solution, tool, or service (physical or digital), which enables the long-term and evolving delivery of value to customers, and stakeholders based on business and user requirements.

    Info-Tech Insight

    A proper definition of a product recognizes three key facts.

    1. A clear recognition that products are long-term endeavors that don't end after the project finishes.
    2. Products are not just 'apps', but can be software or services that drive value.
    3. There is more than one stakeholder group that derives value from the product or service.

    Estimation Exercise 4.2
    Perform an exit survey

    30-60 minutes

    1. As a group, discuss and capture your thoughts on:
      • What specific challenges are you facing with your product owner practices today?
    2. Capture your findings in the table below:

    What are your specific Product Owner challenges?

    • (e.g. We don't have product owners)
    • (e.g. Our product owners have "day jobs" as well, so they don't have enough time to devote to the project)
    • (e.g. Our product owners are unsure about the role and its associated responsibilities)

    Output

    • Your specific product owner challenges

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Product Owner Exercise 1.2 What is a "product"? Who are your "consumers"?

    30-60 minutes

    1. Discussion:
      1. How do you define a product, service, or application?
      2. Who are the consumers that receive value from the product?

    Input

    • Organizational knowledge
    • Internal terms and definitions

    Output

    • Our definition of products and services
    • Our definition of product and service consumers/customers

    Products and services share the same foundation and best practices

    The term "product" is used for consistency but would apply to services as well.

    Product=Service

    "Product" and "Service" are terms that each organization needs to define to fit its culture and customers (internal and external). The most important aspect is consistent use and understanding of:

    • External products
    • Internal products
    • External services
    • Internal services
    • Products as a service (PaaS)
    • Productizing services (SaaS)

    Recognize the different product owner perspectives

    • Business
      • Customer facing, revenue generating
    • Operations
      • Keep the lights on processes
    • Technical
      • IT systems and tools

    "A product owner in its most beneficial form acts like an Entrepreneur, like a 'mini-CEO'. The product owner is someone who really 'owns' the product."

    – – Robbin Schuurman,
    "Tips for Starting Technical Product Managers"

    Info-Tech Best Practice

    Product owners must translate needs and constraints from their perspective into the language of their audience. Kathy Borneman, Digital Product Owner at SunTrust Bank, noted the challenges of finding a common language between lines of business and IT (e.g. what is a unit?).

    Implement Info-Tech's product owner capability model

    An image of Info-Tech’s product owner capability model

    Unfortunately, most product owners operate with an incomplete knowledge of the skills and capabilities needed to perform the role. Common gaps include focusing only on product backlogs, acting as a proxy for product decisions, and ignoring the need for key performance indicators (KPIs) and analytics in both planning and value realization.

    Scale products into families to improve alignment

    Operationally align product delivery to enterprise goals

    A hierarchy showing how to break enterprise goals and strategy down into product families.

    The Info-Tech difference:

    Start by piloting product families to determine which approaches work best for your organization.

    Create a common definition of what a product is and identify products in your inventory.

    Use scaling patterns to build operationally aligned product families.

    Develop a roadmap strategy to align families and products to enterprise goals and priorities.

    Use products and families to evaluate the delivery and organizational design improvements.

    Deliver Digital Products at Scale via Enterprise Product Families

    Select the right models for scaling product management

    • Pyramid
      • Logical hierarchy of products rolling into a single service area.
      • Lower levels of the pyramid focus on more discrete services.
      • Example: Human resources mapping down to supporting applications.
    • Service Grouping
      • Organization of related services into service family.
      • Direct hierarchy does not necessarily exist within the family.
      • Example: End user support and ticketing.
    • Technical Grouping
      • Logical grouping of IT infrastructure, platforms, or applications.
      • Provides full lifecycle management when hierarchies do not exist.
      • Example: Workflow and collaboration tools.
    • Market Alignment
      • Grouping of products by customer segments or market strategy.
      • Aligns product to end users and consumers.
      • Example: Customer banking products and services.
    • Organizational Alignment
      • Used at higher levels of the organization where products are aligned under divisions.
      • Separation of product management from organizational structure no longer distinct.

    Match your product management role definitions to your product family levels

    Product Ownership exists at the different operational tiers or levels in your product hierarchy. This does not imply or require a management relationship.

    Product Portfolio
    Groups of product families within an overall value stream or capability grouping.
    Product Portfolio Manager

    Product Family
    A collection of related products. Products can be grouped along architectural, functional, operational, or experiential patterns.
    Product Family Manager

    Product
    Single product composed of one or more applications and services.
    Product Owner

    Info-Tech Insight

    The primary role conflict occurs when the product owner is a proxy for stakeholders or responsible for the delivery team. The product owner owns the product backlog. The delivery team owns the sprint backlog and delivery.

    Examine the differences between product managers and product owners

    Product management terminology is inconsistent, creating confusion in organizations introducing these roles. Understand the roles, then define terms that work best for you.

    A Table comparing the different roles of product managers to those of product owners.

    Define who manages key milestone

    Key milestones must be proactively managed. If a project manager is not available, those responsibilities need to be managed by the Product Owner or Scrum Master. Start with responsibility mapping to decide which role will be responsible.

    An image of a table with the following column headings: Example Milestones; Project Manager; Product Owner; Scrum Master*

    Product Owner Exercise 1.3 Define your role terminology

    30-60 minutes

    1. Using consistent terms is important for any organizational change and evergreen process. Capture your preferred terms to help align teams and expectations.
    Term

    Definition

    Product Owner

    • Owns and manages the product or service providing continuous delivery of value.
    • Owns the product roadmap and backlog for the product or service.
    • Works with stakeholders, end users, the delivery team, and market research to identify the product features and their estimated return on investment when implemented.
    • Responsible for refining and reprioritizing the product backlog ensuring items are "Ready" for the sprint backlog.
    • Defines KPIs to measure the value and impact of each PBI to help refine the backlog and guide the roadmap.
    • Responsible for refining and reprioritizing the sprint backlog that identifies which features will be delivered in the next sprint based on business importance.
    • Works with the product owner, stakeholders, end users, and SMEs to help define PBIs to ensure they are "Ready" for the Sprint backlog.

    Product Manager

    • Owns and manages a product or service family consisting of multiple products or services.
    • Owns the product family roadmap. Note: Product families do not have a backlog, only products do.
    • Works with stakeholders, end users, product owners, enterprise architecture, and market research to identify the product capabilities needed to accomplish goals.
    • Validates the product PBIs delivered realized the expected value and capability. Feedback is used to refine the product family roadmap and guide product owners.

    Output

    • Product management role definitions

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Product Owner Module

    Establish an effective product owner role

    Activities

    2.1 Identify enablers and blockers

    2.2 (Optional) Dissect this definition of the product owner role

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify cultural enablers and blockers for product owners.
    • Develop a deeper understanding of the product owner role.

    The importance of establishing an effective product owner role

    The critical importance of establishing an effective product owner role (PO) for your Agile projects cannot be overstated.

    Many new-to-Agile organizations do not fully appreciate the critical role played by the PO in Scrum, nor the fundamental changes the organization will need to make in support of the PO role. Both mistakes will reduce an organization's chances of successfully adopting Agile and achieving its promised benefits.

    The PO role is critical to the proper prioritization of requirements and efficient decision-making during the project.

    The PO role helps the organization to avoid "analysis paralysis" challenges often experienced in large command-and-control-style organizations.

    A poorly chosen or disengaged product owner will almost certainly stifle your Agile project.

    Note that for many organizations, "product owner" is not a formally recognized role, which can create HR issues. Some organizational education on Agile may be needed (especially if your organization is unionized).

    Info-Tech Insight

    Failing to establish effective product owners in your organization can be a "species-killing event" for your Agile transformation.

    The three A's of a product owner

    To ensure the effectiveness of a product owner, your organization should select one that meets the three A's:

    Available: Assign a PO that can focus full-time on the project. Make sure your PO can dedicate the time needed to fulfill this critical role.
    Appropriate: It's best for the PO to have strong subject matter expertise (so-called "super users" are often selected to be POs) as well as strong communication, collaboration, facilitation, and arbitration skills. A good PO will understand how to negotiate the best outcomes for the project, considering all project constraints.
    Authoritative: The PO must be empowered by your organization to speak authoritatively about priorities and goals and be able to answer questions from the project team quickly and efficiently. The PO must know when decisions can be made immediately and when they must be made in collaboration with other stakeholders – choosing a PO that is well-known and respected by stakeholders will help to make this more efficient.

    Info-Tech Insight

    It's critical to assign a PO that meets the three A's:

    • Available
    • Appropriate
    • Authoritative

    The three ears of a product owner*

    An effective product owner listens to (and effectively balances) the needs and constraints of three different groups:

    Organizational needs/constraints represent what is most important to the organization overall, and typically revolve around things like cost, schedule, return on investment, time to market, risk mitigation, conforming to policies and regulations, etc.

    Stakeholder needs/constraints represent what is most important to those who will be using the system and typically revolve around the delivery of value, ease of use, better outcomes, making their jobs easier and more efficient, getting what they ask for, etc.

    Delivery Team needs/constraints represent what is most important to those who are tasked with delivering the project and cover a broad range that includes tools, skills, capabilities, technology limitations, capacity limits, adequate testing, architectural considerations, sustainable workload, clear direction and requirements, opportunities to innovate, getting sufficient input and feedback, support for clearing roadblocks, dependencies on other teams, etc.

    Info-Tech Insight

    An effective PO will expertly balance the needs of:

    • The organization
    • Project stakeholders
    • The delivery team

    * For more, see Understanding Scrum: Why do Product Owners Have Three Ears

    A product owner doesn't act alone

    Although the PO plays a unique and central role in the success of an Agile project, it doesn't mean they "act alone."

    The PO is ultimately responsible for managing and maintaining an effective backlog over the project lifecycle, but many people contribute to maintaining this backlog (on large projects, BA's are often the primary contributors to the backlog).

    The PO role also relies heavily on stakeholders (to help define and elaborate user stories, provide input and feedback, answer questions, participate in sprint demos, participate in testing of sprint deliverables, etc.).

    The PO role also relies heavily on the delivery team. Some backlog management and story elaboration is done by delivery team members instead of the PO (think: elaborating user story details, creating acceptance criteria, writing test plans for user stories, etc.).

    The PO both contributes to these efforts and leads/oversees the efforts of others. The exact mix of "doing" and "leading" can be different on a case-by-case basis and is part of establishing the delivery team's norms.

    Given the importance of the role, care must be taken to not overburden the product owner, especially on large projects.

    Info-Tech Insight

    While being ultimately responsible for the product backlog, a PO often relies on others to aid in backlog management and maintenance.

    This is particularly true on large projects.

    The use of a proxy PO

    Sometimes, a proxy product owner is needed.

    It is always best to assign a product owner "from the business," who will bring subject matter expertise and have established relationships with stakeholders.

    When a PO from the business does not have enough time to fulfill the needs of the role completely (e.g. can only be a part-time PO, because they have a day job), assigning a proxy product owner can help to compensate for this.

    The proxy PO acts on behalf of the PO in order to reduce the PO's workload or to otherwise support them.

    Project participants (e.g. delivery team, stakeholders) should treat the PO and proxy PO as roughly equivalent.

    Project managers (PMs) and business analysts (BAs) are often good candidates for the proxy PO role.

    NOTE: It's highly advisable for the PO to attend all/most sprint demos in order to observe progress for themselves, and to identify any misalignment with expectations as early as possible (remember that the PO still has ultimate responsibility for the project outcomes).

    Info-Tech Insight

    Although not ideal, assigning a proxy PO can help to compensate for a PO who doesn't meet all three A's of Product Ownership.

    It is up to the PO and proxy to decide how they will work together (e.g. establish their norms).

    The use of a proxy PO

    The PO and proxy must work together closely and in a highly coordinated way.

    The PO and proxy must:

    • Work closely at the start of the project to agree on the overall approach they will follow, as well as any needs and constraints for the project.
    • Communicate frequently and effectively throughout the project, to ensure progress is being made and to address any challenges.
    • Have a "meeting of the minds" about how the different "parts" of the PO role will be divided between them (including when the proxy must defer to the PO on matters).
    • Focus on ensuring that all the responsibilities of the PO role are fulfilled effectively by the pair (how this is accomplished is up to the two of them to decide).
    • Ensure all project participants clearly understand the POs' and proxies' relative responsibilities to minimize confusion and mistakes.

    The use of multiple POs

    Sometimes, having multiple product owners makes sense.

    It is always best to assign a single product owner to a project. However, under certain circumstances, it can make sense to use multiple POs.

    For example, when implementing a large ERP system with many distinct modules (e.g. Finance, HR) it can be difficult to find a single PO who has sufficient subject matter expertise across all modules.

    When assigning Multiple POs to a project, be sure to identify a "Lead PO" (who is given ultimate responsibility for the entire project) and have the remaining POs act like Proxy POs.

    NOTE: Not surprisingly, it's highly advisable for the Lead PO to attend as many Sprint Demos as possible to observe progress for themselves, and to identify any misalignment with expectations as early as possible (remember that the Lead PO has ultimate responsibility for the project outcomes).

    Info-Tech Best Practice

    Although not ideal, assigning multiple POs to a project sometimes makes sense.

    When needed, be sure to identify a "Lead PO" and have the other PO's act like Proxies.

    Product Owner Exercise 2.1 Identify enablers and blockers

    30-60 minutes

    1. Brainstorm and discuss the key enablers that can help promote and ease your implementation of Product Ownership.
    2. Brainstorm and discuss the key blockers (or risks) that may interrupt or derail your efforts.
    3. Brainstorm mitigation activities for each blocker.
    Enablers Blockers Mitigation
    High business engagement and buy-in Significant time is required to implement and train resources Limit the scope for pilot project to allow time to learn
    Organizational acceptance for change Geographically distributed resources Temporarily collocate all resources and acquire virtual communication technology
    Existing tools can be customized for BRM Difficulty injecting customers in demos Educate customer groups on the importance of attendance and 'what's in it for them'

    Output

    • List of enablers and blockers to establishing product owners

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Establish an effective product owner role

    • The nature of a PO role can be somewhat foreign to many organizations, so candidates for the role will benefit from training along with coaching/mentoring support when starting out.
    • The PO must be able to make decisions quickly around project priorities, goals, and requirements.
    • A PO who is simply a conduit to a slow-moving steering committee will stifle an Agile project.
    • Establish clear boundaries and rules regarding which project decisions can be made directly by the PO and which must be escalated to stakeholders. Lean toward approaches that support the quickest decision-making (e.g. give the PO as much freedom as they need to be effective).
    • An effective PO has a good instinct for what is "good enough for now."
    • The organization can support the PO by focusing attention on goals and accomplishments rather than pushing processes and documentation.
    • Understand the difference between a project sponsor and a PO (the PO role is much more involved in the details, with a higher workload).
    • Agree on and clearly define the roles and responsibilities of PO, PM, dev manager, SM, etc. at the start of the project for clarity and efficiency.

    Characteristics to look for when selecting a product owner

    Here are some "ideal characteristics" for your POs (the more of these that are true for a given PO, the better):

    • Knows how to get things done in your organization
    • Has strong working relationships with project stakeholders (has established trust with them and is well respected by stakeholders as well as others)
    • Comes from the stakeholder community and is invested in the success of the project (ideally, will be an end user of the system)
    • Has proven communication, facilitation, mediation, and negotiation skills
    • Can effectively balance multiple competing priorities and constraints
    • Sees the big picture and strives to achieve the best outcomes possible (grounded in realistic expectations)
    • Works with a sense of urgency and welcomes ongoing feedback and collaboration with stakeholders
    • Understands how to act as an effective "funnel and filter" for stakeholder requests
    • Acts as an informal (but inspirational) leader whom others will follow
    • Has a strong sense of what is "good enough for now"
    • Protects the delivery team from distractions and keeps them focused on goals
    • Thinks strategically and incrementally

    Product Owner Exercise 2.2 (Optional) Dissect this definition of the product owner role

    30-60 minutes

    1. Take a minute or two to review the bullet points below, which describe the product owner's role.
    2. As a group, discuss the "message" for each bullet point in the description, and then identify which aspects would be "easy" and "hard" to achieve in your organization.
      • The product owner is a project team member who has been empowered by both the organization and stakeholders to act on their behalf and to guide the project directly with a single voice (supported by appropriate consultations with the organization and stakeholders).
      • The product owner must be someone with a good understanding of the project deliverable (they are often considered to be a subject matter expert in an area related to the project deliverable) and ideally is both well-known and respected by both the organization and stakeholders.
      • During the project, requirements clarification, prioritization, and scope changes are ultimately decided by the product owner, who must perform the important balancing act required by the project to adequately reflect the needs and constraints of the organization, its stakeholders, and the project team.
      • The product owner role can only be successful in an organization that has established a trusting and supportive culture. Great trust must be placed in the product owner to adequately balance competing needs in a way that leads to good outcomes for the organization. This trust must come with some authority to make important project decisions, and the organization must also support the product owner in addressing risks and roadblocks outside the control of the project team.
      • The product owner is first among equals when it comes to ultimate ownership of success for the project (along with the project delivery team itself). Because of this, any project of any significance will require the full-time effort of the product owner (don't shortchange yourself by under-investing in a willing, able, and available product owner)

    Output

    • Better understanding of the product owner role.

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Product Owner Exercise 2.2 (Optional) Dissect this definition of the product owner role

    Which aspects of the product owner are "easy" in your organization?

    Which aspects of the product owner are "hard" in your organization?

    Product Owner Module

    Establish an effective product owner role

    Activities

    3.1 Build a starting checklist of quality filters

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Understand the levels in a product backlog and how to create quality filters for PBIs moving through the backlog.
    • Define your product roadmap approach for key audiences.

    Product Owner Step 3: Managing effective product backlogs and roadmaps

    The primary role of the product owner is to manage the backlog effectively.

    When managed properly, the product backlog is a powerful project management tool that directly contributes to project success.

    The product owner's primary responsibility is to ensure this backlog is managed effectively.

    A backlog stores and organizes PBIs at various stages of readiness

    A well-formed backlog can be thought of as a DEEP backlog:

    • Detailed Appropriately: Product backlog items (PBIs) are broken down and refined as necessary.
    • Emergent: The backlog grows and evolves over time as PBIs are added and removed.
    • Estimated: The effort a PBI requires is estimated at each tier.
    • Prioritized: The PBIs value and priority are determined at each tier.

    (Perforce, 2018)

    An image showing the Ideas; Qualified; Ready; funnel leading to the sprint approach.

    Backlog tiers facilitate product planning steps

    An image of the product planning steps facilitated by Backlog Tiers

    Each activity is a variation of measuring value and estimating effort to validate and prioritize a PBI.

    A PBI meets our definition of done and passes through to the next backlog tier when it meets the appropriate criteria. Quality filters should exist between each tier.

    Backlog Exercise 2.1 Build a starting checklist of quality filters

    60 minutes

    1. Quality filters provide a checklist to ensure each Product Backlog Item (PBI) meets our definition of Done and is ready to move to the next backlog group (status).
    2. Create a checklist of basic descriptors that must be completed between each backlog level.
    3. If you completed this exercise in a different Module, review and update it here.
    4. Use this information to start your product strategy playbook in Deliver on Your Digital Product Vision.

    An image of the backlog tiers, identifying where product backlog and sprint backlog are

    Output

    • List of enablers and blockers to establishing product owners

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Outline the criteria to proceed to the next tier via quality filters

    Expand the concepts of defining "ready" and "done" to include the other stages of a PBIs journey through product planning.

    An image showing the approach you will use to Outline the criteria to proceed to the next tier via quality filters

    Info-Tech Insight: A quality filter ensures quality is met and teams are armed with the right information to work more efficiently and improve throughput.

    Define product value by aligning backlog delivery with roadmap goals

    In each product plan, the backlogs show what you will deliver.

    Roadmaps identify when and in what order you will deliver value, capabilities, and goals.

    Product roadmaps guide delivery and communicate your strategy

    In Deliver on Your Digital Product Vision, we demonstrate how the product roadmap is core to value realization. The product roadmap is your communicated path, and as a product owner, you use it to align teams and changes to your defined goals while aligning your product to enterprise goals and strategy.

    This is an image Adapted from: Pichler, What Is Product Management?

    Adapted from: Pichler, "What Is Product Management?"

    Info-Tech Insight

    The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.

    Product delivery realizes value for your product family

    While planning and analysis are done at the family level, work and delivery are done at the individual product level.

    An example of performing planning and analysis at the family level.

    Leverage the product family roadmap for alignment

    It's more than a set of colorful boxes. It's the map to align everyone to where you are going.

    • Your product family roadmap:
      • Lays out a strategy for your product family.
      • Is a statement of intent for your family of products.
      • Communicates direction for the entire product family and product teams.
      • Directly connects to the organization's goals.
    • However, it is not:
      • Representative of a hard commitment.
      • A simple combination of your current product roadmaps.

    Your ideal roadmap approach is a spectrum, not a choice!

    Match your roadmap and backlog to the needs of the product.

    Tactical vs strategic roadmaps.

    Product Managers do not have to choose between being tactical or strategic.
    – Aha!, 2015

    Multiple roadmap views can communicate differently yet tell the same truth

    Audience

    Business/
    IT Leaders

    Users/Customers

    Delivery Teams

    Roadmap

    View

    Portfolio

    Product Family

    Technology

    Objectives

    To provide a snapshot
    of the portfolio and
    priority products

    To visualize and validate product strategy

    To coordinate broad technology and architecture decisions

    Artifacts

    Line items or sections of the roadmap are made up of individual products, and an artifact represents a disposition at its highest level.

    Artifacts are generally grouped by product teams and consist of strategic goals and the features that realize
    those goals.

    Artifacts are grouped by
    the teams who deliver
    that work and consist of technical capabilities that support the broader delivery of value for the product family.

    Product Owner Exercise 3.1 Build a starting checklist of quality filters

    60 minutes

    1. Views provide roadmap information to different audiences in the format and level of detail that is fit to their purpose.
    2. Consider the three primary audiences for roadmap alignment.
    3. Define the roles or people who the view best fits.
    4. Define the level of detail or artifacts shared in the view for each audience.
    5. Use this information to start your product strategy playbook in Deliver on Your Digital Product Vision.

    Business/
    IT Leaders

    Users/Customers

    Delivery Teams

    Audience:

    Audience:

    Audience:

    Level of Detail/Artifacts:

    Level of Detail/Artifacts:

    Level of Detail/Artifacts:

    Output

    • List of enablers and blockers to establishing product owners

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Connecting your product family roadmaps to product roadmaps

    Your product and product family roadmaps should be connected at an artifact level that is common between both. Typically, this is done with capabilities, but it can be done at a more granular level if an understanding of capabilities isn't available.

    A comparison between product family roadmaps and product roadmaps.

    Use product roadmaps to align cross-team dependencies

    Regardless of how other teams operate, teams need to align to common milestones.

    An image showing how you may Use product roadmaps to align cross-team dependencies

    Product Owner Module

    Establish an effective product owner role

    Activities

    4.1 Identify key insights and takeaways

    4.2 Perform exit survey and capture results

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Identify your key insights and takeaways.

    Product Owner Exercise 4.1
    Identify key insights and takeaways

    30 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What key insights have participants gained from the Intro to Agile presentation?
      2. What if any takeaways do participants feel are needed as a result of the presentation?
      3. What changes need to be made in the organization to support/enhance Agile adoption?
    2. Capture your findings in the table below:
    What key insights have you gained? What takeaways have you identified?
    (e.g. better understanding of Agile mindset, principles, and practices) (e.g. how you can improve/spread Agile practices in the organization)

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Product Owner Exercise 4.2
    Perform an exit survey

    30 minutes

    1. Wrap up this section by addressing any remaining questions participants still have.
    2. Create your local exit survey by copying the template using the link below. Then copy and distribute your local survey link.
    3. Collect the consolidated survey results in preparation for your next steps.
    4. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst can send the survey for you. Alternatively, this survey can be done with sticky notes and a pen and paper to calculate the outcomes.

    Download Survey Template:

    Develop Your Agile Approach Exit Survey Template

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Agile Modules

    Prioritize Agile support with your top challenges

    Backlog Management

    Scrum Simulation

    Estimation

    Product Owner

    Product Roadmapping

    1: User stories and the art of decomposition

    2: Effective backlog management & refinement

    3: Identify insights and team feedback

    1: Scrum sprint planning and retrospective simulation

    2: Pass the balls – sprint velocity game

    1: Improve product backlog item estimation

    2: Agile estimation fundamentals

    3: Understand the wisdom of crowds

    4: Identify insights and team feedback

    1: Understand product management fundamentals

    2: The critical role of the product owner

    3: Manage effective product backlogs and roadmaps

    4: Identify insights and team feedback

    1: Identify your product roadmapping pains

    2: The six "tools" of product roadmapping

    3: Product roadmapping exercise

    Organizations often struggle with numerous pain points around Agile delivery.
    The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.

    Agile modules provide supporting activities:

    Each module provides guidance and supporting activities related to a specific Agile challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.

    This phase involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Product Roadmapping

    Create effective product roadmaps

    Activities

    Roadmapping 1.1 Identify your product roadmapping pains
    Roadmapping 1.2 The six "tools" of product roadmapping
    Roadmapping 1.3 Product roadmapping exercise

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Understand product management fundamentals
    • Understand the six "tools" of roadmapping and how to use them

    Roadmapping Exercise 1.1: Tell us what product management means to you and how it differs from a project orientation

    10-15 minutes

    1. Share your current understanding of product management.
    What is product management, and how does it differ from a project orientation?

    Output

    • Your current understanding of product management and its benefits

    Participants

    • PMs, Pos, and SMs
    • Delivery managers
    • Delivery teams
    • Business stakeholders
    • Senior leaders
    • Other interested parties

    Definition of terms

    Project

    "A temporary endeavor undertaken to create a unique product, service, or result. The temporary nature of projects indicates a beginning and an end to the project work or a phase of the project work. Projects can stand alone or be part of a program or portfolio."

    – PMBOK, PMI

    Product

    "A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements."
    Deliver on Your Digital Product Vision,
    Info-Tech Research Group

    Info-Tech Insight

    Any proper definition of product recognizes that they are long-term endeavors that don't end after the project finishes. Because of this, products need well thought out roadmaps.

    Deliver Digital Products at Scale via Enterprise Product Families

    Match your product management role definitions to your product family levels

    Product ownership exists at the different operational tiers or levels in your product hierarchy. This does not imply or require a management relationship.

    Product Portfolio
    Groups of product families within an overall value stream or capability grouping.
    Product Portfolio Manager

    Product Family
    A collection of related products. Products can be grouped along architectural, functional, operational, or experiential patterns.
    Product Family Manager

    Product
    Single product composed of one or more applications and services.
    Product Owner

    Info-Tech Insight

    The primary role conflict occurs when the product owner is a proxy for stakeholders or responsible for the delivery team. The product owner owns the product backlog. The delivery team owns the sprint backlog and delivery.

    Roadmapping Exercise 1.2 (Optional): Define "product" in your context*

    15-30 minutes

    1. Discuss what "product" means in your organization.
    2. Create a common, enterprise definition for "product."

    For example,

    • An application, platform, or application family.
    • Discrete items that deliver value to a user/customer.

    Capture your organization's definition of product:

    * For more on Product Management see Deliver on Your Digital Product Vision

    Output

    • Your enterprise/ organizational definition of products and services.

    Participants

    • PMs, Pos, and SMs
    • Delivery managers
    • Delivery teams
    • Business stakeholders
    • Senior leaders
    • Other interested parties

    Product Roadmapping

    Create effective product roadmaps

    Activities

    The six "tools" of product roadmapping

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Understand product management fundamentals
    • Understand the six "tools" of roadmapping and how to use them

    The six "tools" of product roadmapping

    the 6 tools of product roadmapping: Vision; Goals; Strategy; Roadmap; Backlog; Release Plan.

    Product Roadmapping

    Create effective product roadmaps

    Activities

    Roadmapping 3.1 Product roadmapping exercise
    Roadmapping 3.2 Identify key insights and takeaways
    Roadmapping 3.3 Perform an exit survey

    This step involves the following participants:

    • Product owners, product managers, and scrum masters
    • Delivery managers and senior leaders
    • Stakeholders and delivery teams

    Outcomes of this step

    • Understand product management fundamentals
    • Understand the six "tools" of roadmapping and how to use them

    Roadmapping Exercise 1.2 (Optional): Define "product" in your context*

    30 minutes

    1. As a team, read through the exercise back story below:

    The city of Binbetter is a picturesque place that is sadly in decline because local industry jobs are slowly relocating elsewhere. So, the local government has decided to do something to reinvigorate the city. Binbetter City Council has set aside money and a parcel of land they would like to develop into a venue that will attract visitors and generate revenue for the city.

    Your team was hired to develop the site, and you have already spent time with city representatives to create a vision, goals and strategy for building out this venue (captured on the following slides). The city doesn't want to wait until the entire venue is completed before it opens to visitors, and so you have been instructed to build it incrementally in order to bring in much needed revenue as soon as possible.

    Using the vision, goals, and strategy you have created, your team will need to plan out the build (i.e. create a roadmap and release plan for which parts of the venue to build and in which order). You can assume that visitors will come to the venue after your "Release 1", even while the rest is still under construction. Select one member of your team to be designated as the product owner. The entire team will work together to consider options and agree on a roadmap/release plan, but the product owner will be the ultimate decision-maker.

    * Adapted from Rautiainen et al, Toward Agile Product and Portfolio Management, 2015

    Output

    • Practical understanding of how to apply the six tools of product roadmapping.

    Participants

    • PMs, Pos, and SMs
    • Delivery managers
    • Delivery teams
    • Business stakeholders
    • Senior leaders
    • Other interested parties

    Roadmapping Exercise 3.1: Continued

    1. As a team, review vision, goal, and strategy:
      • Is this a "good" vision statement, and if so, why?
      • Does it live up to its definition of being: "notional and inspirational, while also calling out key guidance and constraints"?
      • Does it help you to rule in/out options for the Product?
      • e.g. Would a parking lot fit the vision?
      • What about a bunch of condominiums?
      • What about a theme park?

    Vision, Goals, and Strategy

    Product Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city

    Roadmapping Exercise 3.1: Continued

    1. As a team, review vision, goal, and strategy:

    Vision, Goals, and Strategy

    Product Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city

    An image of a Château-style Hotel (left) and a Gothic-style Cathedral (right)

    Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter.

    Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).

    Roadmapping Exercise 3.1: Continued

    1. As a team, review the following exercise rules:
    • Your construction team has told you that they can divide the structures into 17 "equal" components (see below)
    • Each component will require about the same amount of time and resources to complete
    • You can ask the team to build these components in any order and temporary roofs can be built for components that are not at the top of a "stack" (e.g. you can build C3 without having to build C4 and C5 at the same time)
    • However, you cannot build the tops of any buildings first (e.g. don't build M3 until M2 and M1 are in place)

    An image of the chateau hotel and the Gothic Cathedral from the previous slide, broken down into 7 parts each

    Roadmapping Exercise 3.1: Continued

    1. As a team, review vision, goal, and strategy:
      • The city has asked you to decide on your "Release 1 MVP" and has limited you to selecting between 4 and 8 components for this MVP (fewer components = earlier opening date).
      • As a team, work together to decide which components will be in your MVP (remember, the PO makes the ultimate decision).
      • Drag your (4-8) selected MVP components over from the right and assemble them below (and explain your reasoning for your MVP selections):

    Release 1 (MVP)

    Vision, Goals, and Strategy

    Product Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city

    Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter.

    Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).

    An image of the chateau hotel and the Gothic Cathedral from the previous slide, broken down into 7 parts each

    Roadmapping Exercise 3.1: Continued
    (magnified venue)

    An image of the chateau hotel and the Gothic Cathedral from the previous slide, broken down into 7 parts each

    Roadmapping Exercise 3.1: Continued

    1. As a team, decide the rest of your roadmap:
      • The city has asked you to decide on the remainder of your roadmap
      • They have limited you to selecting between 2 and 4 components for each additional release (drag your selected component into each release below):
    Release 2 Release 3 Release 4 Release 5

    Vision, Goals, and Strategy

    Product Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city

    Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter.

    Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).

    An image of the chateau hotel and the Gothic Cathedral from the previous slide, broken down into 7 parts each

    Roadmapping Exercise 3.1: Continued

    Roadmap, Release Plan and Backlog

    an example roadmap plan; INCREASING: Priority; Requirements detail; Estimate accuracy; Level of commitment.

    Vision, Goals, and Strategy

    Product Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city

    Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter.

    Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).

    An image of the chateau hotel and the Gothic Cathedral from the previous slide, broken down into 7 parts each

    Roadmapping Exercise 3.2:
    Identify key insights and takeaways

    15 minutes

    1. As a group, discuss and capture your thoughts on:
      1. What key insights have participants gained from the product roadmapping module?
      2. What if any takeaways do participants feel are needed as a result of the module?
      3. What changes need to be made in the organization to support/enhance Agile adoption?
    2. Capture your findings in the table below:
    What key insights have you gained?What takeaways have you identified?
    • (e.g. better understanding of Agile mindset, principles, and practices)
    • (e.g. how you can improve/spread Agile practices in the organization)

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Roadmapping Exercise 3.3
    Perform an exit survey

    30 minutes

    1. Wrap up this section by addressing any remaining questions participants still have.
    2. Create your local exit survey by copying the template using the link below. Then copy and distribute your local survey link.
    3. Collect the consolidated survey results in preparation for your next steps.
    4. NOTE: Using this survey template requires having access to Microsoft Forms. If you cannot access Microsoft Forms, an Info-Tech analyst can send the survey for you. Alternatively, this survey can be done with sticky notes and a pen and paper to calculate the outcomes.

    Download Survey Template:

    Develop Your Agile Approach Exit Survey Template

    Output

    • A better understanding of Agile principles and practices
    • Action items that will help solidify Agile practices in the organization

    Participants

    • Product owners, product managers, and scrum masters
    • Delivery managers
    • Delivery teams
    • Stakeholders
    • Senior leaders

    Appendix

    Additional research to start your journey

    Related Info-Tech Research

    Mentoring for Agile Teams

    • Get practical help and guidance on your Agile transformation journey.

    Implement DevOps Practices That Work

    • Streamline business value delivery through the strategic adoption of DevOps practices.

    Deliver on Your Digital Product Vision

    • Build a product vision your organization can take from strategy through execution.

    Deliver Digital Products at Scale

    • Deliver value at the scale of your organization through defining enterprise product families.

    Bibliography

    "Agile Estimation Practice." DZone.com, 13 May 2013. Web.
    "Announcing DORA 2021 Accelerate State of DevOps Report." Google Cloud Blog. Accessed 8 Nov. 2022.
    "Are Your IT Strategy and Business Strategy Aligned?" 5Q Partners, 8 Jan. 2015. Accessed Oct. 2016.
    A, Karen. "20 Mental Models for Product Managers." Medium, Product Management Insider, 2 Aug. 2018 . Web.
    ADAMS, PAUL. "Product Teams: How to Build & Structure Product Teams for Growth." Inside Intercom, 30 Oct. 2019. Web.
    Agile Alliance. "Product Owner." Agile Alliance. n.d. Web.
    Ambysoft. "2018 IT Project Success Rates Survey Results." Ambysoft. 2018. Web.
    Banfield, Richard, et al. "On-Demand Webinar: Strategies for Scaling Your (Growing) Enterprise Product Team." Pluralsight, 31 Jan. 2018. Web.
    Bloch, Michael, Sven Blumberg, and Jurgen Laartz. "Delivering Large-Scale IT Projects on Time, on Budget, and on Value." McKinsey & Company, October 2012.
    Blueprint. "10 Ways Requirements Can Sabotage Your Projects Right From the Start." Blueprint. 2012. Web.
    Boehm, Barry W. Software Engineering Economics. New Jersey: Prentice Hall, 1981.
    Breddels, Dajo, and Paul Kuijten. "Product Owner Value Game." Agile2015 Conference. 2015. Web.
    Cagan, Martin. "Behind Every Great Product." Silicon Valley Product Group. 2005. Web.
    "Chaos Report 2015." The Standish Group, 2015. Accessed 29 July 2022.
    Cohn, Mike. Succeeding With Agile: Software Development Using Scrum. Addison-Wesley. 2010. Web.
    Connellan, Thomas K. Inside the Magic Kingdom, Bard Press, 1997. Print.
    Dyba, Tore, and Torgeir Dingsøyr. "Empirical Studies of Agile Software Development: A Systematic Review." Elsevier, ScienceDirect. 24 Jan. 2008. Web.
    "How do you define a product?" Scrum.org. 4 Apr 2017, Web
    EDUCAUSE. "Aligning IT Funding Models to the Pace of Technology Change." EDUCAUSE. 14 Dec. 2015. Web.
    Eick, Stephen. "Does Code Decay? Assessing the Evidence from Change Management Data." IEEE Transactions on Software Engineering, vol. 27, no. 1, Jan. 2001, pp. 1-12. Web.
    "Enablers." Scaled Agile. n.d. Web.
    "Epic." Scaled Agile. n.d. Web.
    Eringa, Ron. "Evolution of the Product Owner." RonEringa.com. 12 June 2016. Web.
    Fernandes, Thaisa. "Spotify Squad Framework - Part I." Medium.com. 6 Mar. 2017. Web.
    Fowler, Martin. "Application Boundary." MartinFowler.com. 11 Sept. 2003. Web. 20 Nov. 2017.
    Galen, Robert. "Measuring Technical Product Managership – What Does 'Good' Look Like ...." RGalen Consulting. 5 Aug. 2015. Web.
    Hackshall, Robin. "Product Backlog Refinement." Scrum Alliance. 9 Oct. 2014. Web. Feb. 2019.
    Halisky, Merland, and Luke Lackrone. "The Product Owner's Universe." Agile Alliance, Agile2016. 2016. Web.
    Kamer, Jurriaan. "How to Build Your Own 'Spotify Model'." Medium.com. 9 Feb. 2018. Web.
    Karlsson, Johan. "Backlog Grooming: Must-Know Tips for High-Value Products." Perforce. 18 May 2018. Web. Feb. 2019.
    Lindstrom, Lowell. "7 Skills You Need to Be a Great Product Owner." Scrum Alliance. n.d. Web.
    Lawrence, Richard, and Peter Green. "The Humanizing Work Guide to Splitting User Stories." Humanizing Work, 22 Oct. 2020. Web.
    Leffingwell, Dean. "SAFe 5.0." Scaled Agile Inc. 2021. Web. Feb. 2021.
    Lucero, Mario. "Product Backlog – Deep Model." Agilelucero. 8 Oct. 2014. Web.
    Lukassen, Chris. "The Five Belts Of The Product Owner." Xebia.com. 20 Sept. 2016. Web.
    Management 3.0. "Delegation Poker Product Image." Management 3.0. n.d. Web.
    McCloskey, Heather. "Scaling Product Management: Secrets to Defeating Common Challenges." Scaling Product Management: Secrets to Defeating Common Challenges, ProductPlan, 12 July 2019 . Web.
    McCloskey, Heather. "When and How to Scale Your Product Team." UserVoice Blog, UserVoice, 21 Feb. 2017 . Web.
    Medium.com. "Exploring Key Elements of Spotify's Agile Scaling Model." Medium.com. 23 July 2018. Web.
    Mironov, Rich. "Scaling Up Product Manager/Owner Teams: - Rich Mironov's Product Bytes." Rich Mironov's Product Bytes, Mironov Consulting, 12 Apr. 2014 . Web.
    "Most Agile Transformations Will Fail." Vitality Chicago Inc., 24 Jan. 2019.
    Overeem, Barry. "A Product Owner Self-Assessment." Barry Overeem. 6 Mar. 2017. Web.
    Overeem, Barry. "Retrospective: Using the Team Radar." Barry Overeem. 27 Feb. 2017. Web.
    "PI Planning." Scaled Agile. n.d. Web.
    "PI Planning."SAFe. 2020.
    Pichler, Roman. "How to Scale the Scrum Product Owner." Roman Pichler, 28 June 2016 . Web.
    Pichler, Roman. "Product Management Framework." Pichler Consulting Limited. 2014. Web.
    Pichler, Roman. "Sprint Planning Tips for Technical Product Managers." LinkedIn. 4 Sept. 2018. Web.
    Pichler, Roman. "What Is Product Management?" Pichler Consulting Limited. 26 Nov. 2014. Web.
    Project Management Institute. A Guide to the Project Management Body of Knowledge (PMBOK Guide). 7th ed., Project Management Institute, 2021.
    Radigan, Dan. "Putting the 'Flow' Back in Workflow With WIP Limits." Atlassian. n.d. Web.
    Royce, Dr. Winston W. "Managing the Development of Large Software Systems." Scf.usc.edu. 1970. Web.
    Schuurman, Robbin. "10 Tips for Technical Product Managers on Agile Product Management." Scrum.org. 28 Nov. 2017. Web.
    Schuurman, Robbin. "10 Tips for Technical Product Managers on (Business) Value." Scrum.org. 30 Nov. 2017. Web.
    Schuurman, Robbin. "10 Tips for Technical Product Managers on Product Backlog Management." Scrum.org. 5 Dec. 2017. Web.
    Schuurman, Robbin. "10 Tips for Technical Product Managers on the Product Vision." Scrum.org. 29 Nov. 2017. Web.
    Schuurman, Robbin. "Tips for Starting Technical Product Managers." Scrum.org. 27 Nov. 2017. Web.
    Sharma, Rohit. "Scaling Product Teams the Structured Way." Monetary Musings, Monetary Musings, 28 Nov. 2016 . Web.
    STEINER, ANNE. "Start to Scale Your Product Management: Multiple Teams Working on Single Product." Cprime, Cprime, 6 Aug. 2019 . Web.
    Shirazi, Reza. "Betsy Stockdale of Seilevel: Product Managers Are Not Afraid To Be Wrong." Austin VOP #50. 2 Oct. 2018. Web.
    Standish Group, The. "The Standish Group 2015 Chaos Report." The Standish Group. 2015. Web.
    Theus, Andre. "When Should You Scale the Product Management Team?" When Should You Scale the Product Management Team?, ProductPlan, 7 May 2019 . Web.
    Todaro, Dave. "Splitting Epics and User Stories." Ascendle. n.d. Web. Feb. 2019.
    Tolonen, Arto. "Scaling Product Management in a Single Product Company." Smartly.io - Digital Advertising Made Easy, Effective, and Enjoyable, Smartly.io, 26 Apr. 2018 . Web.
    Ulrich, Catherine. "The 6 Types of Product Managers. Which One Do You Need?" Medium.com. 19 Dec. 2017. Web.
    Vähäniitty, J. et al. "Chapter 7: Agile Product Management" in Towards Agile Product and Portfolio Management. Aalto University Software Process Research Group, 2010.
    VersionOne. "12th Annual State of Agile Report." VersionOne. 9 April 2018. Web.
    Verwijs, Christiaan. "Retrospective: Do The Team Radar." Medium.com. 10 Feb. 2017. Web.
    "Why Agile Fails Because of Corporate Culture - DZone Agile." Dzone.Com. Accessed 31 Aug. 2021.

    page 1 of the appendix
    page 2 of the appendix
    page 3 of the appendix
    page 4 of the appendix

    Cultural advantages of Agile

    Collaboration

    Team members leverage all their experience working towards a common goal.

    Iterations

    Cycles provide opportunities for more product feedback.

    Prioritization

    The most important needs are addressed in the current iteration.

    Continual Improvement

    Self-managing teams continually improve their approach for next iteration.

    A backlog stores and organizes PBIs at various stages of readiness

    A well-formed backlog can be thought of as a DEEP backlog:

    • Detailed Appropriately: Product backlog items (PBIs) are broken down and refined as necessary.
    • Emergent: The backlog grows and evolves over time as PBIs are added and removed.
    • Estimated: The effort a PBI requires is estimated at each tier.
    • Prioritized: The PBIs value and priority are determined at each tier.

    (Perforce, 2018)

    Info-Tech Best Practice

    Don't fully elaborate all of your PBIs at the beginning of the project instead, make sure they are elaborated "just in time." (Keep no more than 2 or 3 sprints worth of user stories in the Ready state.)

    An image showing the Ideas; Qualified; Ready; funnel leading to the sprint aproach.

    Scrum versus Kanban: Key differences

    page 6 of the appendix

    Scrum versus Kanban: When to use each

    Scrum: Delivering related or grouped changes in fixed time intervals.

    • Coordinating the development or release of related items
    • Maturing a product or service
    • Interdependencies between work items

    Kanban: Delivering independent items as soon as each is ready.

    • Work items from ticketing or individual requests
    • Completing independent changes
    • Releasing changes as soon as possible

    Develop an adaptive governance process

    page 7 of the appendix

    Five key principles for building an adaptive governance framework

    Delegate and Empower

    Decision making must be delegated down within the organization, and all resources must be empowered and supported to make effective decisions.

    Define Outcomes

    Outcomes and goals must be clearly articulated and understood across the organization to ensure decisions are in line and stay within reasonable boundaries.

    Make Risk informed decisions

    Integrated risk information must be available with sufficient data to support decision making and design approaches at all levels of the organization.

    Embed / Automate

    Governance standards and activities need to be embedded in processes and practices. Optimal governance reduces its manual footprint while remaining viable. This also allows for more dynamic adaptation.

    Establish standards and behavior

    Standards and policies need to be defined as the foundation for embedding governance practices organizationally. These guardrails will create boundaries to reinforce delegated decision making.

    Maturing governance is a journey

    Organizations should look to progress in their governance stages. Ad-Hoc, and controlled governance tends to be slow, expensive, and a poor fit for modern practices.

    The goal as you progress in your stages is to delegate governance and empower teams to make optimal decisions in real-time, knowing that they are aligned with the understood best interests of the organization.

    Automate governance for optimal velocity, while mitigating risks and driving value.

    This puts your organization in the best position to be adaptive and able to react effectively to volatility and uncertainty.

    page 8 of the appendix

    Business value is a key component to driving better decision making

    Better Decisions

    • Team Engagement
    • Frequent Delivery
    • Stakeholder Input
    • Market Analysis
    • Articulating Business Value
    • Focus on Business Needs

    Facilitation Planning Tool

    • Double-click the embedded Excel workbook to select and plan your exercises and timing.
    • Place or remove the "X" in the "Add to Agenda" column to add it to the workshop agenda and duration estimate.
    • Verify the exercise and step timing estimates from the blueprint provided on the "Detailed Workshop Planner" in columns C-F and adjust based on your facilitation and intended audience.

    an image of the Facilitation Planning Tool

    Appendix:
    SDLC transformation steps

    Waterfall SDLC: Valuable product delivered at the end of an extended project lifecycle, frequently in years

    Page 1 of the SDLC Appendix.

    • Business separated from delivery of technology it needs, only one third of product is actually valuable (Info-Tech, N=40,000).
    • In Waterfall, a team of experts in specific disciplines hand off different aspects of the lifecycle.
    • Document signoffs are required to ensure integration between silos (Business, Dev, and Ops) and individuals.
    • A separate change request process lays over the entire lifecycle to prevent changes from disrupting delivery.
    • Tools are deployed to support a specific role (e.g. BA) and seldom integrated (usually requirements <-> test).

    Wagile/Agifall/WaterScrumFall SDLC: Valuable product delivered in multiple releases

    Page 2 of the SDLC Appendix.

    • Business is more closely integrated by a business product owner accountable for day-to-day delivery of value for users.
    • The team collaborates and develops cross-functional skills as they define, design, build, and test code over time.
    • Signoffs are reduced but documentation is still focused on satisfying project delivery and operations policy requirements.
    • Change is built into the process to allow the team to respond to change dynamically.
    • Tools start to be integrated to streamline delivery (usually requirements and Agile work management tools).

    Agile SDLC: Valuable product delivered iteratively; frequency depends on Ops' capacity

    Page 3 of the SDLC Appendix.

    • Business users are closely integrated through regularly scheduled demos (e.g. every two weeks).
    • Team is fully cross-functional and collaboratesto plan, define, design, build, and test the code supported by specialists.
    • Documentation is focused on future development and operations needs.
    • Change is built into the process to allow the team to respond to change dynamically.
    • Explore automation for application development (e.g. automated regression testing).

    Agile with DevOps SDLC: High frequency iterative delivery of valuable product (e.g. every two weeks)

    Page 4 of the SDLC Appendix.

    • Business users are closely integrated through regularly scheduled demos.
    • Dev and ops teams collaborate to plan, define, design, build, test, and deploy code supported by automation.
    • Documentation is focused on supporting users, future changes, and operational support.
    • Change is built into the process to allow the team to respond to change dynamically.
    • Build, test, deploy is fully automated (service desk is still separated).

    DevOps SDLC: Continuous integration and delivery

    Page 5 of the SDLC Appendix.

    • Business users are closely integrated through regularly scheduled demos.
    • Fully integrated DevOps team collaborates to plan, define, design, build, test, deploy, and maintain code.
    • Documentation Is focused on future development and use adoption.
    • Change is built into the process to allow the team to respond to change dynamically.
    • Fully integrated development and operations toolchain.

    Fully integrated product SDLC: Agile + DevOps + continuous delivery of valuable product on demand

    Page 6 of the SDLC Appendix.

    • Business users are fully integrated with the teams through dedicated business product owner.
    • Cross-functional teams collaborate across the business and technical life of the product.
    • Documentation supports internal and external needs (business, users, Ops).
    • Change is built into the process to allow the team to respond to change dynamically.
    • Fully integrated toolchain (including service desk).

    Change Management's Role in Incident Prevention: standard changes

    • Large vertical image:
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    During peak business hours, I witnessed a straightforward database field addition bring down a whole e-commerce platform. It was meant to be standard procedure, the type of “standard change” that is automatically approved because we have performed it innumerable times.

    Adding a field to the end of a table and having applications retrieve data by field name instead of position made the change itself textbook low-impact. There is no need to alter the application or the functional flow. This could have been problematic in the past if you added a field in the middle of the list and it affected the values of other fields, but adding it at the end? That ought to have been impenetrable.

    However, it wasn't.

    Before I tell you what went wrong, let me explain why this is important to all of the IT professionals who are reading this.

    Over the past three decades, industry data has repeatedly supported what this incident taught me: our presumptions about “safe” changes are frequently our greatest weakness. Upon reviewing the ITIL research, I was not surprised to learn that failed changes, many of which were categorized as “standard” or “low-risk,” are responsible for about 80% of unplanned outages.

    When you look more closely, the numbers become even more concerning. Since I've been following the Ponemon Institute's work for years, I wasn't surprised to learn that companies with well-established change management procedures have 65% fewer unscheduled outages. The paradox surprised me: many of these “mature” procedures still operate under the premise that safety correlates with repetition.

    What I had been observing in the field for decades was confirmed when Gartner released their research showing that standard changes are responsible for almost 40% of change-related incidents. The very changes we consider safe enough to avoid thorough review subtly create some of our greatest risks. IBM's analysis supports the pattern I've seen in innumerable organizations: standard changes cause three times as much business disruption due to their volume and our decreased vigilance around them, whereas emergency changes receive all the attention and scrutiny.

    Aberdeen Group data indicates that the average cost of an unplanned outage has increased to $300,000 per hour, with change-related failures accounting for the largest category of preventable incidents. This data makes the financial reality stark.

    What precisely went wrong with the addition of that database field that caused our e-commerce platform to crash?

    We were unaware that the addition of this one field would cause the database to surpass an internal threshold, necessitating a thorough examination of its execution strategy. In its algorithmic wisdom, the database engine determined that the table structure had changed enough to necessitate rebuilding its access and retrieval mechanisms. Our applications relied on high-speed requests, and the new execution plan was terribly unoptimized for them.

    Instead of completing quotes or purchases, customers were spending minutes viewing error pages. All applications began to time out while they awaited data that just wasn't showing up in the anticipated amounts of time. Thousands of transactions were impacted by a single extra field that should have been invisible to the application layer.

    The field addition itself was not the primary cause. We assumed that since we had made similar adjustments dozens of times previously, this one would also act in the same way. Without taking into account the hidden complexities of database optimization thresholds, we had categorized it as a standard change based on superficial similarities.

    My approach to standard changes was completely altered by this experience, and it is now even more applicable in DevOps-driven environments. Many organizations use pipeline deployments, which produce a standard change at runtime. It's great for speed and reliability, but it can easily fall into the same trap.

    However, I have witnessed pipeline deployments result in significant incidents for non-code-related reasons. Due to timing, resource contention, or environmental differences that weren't noticeable in earlier runs, a deployment that performed flawlessly in development and staging abruptly fails in production. Although the automation boosts our confidence, it may also reveal blind spots.

    Over the course of thirty years, I have come to the unsettling realization that there is no such thing as a truly routine change in complex systems. Every modification takes place in a slightly different setting, with varying environmental factors, data states, and system loads. What we refer to as “standard changes” are actually merely modifications with comparable processes rather than risk profiles.

    For this reason, I support contextual change management. We must consider the system state, timing, dependencies, and cumulative effect of recent changes rather than just categorizing them based on their technical features. After three other changes have changed the system's behavior patterns, a change made at two in the morning on a Sunday with little system load is actually different from the same change made during peak business hours.

    Effective change advisory boards must therefore go beyond assessing individual changes separately. I've worked with organizations where the change board carefully considered and approved each modification on its own merits, only to find that the cumulative effect of seemingly unrelated changes led to unexpected interactions and stress on the system. The most developed change management procedures I've come across mandate that their advisory boards take a step back and look at the whole change portfolio over a specified period of time. They inquire whether we are altering the database too frequently during a single maintenance window. Could there be unanticipated interactions between these three different application updates? What is the total resource impact of this week's approved changes?

    It's the distinction between forest management and tree management. While each change may seem logical individually, when combined, they can create situations beyond the scope of any single change assessment.

    Having worked in this field for thirty years, I've come to the conclusion that our greatest confidences frequently conceal our greatest vulnerabilities. Our primary blind spots frequently arise from the changes we've made a hundred times before, the procedures we've automated and standardized, and the adjustments we've labeled as “routine.”

    Whether we should slow down our deployment pipelines or stop using standard changes is not the question. In the current competitive environment, speed and efficiency are crucial. The issue is whether we are posing the appropriate queries before carrying them out. Are we taking into account not only what the change accomplishes but also when it occurs, what else is changing at the same time, and how our systems actually look right now?

    I've discovered that the phrase “we've done this before” is more dangerous in IT operations than “what could go wrong?” Because, despite what we may believe, we never actually perform the same action twice in complex systems.

    Here is what I would like you to think about: which everyday modifications are subtly putting your surroundings at risk? Which procedures have you standardized or automated to the extent that you no longer challenge their presumptions? Most importantly, when was the last time your change advisory board examined your changes as a cohesive portfolio of system modifications rather than as discrete items on a checklist?

    Remember that simple addition to a database field the next time you're tempted to accept a standard change. The most unexpected outcomes can occasionally result from the most routine adjustments.

    I'm always up for a conversation if you want to talk about your difficulties with change management.

    Explore the Secrets of Oracle Cloud Licensing

    • Buy Link or Shortcode: {j2store}142|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: 5 Average Days Saved
    • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • Parent Category Name: Licensing
    • Parent Category Link: /licensing
    • Organizations are considering moving workloads to the cloud; however, they often struggle to understand Oracle's licensing and services models.
    • Complexity of licensing and high price tags can make the renewal process an overwhelming experience.
    • Oracle’s SaaS applications are the most mature, but Oracle’s on-premises E-Business Suite still has functionality gaps in comparison to Oracle’s cloud apps.

    Our Advice

    Critical Insight

    • Understand the Oracle agenda. Oracle has established a unique approach to their cloud offerings – they want all of your workloads on the Red Stack.
    • Communicate effectively. Be aware that Oracle will reach out to members at your organization at various levels. Having your executives on the same page is critical to successfully managing Oracle.
    • Negotiate hard. Oracle needs the deal more than the customer. Oracle's top leaders are heavily incentivized to drive massive cloud adoption and increase Oracle's share price. Use this to your advantage.

    Impact and Result

    • Conducting business with Oracle is not typical compared to other vendors. To emerge successfully from a commercial transaction with Oracle, customers must learn the “Oracle way” of conducting business, which includes a best-in-class sales structure, highly unique contracts, and license use policies coupled with a hyper-aggressive compliance function.
    • Leverage cloud spend to retire support on shelf-ware licenses, or gain virtualization rights for an on-premises environment.
    • Map out the process of how to negotiate from a position of strength, examining terms and conditions, discount percentages, and agreement pitfalls.
    • Carefully review key clauses in the Oracle Cloud Services Agreement to avoid additional spend and compliance risks.

    Explore the Secrets of Oracle Cloud Licensing Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should explore the secrets of Oracle Cloud licensing, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Evaluate licensing requirements

    Review current licensing options and models to determine which cloud products will most appropriately fit the organization's environment.

    • Oracle Cloud Services Agreement Terms and Conditions Evaluation Tool
    [infographic]

    Define Your Cloud Vision

    • Buy Link or Shortcode: {j2store}448|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $182,333 Average $ Saved
    • member rating average days saved: 28 Average Days Saved
    • Parent Category Name: Cloud Strategy
    • Parent Category Link: /cloud-strategy

    The cloud permeates the enterprise technology discussion. It can be difficult to separate the hype from the value. Should everything go to the cloud, or is that sentiment stoked by vendors looking to boost their bottom lines? Not everything should go to the cloud, but coming up with a systematic way to determine what belongs where is increasingly difficult as offerings get more complex.

    Our Advice

    Critical Insight

    Don’t think about the cloud as an inevitable next step for all workloads. The cloud is merely another tool in the toolbox, ready to be used when appropriate and put away when it’s not needed. Cloud-first isn’t always the way to go.

    Impact and Result

    • Evaluate workloads’ suitability for the cloud using Info-Tech’s methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
    • Codify risks tied to workloads’ cloud suitability and plan mitigations.
    • Build a roadmap of initiatives for actions by workload and risk mitigation.
    • Define a cloud vision to share with stakeholders.

    Define Your Cloud Vision Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define Your Cloud Vision – A step-by-step guide to generating, validating, and formalizing your cloud vision.

    The cloud vision storyboard walks readers through the process of generating, validating and formalizing a cloud vision, providing a framework and tools to assess workloads for their cloud suitability and risk.

    • Define Your Cloud Vision – Phases 1-4

    2. Cloud Vision Executive Presentation – A document that captures the results of the exercises, articulating use cases for cloud/non-cloud, risks, challenges, and high-level initiative items.

    The executive summary captures the results of the vision exercise, including decision criteria for moving to the cloud, risks, roadblocks, and mitigations.

    • Cloud Vision Executive Presentation

    3. Cloud Vision Workbook – A tool that facilitates the assessment of workloads for appropriate service model, delivery model, support model, and risks and roadblocks.

    The cloud vision workbook comprises several assessments that will help you understand what service model, delivery model, support model, and risks and roadblocks you can expect to encounter at the workload level.

    • Cloud Vision Workbook
    [infographic]

    Workshop: Define Your Cloud Vision

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Understand the Cloud

    The Purpose

    Align organizational goals to cloud characteristics.

    Key Benefits Achieved

    An understanding of how the characteristics particular to cloud can support organizational goals.

    Activities

    1.1 Generate corporate goals and cloud drivers.

    1.2 Identify success indicators.

    1.3 Explore cloud characteristics.

    1.4 Explore cloud service and delivery models.

    1.5 Define cloud support models and strategy components.

    1.6 Create state summaries for the different service and delivery models.

    1.7 Select workloads for further analysis.

    Outputs

    Corporate cloud goals and drivers

    Success indicators

    Current state summaries

    List of workloads for further analysis

    2 Assess Workloads

    The Purpose

    Evaluate workloads for cloud value and action plan.

    Key Benefits Achieved

    Action plan for each workload.

    Activities

    2.1 Conduct workload assessment using the Cloud Strategy Workbook tool.

    2.2 Discuss assessments and make preliminary determinations about the workloads.

    Outputs

    Completed workload assessments

    Workload summary statements

    3 Identify and Mitigate Risks

    The Purpose

    Identify and plan to mitigate potential risks in the cloud project.

    Key Benefits Achieved

    A list of potential risks and plans to mitigate them.

    Activities

    3.1 Generate a list of risks and potential roadblocks associated with the cloud.

    3.2 Sort risks and roadblocks and define categories.

    3.3 Identify mitigations for each identified risk and roadblock

    3.4 Generate initiatives from the mitigations.

    Outputs

    List of risks and roadblocks, categorized

    List of mitigations

    List of initiatives

    4 Bridge the Gap and Create the Strategy

    The Purpose

    Clarify your vision of how the organization can best make use of cloud and build a project roadmap.

    Key Benefits Achieved

    A clear vision and a concrete action plan to move forward with the project.

    Activities

    4.1 Review and assign work items.

    4.2 Finalize the decision framework for each of the following areas: service model, delivery model, and support model.

    4.3 Create a cloud vision statement

    Outputs

    Cloud roadmap

    Finalized task list

    Formal cloud decision rubric

    Cloud vision statement

    5 Next Steps and Wrap-Up

    The Purpose

    Complete your cloud vision by building a compelling executive-facing presentation.

    Key Benefits Achieved

    Simple, straightforward communication of your cloud vision to key stakeholders.

    Activities

    5.1 Build the Cloud Vision Executive Presentation

    Outputs

    Completed cloud strategy executive presentation

    Completed Cloud Vision Workbook.

    Further reading

    Define Your Cloud Vision

    Define your cloud vision before it defines you

    Analyst perspective

    Use the cloud’s strengths. Mitigate its weaknesses.

    The cloud isn’t magic. It’s not necessarily cheaper, better, or even available for the thing you want it to do. It’s not mysterious or a cure-all, and it does take a bit of effort to systematize your approach and make consistent, defensible decisions about your cloud services. That’s where this blueprint comes in.

    Your cloud vision is the culmination of this effort all boiled down into a single statement: “This is how we want to use the cloud.” That simple statement should, of course, be representative of – and built from – a broader, contextual strategy discussion that answers the following questions: What should go to the cloud? What kind of cloud makes sense? Should the cloud deployment be public, private, or hybrid? What does a migration look like? What risks and roadblocks need to be considered when exploring your cloud migration options? What are the “day 2” activities that you will need to undertake after you’ve gotten the ball rolling?

    Taken as a whole, answering these questions is difficult task. But with the framework provided here, it’s as easy as – well, let’s just say it’s easier.

    Jeremy Roberts

    Research Director, Infrastructure and Operations

    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • You are both extrinsically motivated to move to the cloud (e.g. by vendors) and intrinsically motivated by internal digital transformation initiatives.
    • You need to define the cloud’s true value proposition for your organization without assuming it is an outsourcing opportunity or will save you money.
    • Your industry, once cloud-averse, is now normalizing the use of cloud services, but you have not established a basic cloud vision from which to develop a strategy at a later point.

    Common Obstacles

    • Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
    • Many organizations have a foot in the cloud already, but these decisions have been made in an ad hoc rather than systematic fashion.
    • You lack a consistent framework to assess your workloads’ suitability for the cloud.

    Info-Tech's Approach

    • Evaluate workloads’ suitability for the cloud using Info-Tech’s methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
    • Codify risks tied to workloads’ cloud suitability and plan mitigations.
    • Build a roadmap of initiatives for actions by workload and risk mitigation.
    • Define a cloud vision to share with stakeholders.

    Info-Tech Insight: 1) Base migration decisions on cloud characteristics. If your justification for the migration is simply getting your workload out of the data center, think again. 2) Address the risks up front in your migration plan. 3) The cloud changes roles and calls for different skill sets, but Ops is here to stay.

    Your challenge

    This research is designed to help organizations who need to:

    • Identify workloads that are good candidates for the cloud.
    • Develop a consistent, cost-effective approach to cloud services.
    • Outline and mitigate risks.
    • Define your organization’s cloud archetype.
    • Map initiatives on a roadmap.
    • Communicate your cloud vision to stakeholders so they can understand the reasons behind a cloud decision and differentiate between different cloud service and deployment models.
    • Understand the risks, roadblocks, and limitations of the cloud.

    “We’re moving from a world where companies like Oracle and Microsoft and HP and Dell were all critically important to a world where Microsoft is still important, but Amazon is now really important, and Google also matters. The technology has changed, but most of the major vendors they’re betting their business on have also changed. And that’s super hard for people..” –David Chappell, Author and Speaker

    Common obstacles

    These barriers make this challenge difficult to address for many organizations:

    • Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
    • Many organizations already have a foot in the cloud, but the choice to explore these solutions was made in an ad hoc rather than systematic fashion. The cloud just sort of happened.
    • The lack of a consistent assessment framework means that some workloads that probably belong in the cloud are kept on premises or with hosted services providers – and vice versa.
    • Securing cloud expertise is remarkably difficult – especially in a labor market roiled by the global pandemic and the increasing importance of cloud services.

    Standard cloud challenges

    30% of all cloud spend is self-reported as waste. Many workloads that end up in the cloud don’t belong there. Many workloads that do belong in the cloud aren’t properly migrated. (Flexera, 2021)

    44% of respondents report themselves as under-skilled in the cloud management space. (Pluralsight, 2021)

    Info-Tech’s approach

    Goals and drivers

    • Service model
      • What type of cloud makes the most sense for workload archetypes? When does it make sense to pick SaaS over IaaS, for example?
    • Delivery model
      • Will services be delivered over the public cloud, a private cloud, or a hybrid cloud? What challenges accompany this decision?
    • Migration Path
      • What does the migration path look like? What does the transition to the cloud look like, and how much effort will be required? Amazon’s 6Rs framework captures migration options: rehosting, repurchasing, replatforming, and refactoring, along with retaining and retiring. Each workload should be assessed for its suitability for one or more of these paths.
    • Support model
      • How will services be provided? Will staff be trained, new staff hired, a service provider retained for ongoing operations, or will a consultant with cloud expertise be brought on board for a defined period? The appropriate support model is highly dependent on goals along with expected outcomes for different workloads.

    Highlight risks and roadblocks

    Formalize cloud vision

    Document your cloud strategy

    The Info-Tech difference:

    1. Determine the hypothesized value of cloud for your organization.
    2. Evaluate workloads with 6Rs framework.
    3. Identify and mitigate risks.
    4. Identify cloud archetype.
    5. Plot initiatives on a roadmap.
    6. Write action plan statement and goal statement.

    What is the cloud, how is it deployed, and how is service provided?

    Cloud Characteristics

    1. On-demand self-service: the ability to access reosurces instantly without vendor interaction
    2. Broad network access: all services delivered over the network
    3. Resource pooling: multi-tenant environment (shared)
    4. Rapid elasticity: the ability to expand and retract capabilities as needed
    5. Measured service: transparent metering

    Service Model:

    1. Software-as-a-Service: all but the most minor configuration is done by the vendor
    2. Platform-as-a-Service: customer builds the application using tools provided by the provider
    3. Infrastructure-as-a-Service: the customer manages OS, storage, and the application

    Delivery Model

    1. Public cloud: accessible to anyone over the internet; multi-tenant environment
    2. Private cloud: provisioned for a single organization with multiple units
    3. Hybrid cloud: two or more connected clouds; data is portage across them
    4. Community cloud: provisioned for a specific group of organizations

    (National Institute of Standards and Technology)

    A workload-first approach will allow you to take full advantage of the cloud’s strengths

    • Under all but the most exceptional circumstances, good cloud strategies will incorporate different service models. Very few organizations are “IaaS shops” or “SaaS shops,” even if they lean heavily in one direction.
    • These different service models (including non-cloud options like colocation and on-premises infrastructure) each have different strengths. Part of your cloud strategy should involve determining which of the services makes the most sense for you.
    • Own the cloud by understanding which cloud (or non-cloud!) offering makes the most sense for you given your unique context.

    Migration paths

    In a 2016 blog post, Amazon introduced a framework for understanding cloud migration strategies. The framework presented here is slightly modified – including a “relocate” component rather than a “retire” component – but otherwise hews close to the standard.

    These migration paths reflect organizational capabilities and desired outcomes in terms of service models – cloud or otherwise. Retention means keeping the workload where it is, in a datacenter or a colocation service, or relocating to a colocation or hosted software environment. These represent the “non-cloud” migration paths.

    In the graphic on the right, the paths within the red box lead to the cloud. Rehosting means lifting and shifting to an infrastructure environment. Migrating a virtual machine from your VMware environment on premises to Azure Virtual machines is a quick way to realize some benefits from the cloud. Migrating from SQL Server on premises to a cloud-based SQL solution looks a bit more like changing platforms (replatforming). It involves basic infrastructure modification without a substantial architectural component.

    Refactoring is the most expensive of the options and involves engaging the software development lifecycle to build a custom solution, fundamentally rewriting the solution to be cloud native and take advantage of cloud-native architectures. This can result in a PaaS or an IaaS solution.

    Finally, repurchasing means simply going to market and procuring a new solution. This may involve migrating data, but it does not require the migration of components.

    Migration Paths

    Retain (Revisit)

    • Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

    Relocate

    • Move the workload between datacenters or to a hosted software/colocation provider.

    Rehost

    • Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

    Replatform

    • Move the application to the cloud and perform a few changes for cloud optimizations.

    Refactor

    • Rewrite the application, taking advantage of cloud-native architectures.

    Repurchase

    • Replace with an alternative, cloud-native application and migrate the data.

    Support model

    Support models by characteristic

    Duration of engagement Specialization Flexibility
    Internal IT Indefinite Varies based on nature of business Fixed, permanent staff
    Managed Service Provider Contractually defined General, some specialization Standard offering
    Consultant Project-based Specific, domain-based Entirely negotiable

    IT services, including cloud services, can be delivered and managed in multiple ways depending on the nature of the workload and the organization’s intended path forward. Three high-level options are presented here and may be more or less valuable based on the duration of the expected engagement with the service (temporary or permanent), the skills specialization required, and the flexibility necessary to complete the job.

    By way of example, a highly technical, short-term project with significant flexibility requirements might be a good fit for an expensive consultant, whereas post-implementation maintenance of a cloud email system requires relatively little specialization and flexibility and would therefore be a better fit for internal management.

    There is no universally applicable rule here, but there are some workloads that are generally a good fit for the cloud and others that are not as effective, with that fit being conditional on the appropriate support model being employed.

    Risks, roadblocks, and strategy components

    No two cloud strategies are exactly alike, but all should address 14 key areas. A key step in defining your cloud vision is an assessment of these strategy components. Lower maturity does not preclude an aggressive cloud strategy, but it does indicate that higher effort will be required to make the transition.

    Component Description Component Description
    Monitoring What will system owners/administrators need visibility into? How will they achieve this? Vendor Management What practices must change to ensure effective management of cloud vendors?
    Provisioning Who will be responsible for deploying cloud workloads? What governance will this process be subject to? Finance Management How will costs be managed with the transition away from capital expenditure?
    Migration How will cloud migrations be conducted? What best practices/standards must be employed? Security What steps must be taken to ensure that cloud services meet security requirements?
    Operations management What is the process for managing operations as they change in the cloud? Data Controls How will data residency, compliance, and protection requirements be met in the cloud?
    Architecture What general principles must apply in the cloud environment? Skills and roles What skills become necessary in the cloud? What steps must be taken to acquire those skills?
    Integration and interoperability How will services be integrated? What standards must apply? Culture and adoption Is there a cultural aversion to the cloud? What steps must be taken to ensure broad cloud acceptance?
    Portfolio Management Who will be responsible for managing the growth of the cloud portfolio? Governing bodies What formal governance must be put in place? Who will be responsible for setting standards?

    Cloud archetypes – a cloud vision component

    Once you understand the value of the cloud, your workloads’ general suitability for cloud, and your proposed risks and mitigations, the next step is to define your cloud archetype.

    Your organization’s cloud archetype is the strategic posture that IT adopts to best support the organization’s goals. Info-Tech’s model recognizes seven archetypes, divided into three high-level archetypes.

    After consultation with your stakeholders, and based on the results of the suitability and risk assessment activities, define your archetype. The archetype feeds into the overall cloud vision and provides simple insight into the cloud future state for all stakeholders.

    The cloud vision itself is captured in a “vision statement,” a short summary of the overall approach that includes the overall cloud archetype.

    We can best support the organization's goals by:

    More Cloud

    Less Cloud

    Cloud Focused Cloud-Centric Providing all workloads through cloud delivery.
    Cloud-First Using the cloud as our default deployment model. For each workload, we should ask “why NOT cloud?”
    Cloud Opportunistic Hybrid Enabling the ability to transition seamlessly between on-premises and cloud resources for many workloads.
    Integrated Combining cloud and traditional infrastructure resources, integrating data and applications through APIs or middleware.
    Split Using the cloud for some workloads and traditional infrastructure resources for others.
    Cloud Averse Cloud-Light Using traditional infrastructure resources and limiting our use of the cloud to when it is absolutely necessary.
    Anti-Cloud Using traditional infrastructure resources and avoiding use of the cloud wherever possible.

    Info-Tech’s methodology for defining your cloud vision

    1. Understand the Cloud 2. Assess Workloads 3. Identify and Mitigate Risks 4. Bridge the Gap and Create the Vision
    Phase Steps
    1. Generate goals and drivers
    2. Explore cloud characteristics
    3. Create a current state summary
    4. Select workloads for analysis
    1. Conduct workload assessments
    2. Determine workload future state
    1. Generate risks and roadblocks
    2. Mitigate risks and roadblocks
    3. Define roadmap initiatives
    1. Review and assign work items
    2. Finalize cloud decision framework
    3. Create cloud vision
    Phase Outcomes
    1. List of goals and drivers
    2. Shared understanding of cloud terms
    3. Current state of cloud in the organization
    4. List of workloads to be assessed
    1. Completed workload assessments
    2. Defined workload future state
    1. List of risks and roadblocks
    2. List of mitigations
    3. Defined roadmap initiatives
    1. Cloud roadmap
    2. Cloud decision framework
    3. Completed Cloud Vision Executive Presentation

    Insight summary

    The cloud may not be right for you – and that’s okay!

    Don’t think about the cloud as an inevitable next step for all workloads. The cloud is merely another tool in the toolbox, ready to be used when appropriate and put away when it’s not needed. Cloud first isn’t always the way to go.

    Not all clouds are equal

    It’s not “should I go to the cloud?” but “what service and delivery models make sense based on my needs and risk tolerance?” Thinking about the cloud as a binary can force workloads into the cloud that don’t belong (and vice versa).

    Bottom-up is best

    A workload assessment is the only way to truly understand the cloud’s value. Work from the bottom up, not the top down, understand what characteristics make a workload cloud suitable, and strategize on that basis.

    Your accountability doesn’t change

    You are still accountable for maintaining available, secure, functional applications and services. Cloud providers share some responsibility, but the buck stops where it always has: with you.

    Don’t customize for the sake of customization

    SaaS providers make money selling the same thing to everyone. When migrating a workload to SaaS, work with stakeholders to pursue standardization around a selected platform and avoid customization where possible.

    Best of both worlds, worst of both worlds

    Hybrid clouds are in fashion, but true hybridity comes with additional cost, administration, and other constraints. A convoy moves at the speed of its slowest member.

    The journey matters as much as the destination

    How you get there is as important as what “there” actually is. Any strategy that focuses solely on the destination misses out on a key part of the value conversation: the migration strategy.

    Blueprint benefits

    Cloud Vision Executive Presentation

    This presentation captures the results of the exercises and presents a complete vision to stakeholders including a desired target state, a rubric for decision making, the results of the workload assessments, and an overall risk profile.

    Cloud Vision Workbook

    This workbook includes the standard cloud workload assessment questionnaire along with the results of the assessment. It also includes the milestone timeline for the implementation of the cloud vision.

    Blueprint benefits

    IT Benefits

    • A consistent approach to the cloud takes the guesswork out of deployment decisions and makes it easier for IT to move on to the execution stage.
    • When properly incorporated, cloud services come with many benefits, including automation, elasticity, and alternative architectures (micro-services, containers). The cloud vision project will help IT readers articulate expected benefits and work towards achieving them.
    • A clear framework for incorporating organizational goals into cloud plans.

    Business benefits

    • Simple, well-governed access to high-quality IT resources.
    • Access to the latest and greatest in technology to facilitate remote work.
    • Framework for cost management in the cloud that incorporates OpEx and chargebacks/showbacks. A clear understanding of expected changes to cost modeling is also a benefit of a cloud vision.
    • Clarity for stakeholders about IT’s response (and contribution to) IT strategic initiatives.

    Measure the value of this blueprint

    Don’t take our word for it:

    • The cloud vision material in various forms has been offered for several years, and members have generally benefited substantially, both from cloud vision workshops and from guided implementations led by analysts.
    • After each engagement, we send a survey that asks members how they benefited from the experience. Of 30 responses, the cloud vision research has received an average score of 9.8/10. Real members have found significant value in the process.
    • Additionally, members reported saving between 2 and 120 days (for an average of 17), and financial savings ranged from $1,920 all the way up to $1.27 million, for an average of $170,577.90! If we drop outliers on both ends, the average reported value of a cloud vision engagement is $37, 613.
    • Measure the value by calculating the time saved from using Info-Tech’s framework vs. a home-brewed cloud strategy alternative and by comparing the overall cost of a guided implementation or workshop with the equivalent offering from another firm. We’re confident you’ll come out ahead.

    9.8/10 Average reported satisfaction

    17 Days Average reported time savings

    $37, 613 Average cost savings (adj.)

    Executive Brief Case Study

    Industry: Financial

    Source: Info-Tech workshop

    Anonymous financial institution

    A small East Coast financial institution was required to develop a cloud strategy. This strategy had to meet several important requirements, including alignment with strategic priorities and best practices, along with regulatory compliance, including with the Office of the Comptroller of the Currency.

    The bank already had a significant cloud footprint and was looking to organize and formalize the strategy going forward.

    Leadership needed a comprehensive strategy that touched on key areas including the delivery model, service models, individual workload assessments, cost management, risk management and governance. The output had to be consumable by a variety of audiences with varying levels of technical expertise and had to speak to IT’s role in the broader strategic goals articulated earlier in the year.

    Results

    The bank engaged Info-Tech for a cloud vision workshop and worked through four days of exercises with various IT team members. The bank ultimately decided on a multi-cloud strategy that prioritized SaaS while also allowing for PaaS and IaaS solutions, along with some non-cloud hosted solutions, based on organizational circumstances.

    Bank cloud vision

    [Bank] will provide innovative financial and related services by taking advantage of the multiplicity of best-of-breed solutions available in the cloud. These solutions make it possible to benefit from industry-level innovations, while ensuring efficiency, redundancy, and enhanced security.

    Bank cloud decision workflow

    • SaaS
      • Platform?
        • Yes
          • PaaS
        • No
          • Hosted
        • IaaS
          • Other

    Non-cloud

    Cloud

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    "Our team has already made this crticial project a priority, and we have the time and capability, but some guidance along the way would be helpful."

    Guided Implementation

    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

    Workshop

    "We need to hit the ground running and get this project kicked off imediately. Our team has the ability to take this over once we get a framework and strategy in place."

    Consulting

    "Our team does not have the time or the knowledge the take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks are used throughout all four options.

    Guided Implementation

    What does a typical GI on this topic look like?

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

    Phase 1

    • Call #1: Discuss current state, challenges, etc.
    • Call #2: Goals, drivers, and current state.

    Phase 2

    • Call #3: Conduct cloud suitability assessment for selected workloads.

    Phase 3

    • Call #4: Generate and categorize risks.
    • Call #5: Begin the risk mitigation conversation.

    Phase 4

    • Call #6: Complete the risk mitigation process
    • Call #7: Finalize vision statement and cloud decision framework.

    Workshop Overview

    Contact your account representative for more information.

    workshops@infotech.com 1-888-670-8889

    Day 1 Day 2 Day 3 Day 4 Offsite day
    Understand the cloud Assess workloads Identify and mitigate risks Bridge the gap and create the strategy Next steps and wrap-up (offsite)
    Activities

    1.1 Introduction

    1.2 Generate corporate goals and cloud drivers

    1.3 Identify success indicators

    1.4 Explore cloud characteristics

    1.5 Explore cloud service and delivery models

    1.6 Define cloud support models and strategy components

    1.7 Create current state summaries for the different service and delivery models

    1.8 Select workloads for further analysis

    2.1 Conduct workload assessments using the cloud strategy workbook tool

    2.2 Discuss assessments and make preliminary determinations about workloads

    3.1 Generate a list of risks and potential roadblocks associated with the cloud

    3.2 Sort risks and roadblocks and define categories

    3.3 Identify mitigations for each identified risk and roadblock

    3.4 Generate initiatives from the mitigations

    4.1 Review and assign work items

    4.2 Finalize the decision framework for each of the following areas:

    • Service model
    • Delivery model
    • Support model

    4.3 Create a cloud vision statement

    5.1 Build the Cloud Vision Executive Presentation
    Deliverables
    1. Corporate goals and cloud drivers
    2. Success indicators
    3. Current state summaries
    4. List of workloads for further analysis
    1. Completed workload assessments
    2. Workload summary statements
    1. List of risks and roadblocks, categorized
    2. List of mitigations
    3. List of initiatives
    1. Finalized task list
    2. Formal cloud decision rubric
    3. Cloud vision statement
    1. Completed cloud strategy executive presentation
    2. Completed cloud vision workbook

    Understand the cloud

    Build the foundations of your cloud vision

    Phase 1

    Phase 1

    Understand the Cloud

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    1.1.1 Generate organizational goals

    1.1.2 Define cloud drivers

    1.1.3 Define success indicators

    1.3.1 Record your current state

    1.4.1 Select workloads for further assessment

    This phase involves the following participants:

    IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders.

    It starts with shared understanding

    Stakeholders must agree on overall goals and what “cloud” means

    The cloud is a nebulous term that can reasonably describe services ranging from infrastructure as a service as delivered by providers like Amazon Web Services and Microsoft through its Azure platform, right up to software as a service solutions like Jira or Salesforce. These solutions solve different problems – just because your CRM would be a good fit for a migration to Salesforce doesn’t mean the same system would make sense in Azure or AWS.

    This is important because the language we use to talk about the cloud can color our approach to cloud services. A “cloud-first” strategy will mean something different to a CEO with a concept of the cloud rooted in Salesforce than it will to a system administrator who interprets it to mean a transition to cloud-hosted virtual machines.

    Add to this the fact that not all cloud services are hosted externally by providers (public clouds) and the fact that multiple delivery models can be engaged at once through hybrid or multi-cloud approaches, and it’s apparent that a shared understanding of the cloud is necessary for a coherent strategy to take form.

    This phase proceeds in four steps, each governed by the principle of shared understanding. The first requires a shared understanding of corporate goals and drivers. Step 2 involves coming to a shared understanding of the cloud’s unique characteristics. Step 3 requires a review of the current state. Finally, in Step 4, participants will identify workloads that are suitable for analysis as candidates for the cloud.

    Step 1.1

    Generate goals and drivers

    Activities

    1.1.1 Define organizational goals

    1.1.2 Define cloud drivers

    1.1.3 Define success indicators

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    This step involves the following participants:

    • IT management
    • Core working group
    • Security
    • Applications
    • Infrastructure
    • Service management
    • Leadership

    Outcomes of this step

    • List of organizational goals
    • List of cloud drivers
    • Defined success indicators

    What can the cloud do for you?

    The cloud is not valuable for its own sake, and not all users derive the same value

    • The cloud is characterized by on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Any or all of those characteristics might be enough to make the cloud appealing, but in most cases, there is an overriding driver.
    • Multiple paths may lead to the cloud. Consider an organization with a need to control costs by showing back to business units, or perhaps by reducing capital expenditure – the cloud may be the most appropriate way to effect these changes. Conversely, an organization expanding rapidly and with a need to access the latest and greatest technology might benefit from the elasticity and pooled resources that major cloud providers can offer.
    • In these cases, the destination might be the same (a cloud solution) but the delivery model – public, private, or hybrid – and the decisions made around the key strategy components, including architecture, provisioning, and cost management, will almost certainly be different.
    • Defining goals, understanding cloud drivers, and – crucially – understanding what success means, are all therefore essential elements of the cloud vision process.

    1.1.1 Generate organizational goals

    1-3 hours

    Input

    • Strategy documentation

    Output

    • Organizational goals

    Materials

    • Whiteboard (digital/physical)

    Participants

    • IT leadership
    • Infrastructure
    • Applications
    • Security
    1. As a group, brainstorm organizational goals, ideally based on existing documentation
      • Review relevant corporate and IT strategies.
      • If you do not have access to internal documentation, review the standard goals on the next slide and select those that are most relevant for you.
    2. Record the most important business goals in the Cloud Vision Executive Presentation. Include descriptions where possible to ensure wide readability.
    3. Make note of these goals. They should inform the answers to prompts offered in the Cloud Vision Workbook and should be a consistent presence in the remainder of the visioning exercise. If you’re conducting the session in person, leave the goals up on a whiteboard and make reference to them throughout the workshop.

    Cloud Vision Executive Presentation

    Standard COBIT 19 enterprise goals

    1. Portfolio of competitive products and services
    2. Managed business risk
    3. Compliance with external laws and regulations
    4. Quality of financial information
    5. Customer-oriented service culture
    6. Business service continuity and availability
    7. Quality of management information
    8. Optimization of internal business process functionality
    9. Optimization of business process costs
    10. Staff skills, motivation, and productivity
    11. Compliance with internal policies
    12. Managed digital transformation programs
    13. Product and business innovation

    1.1.2 Define cloud drivers

    30-60 minutes

    Input

    • Organizational goals
    • Strategy documentation
    • Management/staff perspective

    Output

    • List of cloud drivers

    Materials

    • Sticky notes
    • Whiteboard
    • Markers

    Participants

    • IT leadership
    • Infrastructure
    • Applications
    • Security
    1. Cloud drivers sit at a level of abstraction below organizational goals. Keeping your organizational goals in mind, have each participant in the session write down how they expect to benefit from the cloud on a sticky note.
    2. Solicit input one at a time and group similar responses. Encourage participants to bring forward their cloud goals even if similar goals have been mentioned previously. The number of mentions is a useful way to gauge the relative weight of the drivers.
    3. Once this is done, you should have a few groups of similar drivers. Work with the group to name each category. This name will be the driver reported in the documentation.
    4. Input the results of the exercise into the Cloud Vision Executive Presentation, and include descriptions based on the constituent drivers. For example, if a driver is titled “do more valuable work,” the constituent drivers might be “build cloud skills,” “focus on core products,” and “avoid administration work where possible.” The description would be based on these components.

    Cloud Vision Executive Presentation

    1.1.3 Define success indicators

    1 hour

    Input

    • Cloud drivers
    • Organizational goals

    Output

    • List of cloud driver success indicators

    Materials

    • Whiteboard
    • Markers

    Participants

    • IT leadership
    • Infrastructure
    • Applications
    • Security
    1. On a whiteboard, draw a table with each of the cloud drivers (identified in 1.1.2) across the top.
    2. Work collectively to generate success indicators for each cloud driver. In this case, a success indicator is some way you can report your progress with the stated driver. It is a real-world proxy for the sometimes abstract phenomena that make up your drivers. Think about what would be true if your driver was realized.
      1. For example, if your driver is “faster access to resources,” you might consider indicators like developer satisfaction, project completion time, average time to provision, etc.
    3. Once you are satisfied with your list of indicators, populate the slide in the Cloud Vision Executive Presentation for validation from stakeholders.

    Cloud Vision Executive Presentation

    Step 1.2

    Explore cloud characteristics

    Activities

    Understand the value of the cloud:

    • Review delivery models
    • Review support models
    • Review service models
    • Review migration paths

    Understand the Cloud

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    This step involves the following participants:

    • Core working group
    • Architecture
    • Engineering
    • Security

    Outcomes of this step

    • Understanding of cloud service models and value

    Defining the cloud

    Per NIST, the cloud has five fundamental characteristics. All clouds have these characteristics, even if they are executed in somewhat different ways between delivery models, service models, and even individual providers.

    Cloud characteristics

    On-demand self-service

    Cloud customers are capable of provisioning cloud resources without human interaction (e.g. contacting sales), generally through a web console.

    Broad network access

    Capabilities are designed to be delivered over a network and are generally intended for access by a wide variety of platform types (cloud services are generally device-agnostic).

    Resource pooling

    Multiple customers (internal, in the case of private clouds) make use of a highly abstracted shared infrastructure managed by the cloud provider.

    Rapid elasticity

    Customers are capable of provisioning additional resources as required, pulling from a functionally infinite pool of capacity. Cloud resources can be spun-down when no longer needed.

    Measured service

    Consumption is metered based on an appropriate unit of analysis (number of licenses, storage used, compute cycles, etc.) and billing is transparent and granular.

    Cloud delivery models

    The NIST definition of cloud computing outlines four cloud delivery models: public, private, hybrid, and community clouds. A community cloud is like a private cloud, but it is provisioned for the exclusive use of a like-minded group of organizations, usually in a mutually beneficial, non-competitive arrangement. Universities and hospitals are examples of organizations that can pool their resources in this way without impacting competitiveness. The Info-Tech model covers three key delivery models – public, private, and hybrid, and an overarching model (multi-cloud) that can comprise more than one of the other models – public + public, public + hybrid, etc.

    Public

    The cloud service is provisioned for access by the general public (customers).

    Private

    A private cloud has the five key characteristics, but is provisioned for use by a single entity, like a company or organization.

    Hybrid

    Hybridity essentially refers to interoperability between multiple cloud delivery models (public +private).

    Multi

    A multi-cloud deployment requires only that multiple clouds are used without any necessary interoperability (Nutanix, 2019).

    Public cloud

    This is what people generally think about when they talk about cloud

    • The public cloud is, well, public! Anyone can make use of its resources, and in the case of the major providers, capacity is functionally unlimited. Need to store exabytes of data in the cloud? No problem! Amazon will drive a modified shipping container to your datacenter, load it up, and “migrate” it to a datacenter.
    • Public clouds offer significant variety on the infrastructure side. Major IaaS providers, like Microsoft and Amazon, offer dozens of services across many different categories including compute, networking, and storage, but also identity, containers, machine learning, virtual desktops, and much, much more. (See a list from Microsoft here, and Amazon here)
    • There are undoubtedly strengths to the public cloud model. Providers offer the “latest and greatest” and customers need not worry about the details, including managing infrastructure and physical locations. Providers offer built-in redundancy, multi-regional deployments, automation tools, management and governance solutions, and a variety of leading-edge technologies that would not be feasible for organizations to run in-house, like high performance compute, blockchain, or quantum computing.
    • Of course, the public cloud is not all sunshine and rainbows – there are downsides as well. It can be expensive; it can introduce regulatory complications to have to trust another entity with your key information. Additionally, there can be performance hiccups, and with SaaS products, it can be difficult to monitor at the appropriate (per-transaction) level.

    Prominent examples include:

    AWS

    Microsoft

    Azure

    Salesforce.com

    Workday

    SAP

    Private cloud

    A lower-risk cloud for cloud-averse customers?

    • A cloud is a cloud, no matter how small. Some IT shops deploy private clouds that make use of the five key cloud characteristics but provisioned for the exclusive use of a single entity, like a corporation.
    • Private clouds have numerous benefits. Some potential cloud customers might be uncomfortable with the shared responsibility that is inherent in the public cloud. Private clouds allow customers to deliver flexible, measured services without having to surrender control, but they require significant overhead, capital expenditure, administrative effort, and technical expertise.
    • According to the 2021 State of the Cloud Report, private cloud use is common, and the most frequently cited toolset is VMware vSphere, followed by Azure Stack, OpenStack, and AWS Outposts. Private cloud deployments are more common in larger organizations, which makes sense given the overhead required to manage such an environment.

    Private cloud adoption

    The images shows a graph titled Private Cloud Adoption for Enterprises. It is a horizontal bar graph, with three segments in each bar: dark blue marking currently use; mid blue marking experimenting; and light blue marking plan to use.

    VMware and Microsoft lead the pack among private cloud customers, with Amazon and Red Hat also substantially present across private cloud environments.

    Hybrid cloud

    The best of both worlds?

    Hybrid cloud architectures combine multiple cloud delivery models and facilitate some level of interoperability. NIST suggests bursting and load balancing as examples of hybrid cloud use cases. Note: it is not sufficient to simply have multiple clouds running in parallel – there must be a toolset that allows for an element of cross-cloud functionality.

    This delivery model is attractive because it allows users to take advantage of the strengths of multiple service models using a single management pane. Bursting across clouds to take advantage of additional capacity or disaster recovery capabilities are two obvious use cases that appeal to hybrid cloud users.

    But while hybridity is all the rage (especially given the impact Covid-19 has had on the workplace), the reality is that any hybrid cloud user must take the good with the bad. Multiple clouds and a management layer can be technically complex, expensive, and require maintaining a physical infrastructure that is not especially valuable (“I thought we were moving to the cloud to get out of the datacenter!”).

    Before selecting a hybrid approach through services like VMware Cloud on AWS or Microsoft’s Azure Stack, consider the cost, complexity, and actual expected benefit.

    Amazon, Microsoft, and Google dominate public cloud IaaS, but IBM is betting big on hybrid cloud:

    The image is a screencap of a tweet from IBM News. The tweet reads: IBM CEO Ginni Rometty: Hybrid cloud is a trillion dollar market and we'll be number one #Think2019.

    With its acquisition of Red Hat in 2019 for $34 billion, Big Blue put its money where its mouth is and acquired a substantial hybrid cloud business. At the time of the acquisition, Red Hat’s CEO, Jim Whitehurst, spoke about the benefit IBM expected to receive:

    “Joining forces with IBM gives Red Hat the opportunity to bring more open source innovation to an even broader range of organizations and will enable us to scale to meet the need for hybrid cloud solutions that deliver true choice and agility” (Red Hat, 2019).

    Multi-cloud

    For most organizations, the multi-cloud is the most realistic option.

    Multi-cloud is popular!

    The image shows a graph titled Multi-Cloud Architectures Used, % of all Respondents. The largest percentage is Apps siloed on different clouds, followed by DAta integration between clouds.

    Multi-cloud solutions exist at a different layer of abstraction from public, private, and even hybrid cloud delivery models. A multi-cloud architecture, as the name suggests, requires the user to be a customer of more than one cloud provider, and it can certainly include a hybrid cloud deployment, but it is not bound by the same rules of interoperability.

    Many organizations – especially those with fewer resources or a lack of a use case for a private cloud – rely on a multi-cloud architecture to build applications where they belong, and they manage each environment separately (or occasionally with the help of cloud management platforms).

    If your data team wants to work in AWS and your enterprise services run on basic virtual machines in Azure, that might be the most effective architecture. As the Flexera 2021 State of the Cloud Report suggests, this architecture is far more common than the more complicated bursting or brokering architectures characteristic of hybrid clouds.

    NIST cloud service models

    Software as a service

    SaaS has exploded in popularity with consumers who wish to avail themselves of the cloud’s benefits without having to manage underlying infrastructure components. SaaS is simple, generally billed per-user per-month, and is almost entirely provider-managed.

    Platform as a service

    PaaS providers offer a toolset for their customers to run custom applications and services without the requirement to manage underlying infrastructure components. This service model is ideal for custom applications/services that don’t benefit from highly granular infrastructure control.

    Infrastructure as a service

    IaaS represents the sale of components. Instead of a service, IaaS providers sell access to components, like compute, storage, and networking, allowing for customers to build anything they want on top of the providers’ infrastructure.

    Cloud service models

    • This research focuses on five key service models, each of which has its own strengths and weaknesses. Moving right from “on-prem,” customers gradually give up more control over their environments to cloud service providers.
    • An entirely premises-based environment means that the customer is responsible for everything ranging from the dirt under the datacenter to application-level configurations. Conversely, in a SaaS environment, the provider is responsible for everything but those top-level application configurations.
    • A managed service provider or other third party can manage any or of the components of the infrastructure stack. A service provider may, for example, build a SaaS solution on top of another provider’s IaaS, or might offer configuration assistance with a commercially available SaaS.

    Info-Tech Insight

    Not all workloads fit well in the cloud. Many environments will mix service models (e.g. SaaS for some workloads, some in IaaS, some on-premises), and this can be perfectly effective. It must be consistent and intentional, however.

    On-prem Co-Lo IaaS PaaS SaaS
    Application Application Application Application Application
    Database Database Database Database Database
    Runtime/ Middleware Runtime/ Middleware Runtime/ Middleware Runtime/ Middleware Runtime/ Middleware
    OS OS OS OS OS
    Hypervisor Hypervisor Hypervisor Hypervisor Hypervisor
    Server Network Storage Server Network Storage Server Network Storage Server Network Storage Server Network Storage
    Facilities Facilities Facilities Facilities Facilities

    Organization has control

    Organization or vendor may control

    Vendor has control

    Analytics folly

    SaaS is good, but it’s not a panacea

    Industry: Healthcare

    Source: Info-Tech workshop

    Situation

    A healthcare analytics provider had already moved a significant number of “non-core workloads” to the cloud, including email, HRIS, and related services.

    The company CEO was satisfied with the reduced effort required by IT to manage SaaS-based workloads and sought to extend the same benefits to the core analytics platform where there was an opportunity to reduce overhead.

    Complication

    Many components of the health analytics service were designed to run specifically in a datacenter and were not ready to be migrated to the cloud without significant effort/refactoring. SaaS was not an option because this was a core platform – a SaaS provider would have been the competition.

    That left IaaS, which was expensive and would not bring the expected benefits (reduced overhead).

    Results

    The organization determined that there were no short-term gains from migrating to the cloud. Due to the nature of the application (its extensive customization, the fact that it was a core product sold by the company) any steps to reduce operational overhead were not feasible.

    The CEO recognized that the analytics platform was not a good candidate for the cloud and what distinguished the analytics platform from more suitable workloads.

    Migration paths

    In a 2016 blog post, Amazon Web Services articulated a framework for cloud migration that incorporates elements of the journey as well as the destination. If workload owners do not choose to retain or retire their workloads, there are four alternatives. These alternatives all stack up differently along five key dimensions:

    1. Value: does the workload stand to benefit from unique cloud characteristics? To what degree?
    2. Effort: how much work would be required to make the transition?
    3. Cost: how much money is the migration expected to cost?
    4. Time: how long will the migration take?
    5. Skills: what skills must be brought to bear to complete the migration?

    Not all migration paths can lead to all destinations. Rehosting generally means IaaS, while repurchasing leads to SaaS. Refactoring and replatforming have some variety of outcomes, and it becomes possible to take advantage of new IaaS architectures or migrate workloads over fully to SaaS.

    As part of the workload assessment process, use the five dimensions (expanded upon on the next slide) to determine what migration path makes sense. Preferred migration paths form an important part of the overall cloud vision process.

    Retain (Revisit)

    • Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

    Retire

    • Get rid of the application completely.

    Rehost

    • Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

    Replatform

    • Move the application to the cloud and perform a few changes for cloud optimizations.

    Refactor

    • Rewrite the application, taking advantage of cloud native architectures.

    Repurchase

    • Replace with an alternative, cloud-native application and migrate the data.

    Migration paths – relative value

    Migration path Value Effort Cost Time Skills
    Retain No real change in the absolute value of the workload if it is retained. No effort beyond ongoing workload maintenance. No immediate hard dollar costs, but opportunity costs and technical debt abound. No time required! (At least not right away…) Retaining requires the same skills it has always required (which may be more difficult to acquire in the future).
    Rehire A retired workload can provide no value, but it is not a drain! Spinning a service down requires engaging that part of the lifecycle. N/A Retiring the service may be simple or complicated depending on its current role. N/A
    Rehost Some value comes with rehosting, but generally components stay the same (VM here vs. a VM there). Minimal effort required, especially with automated tools. The effort will depend on the environment being migrated. Relatively cheap compared to other options. Rehosting infrastructure is the simplest cloud migration path and is useful for anyone in a hurry. Rehosting is the simplest cloud migration path for most workloads, but it does require basic familiarity with cloud IaaS.

    Replatform

    Replatformed workloads can take advantage of cloud-native services (SQL vs. SQLaaS). Replatforming is more effortful than rehosting, but less effortful than refactoring. Moderate cost – does not require fundamental rearchitecture, just some tweaking. Relatively more complicated than a simple rehost, but less demanding than a refactor. Platform and workload expertise is required; more substantial than a simple rehost.
    Refactor A fully formed, customized cloud-based workload that can take advantage of cloud-native architectures is generally quite valuable. Significant effort required based on the requirement to engage the full SDLC. Significant cost required to engage SDLC and rebuild the application/service. The most complicated and time-consuming. The most complicated and time-consuming.
    Repurchase Repurchasing is the quickest way to achieve cloud-native value. There are compromises, however (high cost, vendor-lock-in). Repurchasing is the quickest way to achieve cloud-native value. There are compromises, however (high cost, vendor-lock-in). Repurchasing is the quickest way to achieve cloud-native value. There are compromises, however (high cost, vendor-lock-in). Configuration – especially for massive projects – can be time consuming, but in general repurchasing can be quite fast. Buying software does require knowledge of requirements and integrations, but is otherwise quite simple.

    Where should you get your cloud skills?

    Cloud skills are certainly top of mind right now. With the great upheaval in both work patterns and in the labor market more generally, expertise in cloud-related areas is simultaneously more valuable and more difficult to procure. According to Pluralsight’s 2021 “State of Upskilling” report, 44% of respondents report themselves under-skilled in the cloud management area, making cloud management the most significant skill gap reported on the survey.

    Everyone left the office. Work as we know it is fundamentally altered for a generation or more. Cloud services shot up in popularity by enabling the transition. And yet there is a gap – a prominent gap – in skilling up for this critically important future. What is the cloud manager to do?

    Per the framework presented here, that manager has three essential options. They may take somewhat different forms depending on specific requirements and the quirks of the local market, but the options are:

    1. Train or hire internal resources: This might be easier said than done, especially for more niche skills, but makes sense for workloads that are critical to operations for the long term.
    2. Engage a managed service provider: MSPs are often engaged to manage services where internal IT lacks bandwidth or expertise.
    3. Hire a consultant: Consultants are great for time-bound implementation projects where highly specific expertise is required, such as a migration or implementation project.

    Each model makes sense to some degree. When evaluating individual workloads for cloud suitability, it is critical to consider the support model – both immediate and long term. What makes sense from a value perspective?

    Cloud decisions – summary

    A key component of the Info-Tech cloud vision model is that it is multi-layered. Not every decision must be made at every level. At the workload level, it makes sense to select service models that make sense, but each workload does not need its own defined vision. Workload-level decisions should be guided by an overall strategy but applied tactically, based on individual workload characteristics and circumstances.

    Conversely, some decisions will inevitably be applied at the environment level. With some exceptions, it is unlikely that cloud customers will build an entire private/hybrid cloud environment around a single solution; instead, they will define a broader strategy and fit individual workloads into that strategy.

    Some considerations exist at both the workload and environment levels. Risks and roadblocks, as well as the preferred support model, are concerns that exist at both the environment level and at the workload level.

    The image is a Venn diagram, with the left side titled Workload level, and the right side titled Environment Level. In the left section are: service model and migration path. On the right section are: Overall vision and Delivery model. In the centre section are: support model and Risks and roadblocks.

    Step 1.3

    Create a current state summary

    Activities

    1.3.1 Record your current state

    Understand the Cloud

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    This step involves the following participants: Core working group

    Outcomes of this step

    • Current state summary of cloud solutions

    1.3.1 Record your current state

    30 minutes

    Input

    • Knowledge of existing cloud workloads

    Output

    • Current state cloud summary for service, delivery, and support models

    Materials

    • Whiteboard

    Participants

    • Core working group
    • Infrastructure team
    • Service owners
    1. On a whiteboard (real or virtual) draw a table with each of the cloud service models across the top. Leave a cell below each to list examples.
    2. Under each service model, record examples present in your environment. The purpose of the exercise is to illustrate the existence of cloud services in your environment or the lack thereof, so there is no need to be exhaustive. Complete this in turn for each service model until you are satisfied that you have created an effective picture of your current cloud SaaS state, IaaS state, etc.
    3. Input the results into their own slide titled “current state summary” in the Cloud Vision Executive Presentation.
    4. Repeat for the cloud delivery models and support models and include the results of those exercises as well.
    5. Create a short summary statement (“We are primarily a public cloud consumer with a large SaaS footprint and minimal presence in PaaS and IaaS. We retain an MSP to manage our hosted telephony solution; otherwise, everything is handled in house.”

    Cloud Vision Executive Presentation

    Step 1.4

    Select workloads for current analysis

    Activities

    1.4.1 Select workloads for assessment

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • List of workloads for assessment

    Understand the cloud

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    1.4.1 Select workloads for assessment

    30 minutes

    Input

    • Knowledge of existing cloud workloads

    Output

    • List of workloads to be assessed

    Materials

    • Whiteboard
    • Cloud Vision Workbook

    Participants

    • Core working group
    • IT management
    1. In many cases, the cloud project is inspired by a desire to move a particular workload or set of workloads. Solicit feedback from the core working group about what these workloads might be. Ask everyone in the meeting to suggest a workload and record each one on a sticky note or white board (virtual or physical).
    2. Discuss the results with the group and begin grouping similar workloads together. They will be subject to the assessments in the Cloud Vision Workbook, so try to avoid selecting too many workloads that will produce similar answers. It might not be obvious, but try to think about workloads that have similar usage patterns, risk levels, and performance requirements, and select a representative group.
    3. You should embrace counterintuition by selecting a workload that you think is unlikely to be a good fit for the cloud if you can and subjecting it to the assessment as well for validation purposes.
    4. When you have a list of 4-6 workloads, record them on tab 2 of the Cloud Vision Workbook.

    Cloud Vision Workbook

    Assess your cloud workloads

    Build the foundations of your cloud vision

    Phase 2

    Phase 2

    Evaluate Cloud Workloads

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    • Conduct workload assessments
    • Determine workload future state

    This phase involves the following participants:

    • Subject matter experts
    • Core working group
    • IT management

    Define Your Cloud Vision

    Work from the bottom up and assess your workloads

    A workload-first approach will help you create a realistic vision.

    The concept of a cloud vision should unquestionably be informed by the nature of the workloads that IT is expected to provide for the wider organization. The overall cloud vision is no greater than the sum of its parts. You cannot migrate to the cloud in the abstract. Workloads need to go – and not all workloads are equally suitable for the transition.

    It is therefore imperative to understand which workloads are a good fit for the cloud, which cloud service models make the most sense, how to execute the migration, what support should look like, and what risks and roadblocks you are likely to encounter as part of the process.

    That’s where the Cloud Vision Workbook comes into play. You can use this tool to assess as many workloads as you’d like – most people get the idea after about four – and by the end of the exercise, you should have a pretty good idea about where your workloads belong, and you’ll have a tool to assess any net new or previously unconsidered workloads.

    It’s not so much about the results of the assessment – though these are undeniably important – but about the learnings gleaned from the collaborative assessment exercise. While you can certainly fill out the assessment without any additional input, this exercise is most effective when completed as part of a group.

    Introducing the Cloud Vision Workbook

    • The Cloud Vision Workbook is an Excel tool that answers the age old question: “What should I do with my workloads?”
    • It is divided into eight tabs, each of which offers unique value. Start by reading the introduction and inputting your list of workloads. Work your way through tabs 3-6, completing the suitability, migration, management, and risk and roadblock assessments, and review the results on tab 7.
    • If you choose to go through the full battery of assessments for each workload, expect to answer and weight 111 unique questions across the four assessments. This is an intensive exercise, so carefully consider which assessments are valuable to you, and what workloads you have time to assess.
    • Tab 8 hosts the milestone timeline and captures the results of the phase 3 risk and mitigation exercise.

    Understand Cloud Vision Workbook outputs

    The image shows a graphic with several graphs and lists on it, with sections highlighted with notes. At the top, there's the title Database with the note Workload title (populated from tab 2). Below that, there is a graph with the note Relative suitability of the five service models. The Risks and roadblocks section includes the note: The strategy components – the risks and roadblocks – are captured relative to one another to highlight key focus areas. To the left of that, there is a Notes section with the note Notes populated based on post-assessment discussion. At the bottom, there is a section titled Where should skills be procured?, with the note The radar diagram captures the recommended support model relative to the others (MSP, consultant, internal IT). To the right of that, there is a section titled Migration path, with the note that Ordered list of migration paths. Note: a disconnect here with the suggested service model may indicate an unrealistic goal state.

    Step 2.1

    Conduct workload assessments

    Activities

    2.1.1 Conduct workload assessments

    2.1.2 Interpret your results

    Phase Title

    Conduct workload assessments

    Determine workload future state

    This step involves the following participants:

    • Core working group
    • Workload subject matter experts

    Outcomes of this step

    • Completed workload assessments

    2.1.1 Conduct workload assessments

    2 hours per workload

    Input

    • List of workloads to be assessed

    Output

    • Completed cloud vision assessments

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    • Service owners/workload SMEs
    1. The Cloud Vision Workbook is your one stop shop for all things workload assessment. Open the tool to tab 2 and review the workloads you identified at the end of phase 1. Ensure that these are correct. Once satisfied, project the tool (virtually, if necessary) so that all participants can see the assessment questions.
    2. Work through tabs 3-6, answering the questions and assigning a multiplier for each one. A higher multiplier increases the relative weight of the question, giving it a greater impact on the overall outcome.
    3. Do your best to induce participants to offer opinions. Consensus is not absolutely necessary, but it is a good goal. Ask your participants if they agree with initial responses and occasionally take the opposite position (“I’m surprised you said agree – I would have thought we didn’t care about CapEx vs. OpEx”). Stimulate discussion.
    4. Highlight any questions that you will need to return to or run by someone not present. Include a placeholder answer, as the tool requires all cells to be filled for computation.

    Cloud Vision Workbook

    2.1.2 Interpret your results

    10 minutes

    Input

    • Completed cloud vision assessments

    Output

    • Shared understanding of implications

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    • Service owners/workload SMEs
    1. Once you’ve completed all 111 questions for each workload, you can review your results on tab 7. On tab 7, you will see four populated graphics: cloud suitability, migration path, “where should skills be procured?”, and risks and roadblocks. These represent the components of the overall cloud vision that you will present to stakeholders.
    2. The “cloud suitability” chart captures the service model that the assessment judges to be most suitable for the workload. Ask those present if any are surprised by the output. If there is any disagreement, discuss the source of the surprise and what a more realistic outcome would be. Revisit the assessment if necessary.
    3. Conduct a similar exercise with each of the other outputs. Does it make sense to refactor the workload based on its cloud suitability? Does the fact that we scored so highly on the “consultant” support model indicate something about how we handle upskilling internally? Does the profile of risks and roadblocks identified here align with expectations? What should be ranked higher? What about lower?
    4. Once everyone is generally satisfied with the results, close the tool and take a break! You’ve earned it.

    Cloud Vision Workbook

    Understand the cloud strategy components

    Each cloud strategy will take a slightly different form, but all should contain echoes of each of these components. This process will help you define your vision and direction, but you will need to take steps to execute on that vision. The remainder of the cloud strategy, covered in the related blueprint Document Your Cloud Strategy comprises these fourteen topics divided across three categories: people, governance, and technology. The workload assessment covers these under risks and roadblocks and highlights areas that may require specific additional attention. When interpreting the results, think of these areas as comprising things that you will need to do to make your vision a reality.

    People

    • Skills and roles
    • Culture and adoption
    • Governing bodies

    Governance

    • Architecture
    • Integration and interoperability
    • Operations management
    • Cloud portfolio management
    • Cloud vendor management
    • Finance management
    • Security
    • Data controls

    Technology

    • Monitoring
    • Provisioning
    • Migration

    Strategy component: People

    People form the core of any good strategy. As part of your cloud vision, you will need to understand the implications a cloud transition will have on your staff and users, whether those users are internal or external.

    Component Description Challenges
    Skills and roles The move to the cloud will require staff to learn how to handle new technology and new operational processes. The cloud is a different way of procuring IT resources and may require the definition of new roles to handle things like cost management and provisioning. Staff may not have the necessary experience to migrate to a cloud environment or to effectively manage resources once the cloud transition is made. Cloud skills are difficult to hire for, and with the ever-changing nature of the platforms themselves, this shows no sign of abating. Redefining roles can also be politically challenging and should be done with due care and consideration.
    Culture and adoption If you build it, they will come…right? It is not always the case that a new service immediately attracts users. Ensuring that organizational culture aligns with the cloud vision is a critical success factor. Equally important is ensuring that cloud resources are used as intended. Those unfamiliar with cloud resources may be less willing to learn to use them. If alternatives exist (e.g. a legacy service that has not been shut down), or if those detractors are influential, this resistance may impede your cloud execution. Also, if the cloud transition involves significant effort or a fundamental rework (e.g. a DevOps transition) this role redefinition could cause some internal turmoil.
    Governing bodies A large-scale cloud deployment requires formal governance. Formal governance requires a governing body that is ultimately responsible for designing the said governance. This could take the form of a “center of excellence” or may rest with a single cloud architect in a smaller, less complicated environment. Governance is difficult. Defining responsibilities in a way that includes all relevant stakeholders without paralyzing the decision-making process is difficult. Implementing suggestions is a challenge. Navigating the changing nature of service provision (who can provision their own instances or assign licenses?) can be difficult as well. All these concerns must be addressed in a cloud strategy.

    Strategy component: Governance

    Without guardrails, the cloud deployment will grow organically. This has strengths (people tend to adopt solutions that they select and deploy themselves), but these are more than balanced out by the drawbacks that come with inconsistency, poor administration, duplication of services, suboptimal costing, and any number of other unique challenges. The solution is to develop and deploy governance. The following list captures some of the necessary governance-related components of a cloud strategy.

    Component Description Challenges
    Architecture Enterprise architecture is an important function in any environment with more than one interacting workload component (read: any environment). The cloud strategy should include an approach to defining and implementing a standard cloud architecture and should assign responsibility to an individual or group. Sometimes the cloud transition is inspired by the desire to rearchitect. The necessary skills and knowledge may not be readily available to design and transition to a microservices-based environment, for example, vs. a traditional monolithic application architecture. The appropriateness of a serverless environment may not be well understood, and it may be the case that architects are unfamiliar with cloud best practices and reference architectures.
    Integration and interoperability Many services are only highly functional when integrated with other services. What is a database without its front-end? What is an analytics platform without its data lake? For the cloud vision to be properly implemented, a strategy for handling integration and interoperability must be developed. It may be as simple as “all SaaS apps must be compatible with Okta” but it must be there. Migration to the cloud may require a fundamentally new approach to integration, moving away from a point-to-point integrations and towards an ESB or data lake. In many cases, this is easier said than done. Centralization of management may be appealing, but legacy applications – or those acquired informally in a one-off fashion – might not be so easy to integrate into a central management platform.
    Operations management Service management (ITIL processes) must be aligned with your overall cloud strategy. Migrating to the cloud (where applicable) will require refining these processes, including incident, problem, request, change, and configuration management, to make them more suitable for the cloud environment. Operations management doesn’t go away in the cloud, but it does change in line with the transition to shared responsibility. Responding to incidents may be more difficult on the cloud when troubleshooting is a vendor’s responsibility. Change management in a SaaS environment may be more receptive than staff are used to as cloud providers push changes out that cannot be rolled back.

    Strategy component: Governance (cont.)

    Component Description Challenges
    Cloud portfolio management This component refers to the act of managing the portfolio of cloud services that is available to IT and to business users. What requirements must a SaaS service meet to be onboarded into the environment? How do we account for exceptions to our IaaS policy? What about services that are only available from a certain provider? Rationalizing services offers administrative benefits, but may make some tasks more difficult for end users who have learned things a certain way or rely on niche toolsets. Managing access through a service catalog can also be challenging based on buy-in and ongoing administration. It is necessary to develop and implement policy.
    Cloud vendor management Who owns the vendor management function, and what do their duties entail? What contract language must be standard? What does due diligence look like? How should negotiations be conducted? What does a severing of the relationship look like? Cloud service models are generally different from traditional hosted software and even from each other (e.g. SaaS vs. PaaS). There is a bit of a learning curve when it comes to dealing with vendors. Also relevant: the skills that it takes to build and maintain a system are not necessarily the same as those required to coherently interact with a cloud vendor.
    Finance management Cloud services are, by definition, subject to a kind of granular, operational billing that many shops might not be used to. Someone will need to accurately project and allocate costs, while ensuring that services are monitored for cost abnormalities. Cloud cost challenges often relate to overall expense (“the cloud is more expensive than an alternative solution”), expense variability (“I don’t know what my budget needs to be this quarter”), and cost complexity (“I don’t understand what I’m paying for – what’s an Elastic Beanstalk?”).
    Security The cloud is not inherently more or less secure than a premises-based alternative, though the risk profile can be different. Applying appropriate security governance to ensure workloads are compliant with security requirements is an essential component of the strategy.

    Technical security architecture can be a challenge, as well as navigating the shared responsibility that comes with a cloud transition. There are also a plethora of cloud-specific security tools like cloud access security brokers (CASBs), cloud security posture management (CSPM) solutions, and even secure access services edge (SASE) technology.

    Data controls Data residency, classification, quality, and protection are important considerations for any cloud strategy. With cloud providers taking on outsized responsibility, understanding and governing data is essential. Cloud providers like to abstract away from the end user, and while some may be able to guarantee residency, others may not. Additionally, regulations may prevent some data from going to the cloud, and you may need to develop a new organizational backup strategy to account for the cloud.

    Strategy component: Technology

    Good technology will never replace good people and effective process, but it remains important in its own right. A migration that neglects the undeniable technical components of a solid cloud strategy is doomed to mediocrity at best and failure at worst. Understanding the technical implications of the cloud vision – particularly in terms of monitoring, provisioning, and migration – makes all the difference. You can interpret the results of the cloud workload assessments by reviewing the details presented here.

    Component Description Challenges
    Monitoring The cloud must be monitored in line with performance requirements. Staff must ensure that appropriate tools are in place to properly monitor cloud workloads and that they are capturing adequate and relevant data. Defining requirements for monitoring a potentially unfamiliar environment can be difficult, as can consolidating on a monitoring solution that both meets requirements and covers all relevant areas. There may be some upskilling and integration work required to ensure that monitoring works as required.
    Provisioning How will provisioning be done? Who will be responsible for ensuring the right people have access to the right resources? What tooling must be deployed to support provisioning goals? What technical steps must be taken to ensure that the provisioning is as seamless as possible? There is the inevitable challenge of assigning responsibility and accountability in a changing infrastructure and operations environment, especially if the changes are substantial (e.g. a fundamental operating model shift, reoriented around the cloud). Staff may also need to familiarize themselves with cloud-based provisioning tools like Ansible, Terraform, or even CloudFormation.
    Migration The act of migrating is important as well. In some cases, the migration is as simple as configuring the new environment and turning it up (e.g. with a net new SaaS service). In other cases, the migration itself can be a substantial undertaking, involving large amounts of data, a complicated replatforming/refactoring, and/or a significant configuration exercise.

    Not all migration journeys are created equal, and challenges include a general lack of understanding of the requirements of a migration, the techniques that might be necessary to migrate to a particular cloud (there are many) and the disruption/risk associated with moving large amounts of data. All of these challenges must be considered as part of the overall cloud strategy, whether in terms of architectural principles or skill acquisition (or both!).

    Step 2.2

    Determine workload future state

    Activities

    2.2.1 Determine workload future state

    Conduct workload assessments

    Determine workload future state

    This step involves the following participants:

    • IT management
    • Core working group

    Outcomes of this step

    • Completed workload assessments
    • Defined workload future state

    2.2.1 Determine workload future state

    1-3 hours

    Input

    • Completed workload assessments

    Output

    • Preliminary future state outputs

    Materials

    • Cloud Vision Workbook
    • Cloud Vision Executive Presentation

    Participants

    • Core working group
    • Service owners
    • IT management
    1. After you’ve had a chance to validate your results, refer to tab 7 of the tool, where you will find a blank notes section.
    2. With the working group, capture your answers to each of the following questions:
      1. What service model is the most suitable for the workload? Why?
      2. How will we conduct the migration? Which of the six models makes the most sense? Do we have a backup plan if our primary plan doesn’t work out?
      3. What should the support model look like?
      4. What are some workload-specific risks and considerations that must be taken into account for the workload?
    3. Once you’ve got answers to each of these questions for each of the workloads, include your summary in the “notes” section of tab 7.

    Cloud Vision Executive Presentation

    Paste the output into the Cloud Vision Executive Presentation

    • The Cloud Vision Workbook output is a compact, consumable summary of each workload’s planned future state. Paste each assessment in as necessary.
    • There is no absolutely correct way to present the information, but the output is a good place to start. Do note that, while the presentation is designed to lead with the vision statement, because the process is workload-first, the assessments are populated prior to the overall vision in a bottom-up manner.
    • Be sure to anticipate the questions you are likely to receive from any stakeholders. You may consider preparing for questions like: “What other workloads fit this profile?” “What do we expect the impact on the budget to be?” “How long will this take?” Keep these and other questions in mind as you progress through the vision definition process.

    The image shows the Cloud Vision Workbook output, which was described in an annotated version in an earlier section.

    Info-Tech Insight

    Keep your audience in mind. You may want to include some additional context in the presentation if the results are going to be presented to non-technical stakeholders or those who are not familiar with the terms or how to interpret the outputs.

    Identify and Mitigate Risks

    Build the foundations of your cloud vision

    PHASE 3

    Phase 3

    Identify and Mitigate Risks

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    • Generate risks and roadblocks
    • Mitigate risks and roadblocks
    • Define roadmap initiatives

    This phase involves the following participants:

    • Core working group
    • Workload subject matter experts

    You know what you want to do, but what do you have to do?

    What questions remain unanswered?

    There are workload-level risks and roadblocks, and there are environment-level risks. This phase is focused primarily on environment-level risks and roadblocks, or those that are likely to span multiple workloads (but this is not hard and fast rule – anything that you deem worth discussing is worth discussing). The framework here calls for an open forum where all stakeholders – technical and non-technical, pro-cloud and anti-cloud, management and individual contributor – have an opportunity to articulate their concerns, however specific or general, and receive feedback and possible mitigation.

    Start by soliciting feedback. You can do this over time or in a single session. Encourage anyone with an opinion to share it. Focus on those who are likely to have a perspective that will become relevant at some point during the creation of the cloud strategy and the execution of any migration. Explain the preliminary direction; highlight any major changes that you foresee. Remind participants that you are not looking for solutions (yet), but that you want to make sure you hear any and every concern as early as possible. You will get feedback and it will all be valuable.

    Before cutting your participants loose, remind them that, as with all business decisions, the cloud comes with trade-offs. Not everyone will have every wish fulfilled, and in some cases, significant effort may be needed to get around a roadblock, risks may need to be accepted, and workloads that looked like promising candidates for one service model or another may not be able to realize that potential. This is a normal and expected part of the cloud vision process.

    Once the risks and roadblocks conversation is complete, it is the core working group’s job to propose and validate mitigations. Not every risk can be completely resolved, but the cloud has been around for decades – chances are someone else has faced a similar challenge and made it through relatively unscathed. That work will inevitably result in initiatives for immediate execution. Those initiatives will form the core of the initiative roadmap that accompanies the completed Cloud Vision Executive Presentation.

    Step 3.1

    Generate risks and roadblocks

    Activities

    3.1.1 Generate risks and roadblocks

    3.1.2 Generate mitigations

    Identify and mitigate risks

    Generate risks and roadblocks

    Mitigate risks and roadblocks

    Define roadmap initiatives

    This step involves the following participants:

    • Core working group
    • IT management
    • Infrastructure
    • Applications
    • Security
    • Architecture

    Outcomes of this step

    • List of risks and roadblocks

    Understand risks and roadblocks

    Risk

    • Something that could potentially go wrong.
    • You can respond to risks by mitigating them:
      • Eliminate: take action to prevent the risk from causing issues.
      • Reduce: take action to minimize the likelihood/severity of the risk.
      • Transfer: shift responsibility for the risk away from IT, towards another division of the company.
      • Accept: where the likelihood or severity is low, it may be prudent to accept that the risk could come to fruition.

    Roadblock

    • There are things that aren’t “risks” that we care about when migrating to the cloud.
    • We know, for example, that a complicated integration situation will create work items for any migration – this is not an “unknown.”
    • We respond to roadblocks by generating work items.

    3.1.1 Generate risks and roadblocks

    1.5 hours

    Input

    • Completed cloud vision assessments

    Output

    • List of risks and roadblocks

    Materials

    • Whiteboard
    • Sticky notes

    Participants

    • Core working group
    • Service owners/workload SMEs
    • Anyone with concerns about the cloud
    1. Gather your core working group – and really anyone with an intelligent opinion on the cloud – into a single meeting space. Give the group 5-10 minutes to list anything they think could present a difficulty in transitioning workloads to the cloud. Write each risk/roadblock on its own sticky note. You will never be 100% exhaustive, but don’t let anything your users care about go unaddressed.
    2. Once everyone has had time to write down their risks and roadblocks, have everyone share one by one. Make sure you get them all. Overlap in risks and roadblocks is okay! Group similar concerns together to give a sort of heat map of what your participants are concerned about. (This is called “affinity diagramming.”)
    3. Assign names to these categories. Many of these categories will align with the strategy components discussed in the previous phase (governance, security, etc.) but some will be specific whether by nature or by degree.
    4. Sort each of the individual risks into its respective category, collapsing any exact duplicates, and leaving room for notes and mitigations (see the next slide for a visual).

    Understand risks and roadblocks

    The image is two columns--on the left, the column is titled Affinity Diagramming. Below the title, there are many colored blocks, randomly arranged. There is an arrow pointing right, to the same coloured blocks, now sorted by colour. In the right column--titled Categorization--each colour has been assigned a category, with subcategories.

    Step 3.2

    Mitigate risks and roadblocks

    Activities

    3.2.1 Generate mitigations

    Identify and mitigate risks

    Generate risks and roadblocks

    Mitigate risks and roadblocks

    Define roadmap initiatives

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • List of mitigations

    Is the public cloud less secure?

    This is the key risk-related question that most cloud customers will have to answer at some point: does migrating to the cloud for some services increase their exposure and create a security problem?

    As with all good questions, the answer is “it depends.” But what does it depend on? Consider these cloud risks and potential mitigations:

    1. Misconfiguration: An error grants access to unauthorized parties (as happened to Capital One in 2019). This can be mitigated by careful configuration management and third-party tooling.
    2. Unauthorized access by cloud provider/partner employees: Though rare, it is possible that a cloud provider or partner can be a vector for a breach. Careful contract language, choosing to own your own encryption keys, and a hybrid approach (storing data on-premises) are some possible ways to address this problem.
    3. Unauthorized access to systems: Cloud services are designed to be accessed from anywhere and may be accessed by malicious actors. Possible mitigations include risk-based conditional access, careful identity access management, and logging and detection.

    “The cloud is definitely more secure in that you have much more control, you have much more security tooling, much more visibility, and much more automation. So it is more secure. The caveat is that there is more risk. It is easier to accidentally expose data in the cloud than it is on-premises, but, especially for security, the amount of tooling and visibility you get in cloud is much more than anything we’ve had in our careers on-premises, and that’s why I think cloud in general is more secure.” –Abdul Kittana, Founder, ASecureCloud

    Breach bests bank

    No cloud provider can protect against every misconfiguration

    Industry: Finance

    Source: The New York Times, CNET

    Background

    Capital One is a major Amazon Web Services customer and is even featured on Amazon’s site as a case study. That case study emphasizes the bank’s commitment to the cloud and highlights how central security and compliance were. From the CTO: “Before we moved a single workload, we engaged groups from across the company to build a risk framework for the cloud that met the same high bar for security and compliance that we meet in our on-premises environments. AWS worked with us every step of the way.”

    Complication

    The cloud migration was humming along until July 2019, when the bank suffered a serious breach at the hands of a hacker. That hacker was able to steal millions of credit card applications and hundreds of thousands of Social Security numbers, bank account numbers, and Canadian social insurance numbers.

    According to investigators and to AWS, the breach was caused by an open reverse proxy attack against a misconfigured web app firewall, not by an underlying vulnerability in the cloud infrastructure.

    Results

    Capital One reported that the breach was expected to cost it $150 million, and AWS fervently denied any blame. The US Senate got involved, as did national media, and Capital One’s CEO issued a public apology, writing, “I sincerely apologize for the understandable worry this incident must be causing those affected, and I am committed to making it right.”

    It was a bad few months for IT at Capital One.

    3.2.1 Generate mitigations

    3-4.5 hours

    Input

    • Completed cloud vision assessments

    Output

    • List of risks and roadblocks

    Materials

    • Whiteboard
    • Sticky notes

    Participants

    • Core working group
    • Service owners/workload SMEs
    • Anyone with concerns about the cloud
    1. Recall the four mitigation strategies: eliminate, reduce, transfer, or accept. Keep these in mind as you work through the list of risks and roadblocks with the core working group. For every individual risk or roadblock raised in the initial generation session, suggest a specific mitigation. If the concern is “SaaS providers having access to confidential information,” a mitigation might be encryption, specific contract language, or proof of certifications (or all the above).
    2. Work through this for each of the risks and roadblocks, identifying the steps you need to take that would satisfy your requirements as you understand them.
    3. Once you have gone through the whole list – ideally with input from SMEs in particular areas like security, engineering, and compliance/legal – populate the Cloud Vision Workbook (tab 8) with the risks, roadblocks, and mitigations (sorted by category). Review tab 8 for an example of the output of this exercise.

    Cloud Vision Workbook

    Cloud Vision Workbook – mitigations

    The image shows a large chart titled Risks, roadblocks, and mitigations, which has been annotated with notes.

    Step 3.3

    Define roadmap initiatives

    Activities

    3.3.1 Generate roadmap initiatives

    Identify and mitigate risks

    Generate risks and roadblocks

    Mitigate risks and roadblocks

    Define roadmap initiatives

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • Defined roadmap initiatives

    3.3.1 Generate roadmap initiatives

    1 hour

    Input

    • List of risk and roadblock mitigations

    Output

    • List of cloud initiatives

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Executing on your cloud vision will likely require you to undertake some key initiatives, many of which have already been identified as part of your mitigation exercise. On tab 8 of the Cloud Vision Workbook, review the mitigations you created in response to the risks and roadblocks identified. Initiatives should generally be assignable to a party and should have a defined scope/duration. For example, “assess all net new applications for cloud suitability” might not be counted as an initiative, but “design a cloud application assessment” would likely be.
    2. Design a timeline appropriate for your specific needs. Generally short-term (less than 3 months), medium-term (3-6 months), and long-term (greater than 6 months) will work, but this is entirely based on preference.
    3. Review and validate the parameters with the working group. Consider creating additional color-coding (highlighting certain tasks that might be dependent on a decision or have ongoing components).

    Cloud Vision Workbook

    Bridge the gap and create the vision

    Build the foundations of your cloud vision

    Phase 4

    Phase 4

    Bridge the Gap and Create the Vision

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    • Assign initiatives and propose timelines
    • Build a delivery model rubric
    • Build a service model rubric
    • Built a support model rubric
    • Create a cloud vision statement
    • Map cloud workloads
    • Complete the Cloud Vision presentation

    This phase involves the following participants:

    • IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders

    Step 4.1

    Review and assign work items

    Activities

    4.1.1 Assign initiatives and propose timelines

    Bridge the gap and create the vision

    Review and assign work items

    Finalize cloud decision framework

    Create cloud vision

    This step involves the following participants:

    • Core working group
    • IT management

    Outcomes of this step

    • Populated cloud vision roadmap

    4.1.1 Assign initiatives and propose timelines

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Once the list is populated, begin assigning responsibility for execution. This is not a RACI exercise, so focus on the functional responsibility. Once you have determined who is responsible, assign a timeline and include any notes. This will form the basis of a more formal project plan.
    2. To assign the initiative to a party, consider 1) who will be responsible for execution and 2) if that responsibility will be shared. Be as specific as possible, but be sure to be consistent to make it easier for you to sort responsibility later on.
    3. When assigning timelines, we suggest including the end date (when you expect the project to be complete) rather than the start date, though whatever you choose, be sure to be consistent. Make use of the notes column to record anything that you think any other readers will need to be aware of in the future, or details that may not be possible to commit to memory.

    Cloud Vision Workbook

    Step 4.2

    Finalize cloud decision framework

    Activities

    4.2.1 Build a delivery model rubric

    4.2.2 Build a service model rubric

    4.2.3 Build a support model rubric

    Bridge the gap and create the vision

    Review and assign work items

    Finalize cloud decision framework

    Create cloud vision

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • Cloud decision framework

    4.2.1 Build a delivery model rubric

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    Participants

    • Core working group
    1. Now that we have a good understanding of the cloud’s key characteristics, the relative suitability of different workloads for the cloud, and a good understanding of some of the risks and roadblocks that may need to be overcome if a cloud transition is to take place, it is time to formalize a delivery model rubric. Start by listing the delivery models on a white board vertically – public, private, hybrid, and multi-cloud. Include a community cloud option as well if that is feasible for you. Strike any models that do not figure into your vision.
    2. Create a table style rubric for each delivery model. Confer with the working group to determine what characteristics best define workloads suitable for each model. If you have a hybrid cloud option, you may consider workloads that are highly dynamic; a private cloud hosted on-premises may be more suitable for workloads that have extensive regulatory requirements.
    3. Once the table is complete, include it in the Cloud Vision Executive Presentation.

    Cloud Vision Executive Presentation

    Vision for the cloud future state (example)

    Delivery model Decision criteria
    Public cloud
    • Public cloud is the primary destination for all workloads as the goal is to eliminate facilities and infrastructure management
    • Offers features, broad accessibility, and managed updates along with provider-managed facilities and hardware
    Legacy datacenter
    • Any workload that is not a good fit for the public cloud
    • Dependency (like a USB key for license validation)
    • Performance requirements (e.g. workloads highly sensitive to transaction thresholds)
    • Local infrastructure components (firewall, switches, NVR)

    Summary statement: Everything must go! Public cloud is a top priority. Anything that is not compatible (for whatever reason) with a public cloud deployment will be retained in a premises-based server closet (downgraded from a full datacenter). The private cloud does not align with the overall organizational vision, nor does a hybrid solution.

    4.2.2 Build a service model rubric

    1 hour

    Input

    • Output of workload assessments
    • Output of risk and mitigation exercise

    Output

    • Service model rubric

    Materials

    • Whiteboard
    • Cloud Vision Executive Presentation

    Participants

    • Core working group
    1. This next activity is like the delivery model activity, but covers the relevant cloud service models. On a whiteboard, make a vertical list of the cloud service models (SaaS, PaaS, IaaS, etc.) that will be considered for workloads. If you have an order of preference, place your most preferred at the top, your least preferred at the bottom.
    2. Describe the circumstances under which you would select each service model. Do your best to focus on differentiators. If a decision criterion appears for multiple service models, consider refining or excluding it. (For additional information, check out Info-Tech’s Reimagine IT Operations for a Cloud-First World blueprint.)
    3. Create a summary statement to capture your overall service model position. See the next slide for an example. Note: this can be incorporated into your cloud vision statement, so be sure that it reflects your genuine cloud preferences.
    4. Record the results in the Cloud Vision Executive Presentation.

    Cloud Vision Executive Presentation

    Vision for the cloud future state (example)

    Service model Decision criteria
    SaaS

    SaaS first; opt for SaaS when:

    • A SaaS option exists that meets all key business requirements
    • There is a strong desire to have someone else (the vendor) manage infrastructure components/the platform
    • Not particularly sensitive to performance thresholds
    • The goal is to transition management of the workload outside of IT
    • SaaS is the only feasible way to consume the desired service
    PaaS
    • Highly customized service/workload – SaaS not feasible
    • Still preferable to offload as much management as possible to third parties
    • Customization required, but not at the platform level
    • The workload is built using a standard framework
    • We have the time/resources to replatform
    IaaS
    • Service needs to be lifted and shifted out of the datacenter quickly
    • Customization is required at the platform level/there is value in managing components
    • There is no need to manage facilities
    • Performance is not impacted by hosting the workload offsite
    • There is value in right-sizing the workload over time
    On-premises Anything that does not fit in the cloud for performance or other reasons (e.g. licensing key)

    Summary statement: SaaS will be the primary service model. All workloads will migrate to the public cloud where possible. Anything that cannot be migrated to SaaS will be migrated to PaaS. IaaS is a transitory step.

    4.2.3 Build a support model rubric

    1 hour

    Input

    • Results of the cloud workload assessments

    Output

    • Support model rubric

    Materials

    • Whiteboard
    • Cloud Vision Executive Presentation

    Participants

    • Core working group
    1. The final rubric covered here is that for the support model. Where will you procure the skills necessary to ensure the vision’s proper execution? Much like the other rubric activities, write the three support models vertically (in order of preference, if you have one) on a whiteboard.
    2. Next to each model, describe the circumstances under which you would select each support model. Focus on the dimensions: the duration of the engagement, specialization required, and flexibility required. If you have existing rules/practices around hiring consultants/MSPs, consider those as well.
    3. Once you have a good list of decision criteria, form a summary statement. This should encapsulate your position on support models and should mention any notable criteria that will contribute to most decisions.
    4. Record the results in the Cloud Vision Executive Presentation.

    Cloud Vision Executive Presentation

    Vision for the cloud future state (example)

    Support model Decision criteria
    Internal IT

    The primary support model will be internal IT going forward

    • Chosen where the primary work required is administrative
    • Where existing staff can manage the service in the cloud easily and effectively
    • Where the chosen solution fits the SaaS service model
    Consultant
    • Where the work required is time-bound (e.g. a migration/refactoring exercise)
    • Where the skills do not exist in house, and where the skills cannot easily be procured (specific technical expertise required in areas of the cloud unfamiliar to staff)
    • Where opportunities for staff to learn from consultant SMEs are valuable
    • Where ongoing management and maintenance can be handled in house
    MSP
    • Where an ongoing relationship is valued
    • Where ongoing administration and maintenance are disproportionately burdensome on IT staff (or where this administration and maintenance is likely to be burdensome)
    • Where the managed services model has already been proven out
    • Where specific expertise in an area of technology is required but this does not rise to the need to hire an FTE (e.g. telephony)

    Summary statement: Most workloads will be managed in house. A consultant will be employed to facilitate the transition to micro-services in a cloud container environment, but this will be transitioned to in-house staff. An MSP will continue to manage backups and telephony.

    Step 4.3

    Create cloud vision

    Activities

    4.3.1 Create a cloud vision statement

    4.3.2 Map cloud workloads

    4.3.3 Complete the Cloud Vision Presentation

    Review and assign work items

    Finalize cloud decision framework

    Create cloud vision

    This step involves the following participants:

    • Core working group
    • IT management

    Outcomes of this step

    Completed Cloud Vision Executive Presentation

    4.3.1 Create a cloud vision statement

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Now that you know what service models are appropriate, it’s time to summarize your cloud vision in a succinct, consumable way. A good vision statement should have three components:
      • Scope: Which parts of the organization will the strategy impact?
      • Goal: What is the strategy intended to accomplish?
      • Key differentiator: What makes the new strategy special?
    2. On a whiteboard, make a chart with three columns (one column for each of the features of a good mission statement). Have the group generate a list of words to describe each of the categories. Ideally, the group will produce multiple answers for each category.
    3. Once you’ve gathered a few different responses for each category, have the team put their heads down and generate pithy mission statements that capture the sentiments underlying each category.
    4. Have participants read their vision statements in front of the group. Use the rest of the session to produce a final statement. Record the results in the Cloud Strategy Executive Presentation.

    Example vision statement outputs

    “IT at ACME Corp. hereby commits to providing clients and end users with an unparalleled, productivity-enabling technology experience, leveraging, insofar as it is possible and practical, cloud-based services.”

    “At ACME Corp. our employees and customers are our first priority. Using new, agile cloud services, IT is devoted to eliminating inefficiency, providing cutting-edge solutions for a fast-paced world, and making a positive difference in the lives of our colleagues and the people we serve.”

    As a global leader in technology, ACME Corp. is committed to taking full advantage of new cloud services, looking first to agile cloud options to optimize internal processes wherever efficiency gaps exist. Improved efficiency will allow associates to spend more time on ACME’s core mission: providing an unrivalled customer experience.”

    Scope

    Goal

    Key differentiator

    4.3.2 Map cloud workloads

    1 hour

    Input

    • List of workloads
    • List of acceptable service models
    • List of acceptable migration paths

    Output

    • Workloads mapped by service model/migration path

    Materials

    • Whiteboard
    • Sticky notes

    Participants

    • Core working group
    1. Now that you have defined your overall cloud vision as well as your service model options, consider aligning your service model preferences with your migration path preferences. Draw a table with your expected migration strategies across the top (retain, retire, rehost, replatform, refactor, repurchase, or some of these) and your expected service models across the side.
    2. On individual sticky notes, write a list of workloads in your environment. In a smaller environment, this list can be exhaustive. Otherwise take advantage of the list you created as part of phase 1 along with any additional workloads that warrant discussion.
    3. As a group, go through the list, placing the sticky notes first in the appropriate row based on their characteristics and the decision criteria that have already been defined, and then in the appropriate column based on the appropriate migration path. (See the next slide for an example of what this looks like.)
    4. Record the results in the Cloud Vision Executive Presentation. Note: not every cell will be filled; some migration path/service model combinations are impossible or otherwise undesirable.

    Cloud Vision Executive Presentation

    Example cloud workload map

    Repurchase Replatform Rehost Retain
    SaaS

    Office suite

    AD

    PaaS SQL Database
    IaaS File Storage DR environment
    Other

    CCTV

    Door access

    4.3.3 Complete the Cloud Vision Presentation

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Open the Cloud Vision Executive Presentation to the second slide and review the templated executive brief. This comprises several sections (see the next slide). Populate each one:
      • Summary of the exercise
      • The cloud vision statement
      • Key cloud drivers
      • Risks and roadblocks
      • Top initiatives and next steps
    2. Review the remainder of the presentation. Be sure to elaborate on any significant initiatives and changes (where applicable) and to delete any slides that you no longer require.

    Cloud Vision Workbook

    Sample cloud vision executive summary

    • From [date to date], a cross-functional group representing IT and its constituents met to discuss the cloud.
    • Over the course of the week, the group identified drivers for cloud computing and developed a shared vision, evaluated several workloads through an assessment framework, identified risks, roadblocks, and mitigations, and finally generated initiatives and next steps.
    • From the process, the group produced a summary and a cloud suitability assessment framework that can be applied at the level of the workload.

    Cloud Vision Statement

    [Organization] will leverage public cloud solutions and retire existing datacenter and colocation facilities. This transition will simplify infrastructure administration, support, and security, while modernizing legacy infrastructure and reducing the need for additional capital expenditure.

    Cloud Drivers Retire the datacenter Do more valuable work
    Right-size the environment Reduce CapEx
    Facilitate ease of mgmt. Work from anywhere
    Reduce capital expenditure Take advantage of elasticity
    Performance and availability Governance Risks and roadblocks
    Security Rationalization
    Cost Skills
    Migration Remaining premises resources
    BC, backup, and DR Control

    Initiatives and next steps

    • Close the datacenter and colocation site in favor of a SaaS-first cloud approach.
    • Some workloads will migrate to infrastructure-as-a-service in the short term with the assistance of third-party consultants.

    Document your cloud strategy

    You did it!

    Congratulations! If you’ve made it this far, you’ve successfully articulated a cloud vision, assessed workloads, developed an understanding (shared with your team and stakeholders) of cloud concepts, and mitigated risks and roadblocks that you may encounter along your cloud journey. From this exercise, you should understand your mission and vision, how your cloud plans will interact with any other relevant strategic plans, and what successful execution looks like, as well as developing a good understanding of overall guiding principles. These are several components of your overall strategy, but they do not comprise the strategy in its entirety.

    How do you fix this?

    First, validate the results of the vision exercise with your stakeholders. Socialize it and collect feedback. Make changes where you think changes should be made. This will become a key foundational piece. The next step is to formally document your cloud strategy. This is a separate project and is covered in the Info-Tech blueprint Document Your Cloud Strategy.

    The vision exercise tells you where you want to go and offers some clues as to how to get there. The formal strategy exercise is a formal documentation of the target state, but also captures in detail the steps you’ll need to take, the processes you’ll need to refine, and the people you’ll need to hire.

    A cloud strategy should comprise your organizational stance on how the cloud will change your approach to people and human resources, technology, and governance. Once you are confident that you can make and enforce decisions in these areas, you should consider moving on to Document Your Cloud Strategy. This blueprint, Define Your Cloud Vision, often serves as a prerequisite for the strategy documentation conversation(s).

    Appendix

    Summary of Accomplishment

    Additional Support

    Research Contributors

    Related Info-Tech Research

    Vendor Resources

    Bibliography

    Summary of Accomplishment

    Problem Solved

    You have now documented what you want from the cloud, what you mean when you say “cloud,” and some preliminary steps you can take to make your vision a reality.

    You now have at your disposal a framework for identifying and evaluating candidates for their cloud suitability, as well as a series of techniques for generating risks and mitigations associated with your cloud journey. The next step is to formalize your cloud strategy using the takeaways from this exercise. You’re well on your way to a completed cloud strategy!

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

    Contact your account representative for more information.

    workshops@infotech.com

    1-888-670-8889

    Additional Support

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

    Contact your account representative for more information.

    workshops@infotech.com 1-888-670-8889

    To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

    Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    Generate drivers for cloud adoption

    Work with stakeholders to understand the expected benefits of the cloud migration and how these drivers will impact the overall vision.

    Conduct workload assessments

    Assess your individual cloud workloads for their suitability as candidates for the cloud migration.

    Bibliography

    “2021 State of the Cloud Report.” Flexera, 2021. Web.

    “2021 State of Upskilling Report.” Pluralsight, 2021. Web.

    “AWS Snowmobile.” Amazon Web Services, n.d. Web.

    “Azure products.” Microsoft, n.d. Web.

    “Azure Migrate Documentation.” Microsoft, n.d. Web.

    Bell, Harold. “Multi-Cloud vs. Hybrid Cloud: What’s the Difference?” Nutanix, 2019. Web.

    “Cloud Products.” Amazon Web Services, n.d. Web.

    “COBIT 2019 Framework: Introduction and Methodology.” ISACA, 2019. Web.

    Edmead, Mark T. “Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy.” ISACA, 2020. Web.

    Flitter, Emily, and Karen Weise. “Capital One Data Breach Compromises Data of Over 100 Million.” The New York Times, 29 July 2019. Web.

    Gillis, Alexander S. “Cloud Security Posture Management (CSPM).” TechTarget, 2021. Web.

    “’How to Cloud’ with Capital One.” Amazon Web Services, n.d. Web.

    “IBM Closes Landmark Acquisition of Red Hat for $34 Billion; Defines Open, Hybrid Cloud Future.” Red Hat, 9 July 2019. Web.

    Mell, Peter, and Timothy Grance. “The NIST Definition of Cloud Computing.” National Institute of Standards and Technology, Sept. 2011. Web.

    Ng, Alfred. “Amazon Tells Senators it Isn't to Blame for Capital One Breach.” CNET, 2019. Web.

    Orban, Stephen. “6 Strategies for Migrating Applications to the Cloud.” Amazon Web Services, 2016. Web.

    Sullivan, Dan. “Cloud Access Security Broker (CASB).” TechTarget, 2021. Web.

    “What Is Secure Access Service Edge (SASE)?” Cisco, n.d. Web.

    Modernize Your Corporate Website to Drive Business Value

    • Buy Link or Shortcode: {j2store}524|cart{/j2store}
    • member rating overall impact: 8.0/10 Overall Impact
    • member rating average dollars saved: $10,399 Average $ Saved
    • member rating average days saved: 10 Average Days Saved
    • Parent Category Name: Marketing Solutions
    • Parent Category Link: /marketing-solutions
    • Users are demanding more valuable web functionalities and improved access to your website services. They are expecting development teams to keep up with their changing needs.
    • The criteria of user acceptance and satisfaction involves more than an aesthetically pleasing user interface (UI). It also includes how emotionally attached the user is to the website and how it accommodates user behaviors.

    Our Advice

    Critical Insight

    Complication

    • Organizations are focusing too much on the UI when they optimize the user experience of their websites. The UI is only one of many components involved in successful websites with good user experience.
    • User experience (UX) is often an afterthought in development, risking late and costly fixes to improve end-user reception after deployment.

    Insights

    • Organizations often misinterpret UX as UI. In fact, UX incorporates both the functional and emotional needs of the user, going beyond the website’s UI.
    • Human behaviors and tendencies are commonly left out of the define and design phases of website development, putting user satisfaction and adoption at risk.

    Impact and Result

    • Gain a deep understanding of user needs and behaviors. Become familiar with the human behaviors, emotions, and pain points of your users in order to shortlist the design elements and website functions that will receive the highest user satisfaction.
    • Perform a comprehensive website review. Leverage satisfaction surveys, user feedback, and user monitoring tools (e.g. heat maps) to reveal high-level UX issues. Use these insights to drill down into the execution and composition of your website to identify the root causes of issues.
    • Incorporate modern UX trends in your design. New web technologies are continuously emerging in the industry to enhance user experience. Stay updated on today’s UX trends and validate their fit for the specific needs of your target audience.

    Modernize Your Corporate Website to Drive Business Value Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should modernize your website, review Info-Tech’s methodology, and discover the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define UX requirements

    Reveal the opportunities to heighten the user experience of your website through a deep understanding of the behaviors, emotions, and needs of your end users in order to design a receptive and valuable website.

    • Modernize Your Corporate Website to Drive Business Value – Phase 1: Define UX Requirements
    • Website Design Document Template

    2. Design UX-driven website

    Design a satisfying and receptive website by leveraging industry best practices and modern UX trends and ensuring the website is supported with reliable and scalable data and infrastructure.

    • Modernize Your Corporate Website to Drive Business Value – Phase 2: Design UX-Driven Website
    [infographic]

    Workshop: Modernize Your Corporate Website to Drive Business Value

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Define Your UX Requirements

    The Purpose

    List the business objectives of your website.

    Describe your user personas, use cases, and user workflow.

    Identify current UX issues through simulations, website design, and system reviews.

    Key Benefits Achieved

    Strong understanding of the business goals of your website.

    Knowledge of the behaviors and needs of your website’s users.

    Realization of the root causes behind the UX issues of your website.

    Activities

    1.1 Define the business objectives for the website you want to optimize

    1.2 Define your end-user personas and map them to use cases

    1.3 Build your website user workflow

    1.4 Conduct a SWOT analysis of your website to drive out UX issues

    1.5 Gauge the UX competencies of your web development team

    1.6 Simulate your user workflow to identify the steps driving down UX

    1.7 Assess the composition and construction of your website

    1.8 Understand the execution of your website with a system architecture

    1.9 Pinpoint the technical reason behind your UX issues

    1.10 Clarify and prioritize your UX issues

    Outputs

    Business objectives

    End-user personas and use cases

    User workflows

    Website SWOT analysis

    UX competency assessment

    User workflow simulation

    Website design assessment

    Current state of web system architecture

    Gap analysis of web system architecture

    Prioritized UX issues

    2 Design Your UX-Driven Website

    The Purpose

    Design wireframes and storyboards to be aligned to high priority use cases.

    Design a web system architecture that can sufficiently support the website.

    Identify UX metrics to gauge the success of the website.

    Establish a website design process flow.

    Key Benefits Achieved

    Implementation of key design elements and website functions that users will find stimulating and valuable.

    Optimized web system architecture to better support the website.

    Website design process aligned to your current context.

    Rollout plan for your UX optimization initiatives.

    Activities

    2.1 Define the roles of your UX development team

    2.2 Build your wireframes and user storyboards

    2.3 Design the target state of your web environment

    2.4 List your UX metrics

    2.5 Draw your website design process flow

    2.6 Define your UX optimization roadmap

    2.7 Identify and engage your stakeholders

    Outputs

    Roles of UX development team

    Wireframes and user storyboards

    Target state of web system architecture

    List of UX metrics

    List of your suppliers, inputs, processes, outputs, and customers

    Website design process flow

    UX optimization rollout roadmap

    Build a Data Classification MVP for M365

    • Buy Link or Shortcode: {j2store}67|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: End-User Computing Applications
    • Parent Category Link: /end-user-computing-applications
    • Resources are the primary obstacle to getting a foot hold in O365 governance, whether it is funding or FTE resources.
    • Data is segmented and is difficult to analyze when you can’t see it or manage the relationships between sources.
    • Organizations expect results early and quickly and a common obstacle is that building a proper data classification framework can take more than two years and the business can't wait that long.

    Our Advice

    Critical Insight

    • Data classification is the lynchpin to ANY effective governance of O/M365 and your objective is to navigate through this easily and effectively and build a robust, secure, and viable governance model.
    • Start your journey by identifying what and where your data is and how much data you have. You need to understand what sensitive data you have and where it is stored before you can protect it or govern that data.
    • Ensure there is a high-level leader who is the champion of the governance objective.

    Impact and Result

    • Using least complex sensitivity labels in your classification are your building blocks to compliance and security in your data management schema; they are your foundational steps.

    Build a Data Classification MVP for M365 Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Build a Data Classification MVP for M365 Deck – A guide for how to build a minimum-viable product for data classification that end users will actually use.

    Discover where your data resides, what governance helps you do, and what types of data you're classifying. Then build your data and security protection baselines for your retention policy, sensitivity labels, workload containers, and both forced and unforced policies.

    • Build a Data Classification MVP for M365 Storyboard
    [infographic]

    Further reading

    Build a Data Classification MVP for M365

    Kickstart your governance with data classification users will actually use!

    Executive Summary

    Info-Tech Insight

    • Creating an MVP gets you started in data governance
      Information protection and governance are not something you do once and then you are done. It is a constant process where you start with the basics (a minimum-viable product or MVP) and enhance your schema over time. The objective of the MVP is reducing obstacles to establishing an initial governance position, and then enabling rapid development of the solution to address a variety of real risks, including data loss prevention (DLP), data retention, legal holds, and data labeling.
    • Define your information and protection strategy
      The initial strategy is to start looking across your organization and identifying your customer data, regulatory data, and sensitive information. To have a successful data protection strategy you will include lifecycle management, risk management, data protection policies, and DLP. All key stakeholders need to be kept in the loop. Ensure you keep track of all available data and conduct a risk analysis early. Remember, data is your highest valued intangible asset.
    • Planning and resourcing are central to getting started on MVP
      A governance plan and governance decisions are your initial focus. Create a team of stakeholders that include IT and business leaders (including Legal, Finance, HR, and Risk), and ensure there is a top-level leader who is the champion of the governance objective, which is to ensure your data is safe, secure, and not prone to leakage or theft, and maintain confidentiality where it is warranted.

    Executive Summary

    Your Challenge
    • Today, the amount of data companies are gathering is growing at an explosive rate. New tools are enabling unforeseen channels and ways of collaborating.
    • Combined with increased regulatory oversight and reporting obligations, this makes the discovery and management of data a massive undertaking. IT can’t find and protect the data when the business has difficulty defining its data.
    • The challenge is to build a framework that can easily categorize and classify data yet allows for sufficient regulatory compliance and granularity to be useful. Also, to do it now because tomorrow is too late.
    Common Obstacles

    Data governance has several obstacles that impact a successful launch, especially if governing M365 is not a planned strategy. Below are some of the more common obstacles:

    • Resources are the primary obstacle to starting O365 governance, whether it is funding or people.
    • Data is segmented and is difficult to analyze when you can’t see it or manage the relationships between sources.
    • Organizations expect results early and quickly and a common obstacle is that building a "proper data classification framework” is a 2+ year project and the business can't wait that long.
    Info-Tech’s Approach
    • Start with the basics: build a minimum-viable product (MVP) to get started on the path to sustainable governance.
    • Identify what and where your data resides, how much data you have, and understand what sensitive data needs to be protected.
    • Create your team of stakeholders, including Legal, records managers, and privacy officers. Remember, they own the data and should manage it.
    • Categorization comes before classification, and discovery comes before categorization. Use easy-to-understand terms like high, medium, or low risk.

    Info-Tech Insight

    Data classification is the lynchpin to any effective governance of O/M365 and your objective is to navigate through this easily and effectively and build a robust, secure, and viable governance model. Start your journey by identifying what and where your data is and how much data do you have. You need to understand what sensitive data you have and where it is stored before you can protect or govern it. Ensure there is a high-level leader who is the champion of the governance objectives. Data classification fulfills the governance objectives of risk mitigation, governance and compliance, efficiency and optimization, and analytics.

    Questions you need to ask

    Four key questions to kick off your MVP.

    1

    Know Your Data

    Do you know where your critical and sensitive data resides and what is being done with it?

    Trying to understand where your information is can be a significant project.

    2

    Protect Your Data

    Do you have control of your data as it traverses across the organization and externally to partners?

    You want to protect information wherever it goes through encryption, etc.

    3

    Prevent Data Loss

    Are you able to detect unsafe activities that prevent sharing of sensitive information?

    Data loss prevention (DLP) is the practice of detecting and preventing data breaches, exfiltration, or unwanted destruction of sensitive data.

    4

    Govern Your Data

    Are you using multiple solutions (or any) to classify, label, and protect sensitive data?

    Many organizations use more than one solution to protect and govern their data, making it difficult to determine if there are any coverage gaps.

    Classification tiers

    Build your schema.

    Pyramid visualization for classification tiers. The top represents 'Simplicity', and the bottom 'Complexity' with the length of the sides at each level representing the '# of policies' and '# of labels'. At the top level is 'MVP (Minimum-Viable Product) - Confidential, Internal (Subcategory: Personal), Public'. At the middle level is 'Regulated - Highly Confidential, Confidential, Sensitive, General, Internal, Restricted, Personal, Sub-Private, Public'. And a the bottom level is 'Government (DOD) - Top Secret (TS), Secret, Confidential, Restricted, Official, Unclassified, Clearance'

    Info-Tech Insight

    Deciding on how granular you go into data classification will chiefly be governed by what industry you are in and your regulatory obligations – the more highly regulated your industry, the more classification levels you will be mandated to enforce. The more complexity you introduce into your organization, the more operational overhead both in cost and resources you will have to endure and build.

    Microsoft MIP Topology

    Microsoft Information Protection (MIP), which is Microsoft’s Data Classification Services, is the key to achieving your governance goals. Without an MVP, data classification will be overwhelming; simplifying is the first step in achieving governance.

    A diagram of multiple offerings all connected to 'MIP Data Classification Service'. Circled is 'Sensitivity Labels' with an arrow pointing back to 'MIP' at the center.
    (Source: Microsoft, “Microsoft Purview compliance portal”)

    Info-Tech Insight

    Using least-complex sensitivity labels in your classification are your building blocks to compliance and security in your data management schema; they are your foundational steps.

    MVP RACI Chart

    Data governance is a "takes a whole village" kind of effort.

    Clarify who is expected to do what with a RACI chart.

    End User M365 Administrator Security/ Compliance Data Owner
    Define classification divisions R A
    Appy classification label to data – at point of creation A R
    Apply classification label to data – legacy items R A
    Map classification divisions to relevant policies R A
    Define governance objectives R A
    Backup R A
    Retention R A
    Establish minimum baseline A R

    What and where your data resides

    Data types that require classification.

    Logos for 'Microsoft', 'Office 365', and icons for each program included in that package.
    M365 Workload Containers
    Icon for MS Exchange. Icon for MS SharePoint.Icon for MS Teams. Icon for MS OneDrive. Icon for MS Project Online.
    Email
    • Attachments
    Site Collections, Sites Sites Project Databases
    Contacts Teams and Group Site Collections, Sites Libraries and Lists Sites
    Metadata Libraries and Lists Documents
    • Versions
    Libraries and Lists
    Teams Conversations Documents
    • Versions
    Metadata Documents
    • Versions
    Teams Chats Metadata Permissions
    • Internal Sharing
    • External Sharing
    Metadata
    Permissions
    • Internal Sharing
    • External Sharing
    Files Shared via Teams Chats Permissions
    • Internal Sharing
    • External Sharing

    Info-Tech Insight

    Knowing where your data resides will ensure you do not miss any applicable data that needs to be classified. These are examples of the workload containers; you may have others.

    Discover and classify on- premises files using AIP

    AIP helps you manage sensitive data prior to migrating to Office 365:
    • Use discover mode to identify and report on files containing sensitive data.
    • Use enforce mode to automatically classify, label, and protect files with sensitive data.
    Can be configured to scan:
    • SMB files
    • SharePoint Server 2016, 2013
    Stock image of a laptop uploading to the cloud with a padlock and key in front of it.
    • Map your network and find over-exposed file shares.
    • Protect files using MIP encryption.
    • Inspect the content in file repositories and discover sensitive information.
    • Classify and label file per MIP policy.
    Azure Information Protection scanner helps discover, classify, label, and protect sensitive information in on-premises file servers. You can run the scanner and get immediate insight into risks with on-premises data. Discover mode helps you identify and report on files containing sensitive data (Microsoft Inside Track and CIAOPS, 2022). Enforce mode automatically classifies, labels, and protects files with sensitive data.

    Info-Tech Insight

    Any asset deployed to the cloud must have approved data classification. Enforcing this policy is a must to control your data.

    Understanding governance

    Microsoft Information Governance

    Information Governance
    • Retention policies for workloads
    • Inactive and archive mailboxes

    Arrow pointing down-right

    Records Management
    • Retention labels for items
    • Disposition review

    Arrow pointing down-left

    Retention and Deletion

    ‹——— Connectors for Third-Party Data ———›

    Information governance manages your content lifecycle using solutions to import, store, and classify business-critical data so you can keep what you need and delete what you do not. Backup should not be used as a retention methodology since information governance is managed as a “living entity” and backup is a stored information block that is “suspended in time.” Records management uses intelligent classification to automate and simplify the retention schedule for regulatory, legal, and business-critical records in your organization. It is for that discrete set of content that needs to be immutable.
    (Source: Microsoft, “Microsoft Purview compliance portal”)

    Retention and backup policy decision

    Retention is not backup.

    Info-Tech Insight

    Retention is not backup. Retention means something different: “the content must be available for discovery and legal document production while being able to defend its provenance, chain of custody, and its deletion or destruction” (AvePoint Blog, 2021).

    Microsoft Responsibility (Microsoft Protection) Weeks to Months Customer Responsibility (DLP, Backup, Retention Policy) Months to Years
    Loss of service due to natural disaster or data center outage Loss of data due to departing employees or deactivated accounts
    Loss of service due to hardware or infrastructure failure Loss of data due to malicious insiders or hackers deleting content
    Short-term (30 days) user error with recycle bin/ version history (including OneDrive “File Restore”) Loss of data due to malware or ransomware
    Short-term (14 days) administrative error with soft- delete for groups, mailboxes, or service-led rollback Recovery from prolonged outages
    Long-term accidental deletion coverage with selective rollback

    Understand retention policy

    What are retention policies used for? Why you need them as part of your MVP?

    Do not confuse retention labels and policies with backup.

    Remember: “retention [policies are] auto-applied whereas retention label policies are only applied if the content is tagged with the associated retention label” (AvePoint Blog, 2021).

    E-discovery tool retention policies are not turned on automatically.

    Retention policies are not a backup tool – when you activate this feature you are unable to delete anyone.

    “Data retention policy tools enable a business to:

    • “Decide proactively whether to retain content, delete content, or retain and then delete the content when needed.
    • “Apply a policy to all content or just content meeting certain conditions, such as items with specific keywords or specific types of sensitive information.
    • “Apply a single policy to the entire organization or specific locations or users.
    • “Maintain discoverability of content for lawyers and auditors, while protecting it from change or access by other users. […] ‘Retention Policies’ are different than ‘Retention Label Policies’ – they do the same thing – but a retention policy is auto-applied, whereas retention label policies are only applied if the content is tagged with the associated retention label.

    “It is also important to remember that ‘Retention Label Policies’ do not move a copy of the content to the ‘Preservation Holds’ folder until the content under policy is changed next.” (Source: AvePoint Blog, 2021)

    Definitions

    Data classification is a focused term used in the fields of cybersecurity and information governance to describe the process of identifying, categorizing, and protecting content according to its sensitivity or impact level. In its most basic form, data classification is a means of protecting your data from unauthorized disclosure, alteration, or destruction based on how sensitive or impactful it is.

    Once data is classified, you can then create policies; sensitive data types, trainable classifiers, and sensitivity labels function as inputs to policies. Policies define behaviors, like if there will be a default label, if labeling is mandatory, what locations the label will be applied to, and under what conditions. A policy is created when you configure Microsoft 365 to publish or automatically apply sensitive information types, trainable classifiers, or labels.

    Sensitivity label policies show one or more labels to Office apps (like Outlook and Word), SharePoint sites, and Office 365 groups. Once published, users can apply the labels to protect their content.

    Data loss prevention (DLP) policies help identify and protect your organization's sensitive info (Microsoft Docs, April 2022). For example, you can set up policies to help make sure information in email and documents is not shared with the wrong people. DLP policies can use sensitive information types and retention labels to identify content containing information that might need protection.

    Retention policies and retention label policies help you keep what you want and get rid of what you do not. They also play a significant role in records management.

    Data examples for MVP classification

    • Examples of the type of data you consider to be Confidential, Internal, or Public.
    • This will help you determine what to classify and where it is.
    Internal Personal, Employment, and Job Performance Data
    • Social Security Number
    • Date of birth
    • Marital status
    • Job application data
    • Mailing address
    • Resume
    • Background checks
    • Interview notes
    • Employment contract
    • Pay rate
    • Bonuses
    • Benefits
    • Performance reviews
    • Disciplinary notes or warnings
    Confidential Information
    • Business and marketing plans
    • Company initiatives
    • Customer information and lists
    • Information relating to intellectual property
    • Invention or patent
    • Research data
    • Passwords and IT-related information
    • Information received from third parties
    • Company financial account information
    • Social Security Number
    • Payroll and personnel records
    • Health information
    • Self-restricted personal data
    • Credit card information
    Internal Data
    • Sales data
    • Website data
    • Customer information
    • Job application data
    • Financial data
    • Marketing data
    • Resource data
    Public Data
    • Press releases
    • Job descriptions
    • Marketing material intended for general public
    • Research publications

    New container sensitivity labels (MIP)

    New container sensitivity labels

    Public Private
    Privacy
    1. Membership to group is open; anyone can join
    2. “Everyone except external guest” ACL onsite; content available in search to all tenants
    1. Only owner can add members
    2. No access beyond the group membership until someone shares it or changes permissions
    Allowed Not Allowed
    External guest policy
    1. Membership to group is open; anyone can join
    2. “Everyone except external guest” ACL onsite; content available in search to all tenants
    1. Only owner can add members
    2. No access beyond the group membership until someone shares it or changes permissions

    What users will see when they create or label a Team/Group/Site

    Table of what users will see when they create or label a team/group/site highlighting 'External guest policy' and 'Privacy policy options' as referenced above.
    (Source: Microsoft, “Microsoft Purview compliance portal”)

    Info-Tech Insights

    Why you need sensitivity container labels:
    • Manage privacy of Teams Sites and M365 Groups
    • Manage external user access to SPO sites and teams
    • Manage external sharing from SPO sites
    • Manage access from unmanaged devices

    Data protection and security baselines

    Data Protection Baseline

    “Microsoft provides a default assessment in Compliance Manager for the Microsoft 365 data protection baseline" (Microsoft Docs, June 2022). This baseline assessment has a set of controls for key regulations and standards for data protection and general data governance. This baseline draws elements primarily from NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) as well as from FedRAMP (Federal Risk and Authorization Management Program) and GDPR (General Data Protection Regulation of the European Union).

    Security Baseline

    The final stage in M365 governance is security. You need to implement a governance policy that clearly defines storage locations for certain types of data and who has permission to access it. You need to record and track who accesses content and how they share it externally. “Part of your process should involve monitoring unusual external sharing to ensure staff only share documents that they are allowed to” (Rencore, 2021).

    Info-Tech Insights

    • Controls are already in place to set data protection policy. This assists in the MVP activities.
    • Finally, you need to set your security baseline to ensure proper permissions are in place.

    Prerequisite baseline

    Icon of crosshairs.
    Security

    MFA or SSO to access from anywhere, any device

    Banned password list

    BYOD sync with corporate network

    Icon of a group.
    Users

    Sign out inactive users automatically

    Enable guest users

    External sharing

    Block client forwarding rules

    Icon of a database.
    Resources

    Account lockout threshold

    OneDrive

    SharePoint

    Icon of gears.
    Controls

    Sensitivity labels, retention labels and policies, DLP

    Mobile application management policy

    Building baselines

    Sensitivity Profiles: Public, Internal, Confidential; Subcategory: Highly Confidential

    Microsoft 365 Collaboration Protection Profiles

    Sensitivity Public External Collaboration Internal Highly Confidential
    Description Data that is specifically prepared for public consumption Not approved for public consumption, but OK for external collaboration External collaboration highly discouraged and must be justified Data of the highest sensitivity: avoid oversharing, internal collaboration only
    Label details
    • No content marking
    • No encryption
    • Public site
    • External collaboration allowed
    • Unmanaged devices: allow full access
    • No content marking
    • No encryption
    • Private site
    • External collaboration allowed
    • Unmanaged devices: allow full access
    • Content marking
    • Encryption
    • Private site
    • External collaboration allowed but monitored
    • Unmanaged devices: limited web access
    • Content marking
    • Encryption
    • Private site
    • External collaboration disabled
    • Unmanaged devices: block access
    Teams or Site details Public Team or Site open discovery, guests are allowed Private Team or Site members are invited, guests are allowed Private Team or Site members are invited, guests are not allowed
    DLP None Warn Block

    Please Note: Global/Compliance Admins go to the 365 Groups platform, the compliance center (Purview), and Teams services (Source: Microsoft Documentation, “Microsoft Purview compliance documentation”)

    Info-Tech Insights

    • Building baseline profiles will be a part of your MVP. You will understand what type of information you are addressing and label it accordingly.
    • Sensitivity labels are a way to classify your organization's data in a way that specifies how sensitive the data is. This helps you decrease risks in sharing information that shouldn't be accessible to anyone outside your organization or department. Applying sensitivity labels allows you to protect all your data easily.

    MVP activities

    PRIMARY
    ACTIVITIES
    Define Your Governance
    The objective of the MVP is reducing barriers to establishing an initial governance position, and then enabling rapid progression of the solution to address a variety of tangible risks, including DLP, data retention, legal holds, and labeling.
    Decide on your classification labels early.

    CATEGORIZATION





    CLASSIFICATION

    MVP
    Data Discovery and Management
    AIP (Azure Information Protection) scanner helps discover, classify, label, and protect sensitive information in on-premises file servers. You can run the scanner and get immediate insight into risks with on-premises data.
    Baseline Setup
    Building baseline profiles will be a part of your MVP. You will understand what type of information you are addressing and label it accordingly. Microsoft provides a default assessment in Compliance Manager for the Microsoft 365 data protection baseline.
    Default M365 settings
    Microsoft provides a default assessment in Compliance Manager for the Microsoft 365 data protection baseline. This baseline assessment has a set of controls for key regulations and standards for data protection and general data governance.
    SUPPORT
    ACTIVITIES
    Retention Policy
    Retention policy is auto-applied. Decide whether to retain content, delete content, or retain and then delete the content.
    Sensitivity Labels
    Automatically enforce policies on groups through labels; classify groups.
    Workload Containers
    M365: SharePoint, Teams, OneDrive, and Exchange, where your data is stored for labels and policies.
    Unforced Policies
    Written policies that are not enforceable by controls in Compliance Manager such as acceptable use policy.
    Forced Policies
    Restrict sharing controls to outside organizations. Enforce prefix or suffix to group or team names.

    ACME Company MVP for M/O365

    PRIMARY
    ACTIVITIES
    Define Your Governance


    Focus on ability to use legal hold and GDPR compliance.

    CATEGORIZATION





    CLASSIFICATION

    MVP
    Data Discovery and Management


    Three classification levels (public, internal, confidential), which are applied by the user when data is created. Same three levels are used for AIP to scan legacy sources.

    Baseline Setup


    All data must at least be classified before it is uploaded to an M/O365 cloud service.

    Default M365 settings


    Turn on templates 1 8 the letter q and the number z

    SUPPORT
    ACTIVITIES
    Retention Policy


    Retention policy is auto-applied. Decide whether to retain content, delete content, or retain and then delete the content.

    Sensitivity Labels


    Automatically enforce policies on groups through labels; classify groups.

    Workload Containers


    M365: SharePoint, Teams, OneDrive, and Exchange, where your data is stored for labels and policies.

    Unforced Policies


    Written policies that are not enforceable by controls in Compliance Manager such as acceptable use policy.

    Forced Policies


    Restrict sharing controls to outside organizations. Enforce prefix or suffix to group or team names.

    Related Blueprints

    Govern Office 365

    Office 365 is as difficult to wrangle as it is valuable. Leverage best practices to produce governance outcomes aligned with your goals.

    Map your organizational goals to the administration features available in the Office 365 console. Your governance should reflect your requirements.

    Migrate to Office 365 Now

    Jumping into an Office 365 migration project without careful thought of the risks of a cloud migration will lead to project halt and interruption. Intentionally plan in order to expose risk and to develop project foresight for a smooth migration.

    Microsoft Teams Cookbook

    Remote work calls for leveraging your Office 365 license to use Microsoft Teams – but IT is unsure about best practices for governance and permissions. Moreover, IT has few resources to help train end users with Teams best practices

    IT Governance, Risk & Compliance

    Several blueprints are available on a broader topic of governance, from Make Your IT Governance Adaptable to Improve IT Governance to Drive Business Results and Build an IT Risk Management Program.

    Bibliography

    “Best practices for sharing files and folders with unauthenticated users.” Microsoft Build, 28 April 2022. Accessed 2 April 2022.

    “Build and manage assessments in Compliance Manager.” Microsoft Docs, 15 June 2022. Web.

    “Building a modern workplace with Microsoft 365.” Microsoft Inside Track, n.d. Web.

    Crane, Robert. “June 2020 Microsoft 365 Need to Know Webinar.” CIAOPS, SlideShare, 26 June 2020. Web.

    “Data Classification: Overview, Types, and Examples.” Simplilearn, 27 Dec. 2021. Accessed 11 April 2022.

    “Data loss prevention in Exchange Online.” Microsoft Docs, 19 April 2022. Web.

    Davies, Nahla. “5 Common Data Governance Challenges (and How to Overcome Them).” Dataversity. 25 October 2021. Accessed 5 April 2022.

    “Default labels and policies to protect your data.” Microsoft Build, April 2022. Accessed 3 April 2022.

    M., Peter. "Guide: The difference between Microsoft Backup and Retention." AvePoint Blog, 9 Oct. 2021. Accessed 4 April 2022.

    Meyer, Guillaume. “Sensitivity Labels: What They Are, Why You Need Them, and How to Apply Them.” nBold, 6 October 2021. Accessed 2 April 2022.

    “Microsoft 365 guidance for security & compliance.” Microsoft, 27 April 2022. Accessed 28 April 2022.

    “Microsoft Purview compliance portal.” Microsoft, 19 April 2022. Accessed 22 April 2022.

    “Microsoft Purview compliance documentation.” Microsoft, n.d. Accessed 22 April 2022.

    “Microsoft Trust Center: Products and services that run on trust.” Microsoft, 2022. Accessed 3 April 2022.

    “Protect your sensitive data with Microsoft Purview.” Microsoft Build, April 2022. Accessed 3 April 2022.

    Zimmergren, Tobias. “4 steps to successful cloud governance in Office 365.” Rencore, 9 Sept. 2021. Accessed 5 April 2022.

    Identify and Manage Regulatory and Compliance Risk Impacts on Your Organization

    • Buy Link or Shortcode: {j2store}366|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management

    More than at any other time, our world is changing. As a result, organizations – and their vendors – need to be able to adapt their plans to accommodate risk on an unprecedented level.

    It is increasingly likely that one of your vendors, or their n-party support vendors, will fall out of regulatory compliance. Therefore, organizations must protect themselves by creating better mechanisms to hold their n-party vendors accountable and validate that they comply.

    Our Advice

    Critical Insight

    • Identifying and managing a vendor’s potential regulatory impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes may affect operations.
    • Organizational leadership is often taken unaware by changes, and their plans lack the flexibility to adjust to significant regulatory upheavals.

    Impact and Result

    Vendor management practices educate organizations on the different potential risks from vendors in your market and suggest creative and alternative ways to avoid and help manage them.

    • Prioritize and classify your vendors with quantifiable, standardized rankings.
    • Prioritize focus on your high-risk vendors.
    • Standardize your processes for identifying and monitoring vendor risks with our Regulatory Risk Impact Tool to manage potential impacts.

    Identify and Manage Regulatory and Compliance Risk Impacts on Your Organization Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify and Manage Regulatory and Compliance Risk Impacts to Your Organization Storyboard – Use the research to better understand the negative impacts of vendor actions to your brand reputation.

    Use this research to identify and quantify the potential regulatory impacts caused by vendors. Use Info-Tech's approach to look at the regulatory impact from various perspectives to better prepare for issues that may arise.

    • Identify and Manage Regulatory and Compliance Risk Impacts on Your Organization Storyboard

    2. Regulatory Risk Impact Tool – Use this tool to help identify and quantify the operational impacts of negative vendor actions.

    By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    • Regulatory Risk Impact Tool
    [infographic]

    Further reading

    Identify and Manage Risk Impacts on Your Organization

    It is easier for prospective clients to find out what you did wrong than that you fixed the issue.

    Analyst perspective

    Organizations must understand the regulatory damage vendors may cause from lack of compliance.

    Frank Sewell.

    The sheer number of regulations on the international market is immense, ever-changing, and make it almost impossible for any organization to consistently keep up with compliance.

    As regulatory enforcement increases, organizations must hold their vendors accountable for compliance through ongoing monitoring and validation of regulatory compliance to the relevant standards in their industries, or face increasing penalties for non-compliance.

    Frank Sewell,

    Research Director, Vendor Management

    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Common Obstacles

    Info-Tech’s Approach

    More than at any previous time, our world is changing rapidly. As a result, organizations – and their vendors – need to be able to adapt their plans to accommodate risk on an unprecedented level.

    It is increasingly likely that one of your vendors, or their n-party support vendors, will fall out of regulatory compliance. Organizations must protect themselves by creating better mechanisms to hold their n-party vendors accountable and validate that they comply.

    Identifying and managing a vendor’s potential regulatory impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes may affect operations.

    Organizational leadership is often taken unaware by changes, and their plans lack the flexibility to adjust to significant regulatory upheavals.

    Vendor management practices educate organizations on the different potential risks from vendors in your market and suggest creative and alternative ways to avoid and help manage them.

    Prioritize and classify your vendors with quantifiable, standardized rankings.

    Prioritize focus on your high-risk vendors.

    Standardize your processes for identifying and monitoring vendor risks with our Regulatory Risk Impact Tool to manage potential impacts.

    Info-Tech Insight

    Organizations must evolve their risk assessments to be more adaptive to respond to regulatory changes in the global market. Ongoing monitoring of the vendors who must comply with industry and governmental regulations is crucial to avoiding penalties and maintaining your regulatory compliance.

    Info-Tech’s multi-blueprint series on vendor risk assessment

    There are many individual components of vendor risk beyond cybersecurity.

    The image contains a cube that is divided into 6 asymmetrical to highlight the six components of vendor risk. Strategic, Security, Regulatory & Compliance, Financial, Reputational, Operational.

    This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

    Out of Scope:

    This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

    Regulatory and Compliance risk impacts

    Potential losses to the organization due regulatory and compliance incidents.

    • In this blueprint we’ll:
      • Explore regulatory and compliance risks and their impacts.
      • Identify potentially disruptive events to assess the overall impact on organizations and implement adaptive measures to identify, manage, and monitor vendor performance.

    The image contains a cube that is divided into 6 asymmetrical to highlight the six components of vendor risk. Strategic, Security, Regulatory & Compliance, Financial, Reputational, Operational. Regulatory & Compliance is highlighted on the cube.

    The world is constantly changing

    The IT market is constantly reacting to global influences. By anticipating changes, leaders can set expectations and work with their vendors to accommodate them and avoid penalties.

    When the unexpected happens, being able to adapt quickly to new priorities and regulations ensures continued long-term business success.

    Below are some things no one expected to happen in the last few years:

    45%

    Have no visibility into their upstream supply chain, or they can only see as far as their first-tier suppliers.

    2022 McKinsey

    61%

    Of compliance officers expect to increase investment in their compliance function over the next two years.

    2022 Accenture

    $770k+

    Breaches involving third-party vendors cost more on average.

    2022 HIT Consultant.net

    Regulatory Compliance

    Consider implementing vendor management initiatives and practices in your organization to help gain compliance with your expanding vendor landscape.

    Your organizational risks may be monitored but are your n-party vendors?

    The image contains a cube that is divided into 6 asymmetrical to highlight the six components of vendor risk. Strategic, Security, Regulatory & Compliance, Financial, Reputational, Operational.

    Review your expectations with your vendors and hold them accountable.

    Regulatory entities are looking beyond your organization’s internal compliance these days. More and more they are diving into your third-party and downstream relationships, particularly as awareness of downstream breaches increases globally.

    • Are you assessing your vendors regularly?
    • Are you validating those assessments?
    • Do your vendors have a map of their downstream support vendors?
    • Do they have the mechanisms to hold those downstream vendors accountable to your standards?

    Regulatory Guidance and Industry Standards

    Are you confident your vendors meet your standards?

    Identify and manage regulatory and compliance risks

    Environmental, Social, Governance (ESG)
    Regulatory agencies are putting more enforcement on ESG practices across the globe. As a result, organizations will need to monitor the changing regulations and validate that their vendors and n-party support vendors are adhering to these regulations, or face penalties for non-compliance.

    Data Protection
    Data Protection remains an issue in the world. Organizations should ensure that the data their vendors obtain remains protected throughout the vendor’s lifecycle, including post-termination. Otherwise, they could be monitoring for a data breach in perpetuity.

    Mergers and Acquisitions
    More prominent vendors continuously buy smaller companies to control the market in the IT industry. Therefore, organizations should put protections in their contracts to ensure that an IT vendor’s acquisition does not put them in a relationship with someone that could cause them an issue.

    What to look for

    Identify regulatory and compliance risk impacts.

    • Is there a record of complaints against the vendor from their employees or customers?
    • Has the vendor been cited for regulatory compliance issues in the past?
    • Does the vendor have a comprehensive list of their n-party vendor partners?
      • Are they willing to accept appropriate contractual protections regarding them?
    • Does the vendor self-audit, or do they use a vetted third-party audit firm to issue a SOC report annually?
    • Does the vendor operate in regions known for regulatory violations?
    • Is the vendor willing to make concessions on contractual protections, or are they only offering “one-sided” agreements with “as-is” warranties?

    Prepare your vendor risk management for success

    Due diligence will enable successful outcomes.

    1. Obtain top-level buy-in; it is critical to success.
    2. Build enterprise risk management (ERM) through incremental improvement.
    3. Focus initial efforts on the “big wins” to prove the process works.
    4. Use existing resources.
    5. Build on any risk management activities that already exist in the organization.
    6. Socialize ERM throughout the organization to gain additional buy‑in.
    7. Normalize the process long term, with ongoing updates and continuing education for the organization.

    (Adapted from COSO)

    How to assess third-party risk

    1. Review Organizational Regulations
    2. Understand the organization’s regulatory risks to prepare for the “What If” game exercise.

    3. Identify & Understand Potential Regulatory-Compliance Risks
    4. Play the “What If” game with the right people at the table.

    5. Create a Risk Profile Packet for Leadership
    6. Pull all the information together in a presentation document.

    7. Validate the Risks
    8. Work with leadership to ensure that the proposed risks are in line with their thoughts.

    9. Plan to Manage the Risks
    10. Lower the overall risk potential by putting mitigations in place.

    11. Communicate the Plan
    12. It is important not only to have a plan but also to socialize it in the organization for awareness.

    13. Enact the Plan
    14. Once the plan is finalized and socialized, put it in place with continued monitoring for success.

    Adapted from Harvard Law School Forum on Corporate Governance

    Insight summary

    Regulatory risk impacts often come from unexpected places and have significant consequences. Knowing who your vendors are using for their support and supply chain could be crucial in eliminating the risk of non-compliance for your organization. Having a plan to identify and validate the regulatory compliance of your vendors is a must for any organization, to avoid penalties.

    Insight 1

    Organizations fail to plan for vendor acquisitions appropriately.

    Vendors routinely get acquired in the IT space. Does your organization have appropriate safeguards from inadvertently entering a negative relationship? Do you have plans around replacing critical vendors purchased in such a manner?

    Insight 2

    Organizations often fail to understand how n-party vendors could place them in non-compliance.

    Even if you know your complete third-party vendor landscape, you may not be aware of the downstream vendors in play. Ensure that you get visibility into this space as well and hold your direct vendors accountable for the actions of their vendors.

    Insight 3

    Organizations need to know where their data lives and ensure it is protected.

    Make sure you know which vendors are accessing/storing your data, where they are keeping it, and that you can get it back and have the vendors destroy it when the relationship is over. Without adequate protection throughout the lifecycle of the vendor, you could be monitoring for breaches in perpetuity.

    Identifying regulatory and compliance risks

    Who should be included in the discussion.

    • While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make informed decisions.
    • Getting input from regulatory risk experts within your organization will enhance your long-term potential for successful compliance.
    • Involving those who not only directly manage vendors but also understand your regulatory requirements will aid in determining the path forward for relationships with your current vendors, and identifying new emerging potential partners.

    See the blueprint Build an IT Risk Management Program

    Review your risk management plans for new risks on a regular basis.

    Keep in mind Risk = Likelihood x Impact (R=L*I).

    Impact (I) tends to remain the same, while Likelihood (L) is becoming closer to 100% as threat actors become more prevalent

    Managing vendor regulatory and compliance risk impacts

    How could your vendors fall out of compliance?

    • Review vendors’ downstream connections to understand thoroughly with whom you are in business.
      • Monitor their regulatory stance as it could reflect on your organization.
    • Institute proper vendor lifecycle management.
      • Make sure to follow corporate due diligence and risk assessment policies and procedures.
      • Failure to consistently do so is a recipe for disaster.
    • Develop IT risk governance and change control.
    • Introduce continual risk assessment to monitor the relevant vendor markets.
      • Regularly review your regulatory requirements for new and changing risks.
    • Be adaptable and allow for innovations that arise from the current needs.
      • Capture lessons learned from prior incidents to improve over time, and adjust your plans accordingly.

    Organizations must review their regulatory risk appetite and tolerance levels, considering their complete landscape.

    Changing regulations, acquisitions, and events that affect global supply chains are current realities, not unlikely scenarios.

    Ongoing Improvement

    Incorporating lessons learned.

    • Over time, despite everyone’s best observations and plans, incidents will catch us off guard.
    • When it happens, follow your incident response plans and act accordingly.
    • An essential step is to document what worked and what did not – collectively known as the “lessons learned.”
    • Use the lessons learned document to devise, incorporate, and enact a better risk management process.

    Sometimes disasters occur despite our best plans to manage them.

    When this happens, it is important to document the lessons learned and update our plans.

    The “what if” game

    1-3 hours

    Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible adverse outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    1. Break into smaller groups (or if too small, continue as a single group).
    2. Use the Regulatory Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potentials but manage the overall process to keep the discussion pertinent and on track.
    3. Collect the outputs and ask the subject matter experts (SMEs) for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.
    Input Output
    • List of identified potential risk scenarios scored by regulatory-compliance impact
    • List of potential mitigations of the scenarios to reduce the risk
    • Comprehensive regulatory risk profile on the specific vendor solution
    Materials Participants
    • Whiteboard/flip charts
    • Regulatory Risk Impact Tool to help drive discussion
    • Vendor Management – Coordinator
    • Organizational Leadership
    • Operations Experts (SMEs)
    • Legal/Compliance/Risk Manager

    High risk example from tool

    The image contains a screenshot demonstrating high risk example from the tool.

    How to mitigate:

    Contractually insist that the vendor have a third-party security audit performed annually, with the stipulation that they will not denigrate below your acceptable standards.

    Note: Even though a few items are “scored” they have not been added to the overall weight, signaling that the company has noted but does not necessarily hold them against the vendor.

    Low risk example from tool

    The image contains a screenshot demonstrating low risk example from the tool.

    Summary

    Seek to understand all regulatory requirements to obtain compliance.

    • Organizations need to understand and map out their entire vendor landscape.
    • Understand where all your data lives and how you can control it throughout the vendor lifecycle.
    • Those organizations that consistently follow their established risk assessment and due diligence processes are better positioned to avoid penalties.
    • Bring the right people to the table to outline potential risks in the market and your organization.
    • Incorporate “lessons learned” from prior incidents into your risk management process to build better plans for future issues.

    Keeping up with the ever-changing regulations can make compliance a difficult task.

    Organizations should increase the resources dedicated to monitoring these regulations as agencies continue to hold them more accountable.

    Related Info-Tech Research

    Identify and Manage Financial Risk Impacts on Your Organization

    • Vendor management practices educate organizations on potential financial impacts that vendors may incur and suggest systems to help manage them.
    • Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

    Identify and Manage Reputational Risk Impacts on Your Organization

    • Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

    Identify and Manage Strategic Risk Impacts on Your Organization

    • Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your strategic plan with our Strategic Risk Impact Tool.

    Info-Tech Insight

    It is easier for prospective clients to find out what you did wrong than that you fixed the issue.


    Bibliography

    Alicke, Knut, et al. "Taking the pulse of shifting supply chains", McKinsey & Company, August 26th 2022. Accessed October 31st
    Regan, Samantha, et al. "Can compliance keep up with warp-speed Change?", accenture, May 18th 2022. Accessed Oct 31st 2022.
    Feria, Nathalie, and Rosenberg, Daniel. "Mitigating Healthcare Cyber Risk Through Vendor Management", HIT Consultant, October 17th 2022. Accessed Oct 31st 2022.
    Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012.
    Frigo, Mark L., and Richard J. Anderson. “Embracing Enterprise Risk Management: Practical Approaches for Getting Started.” COSO, 2011.

    Secure IT-OT Convergence

    • Buy Link or Shortcode: {j2store}382|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: $10,499 Average $ Saved
    • member rating average days saved: 19 Average Days Saved
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations

    IT and OT are both very different complex systems. However, significant benefits have driven OT to be converged to IT. This results in IT security leaders, OT leaders and their teams' facing challenges in:

    • Governing and managing IT and OT security and accountabilities.
    • Converging security architecture and controls between IT and OT environments.
    • Compliance with regulations and standards.
    • Metrics for OT security effectiveness and efficiency.

    Our Advice

    Critical Insight

    • Returning to isolated OT is not beneficial for the organization, therefore IT and OT need to learn to collaborate starting with communication to build trust and to overcome differences between IT and OT. Next, negotiation is needed on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and metrics for OT security.
    • Most OT incidents start with attacks against IT networks and then move laterally into the OT environment. Therefore, converging IT and OT security will help protect the entire organization.
    • OT interfaces with the physical world while IT system concerns more on cyber world. Thus, the two systems have different properties. The challenge is how to create strategic collaboration between IT-OT based on negotiation and this needs top-down support.

    Impact and Result

    Info-Tech’s approach in preparing for IT/OT convergence in the planning phase is coordination and collaboration of IT and OT to

    • initiate communication to define roles and responsibilities.
    • establish governance and build cross-functional team.
    • identify convergence components and compliance obligations.
    • assess readiness.

    Secure IT/OT Convergence Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Secure IT/OT Convergence Storyboard – A step-by-step document that walks you through how to secure IT-OT convergence.

    Info-Tech provides a three-phase framework of secure IT/OT convergence, namely Plan, Enhance, and Monitor & Optimize. The essential steps in Plan are to:

  • Initiate communication to define roles and responsibilities.
  • Establish governance and build a cross-functional team.
  • Identify convergence components and compliance obligations.
  • Assess readiness.
    • Secure IT/OT Convergence Storyboard

    2. Secure IT/OT Convergence Requirements Gathering Tool – A tool to map organizational goals to secure IT-OT goals.

    This tool serves as a repository for information about the organization, compliance, and other factors that will influence your IT/OT convergence.

    • Secure IT/OT Convergence Requirements Gathering Tool

    3. Secure IT/OT Convergence RACI Chart Tool – A tool to identify and understand the owners of various IT/OT convergence across the organization.

    A critical step in secure IT/OT convergence is populating a RACI (Responsible, Accountable, Consulted, and Informed) chart. The chart assists you in organizing roles for carrying out convergence steps and ensures that there are definite roles that different individuals in the organization must have. Complete this tool to assign tasks to suitable roles.

    • Secure IT/OT Convergence RACI Chart Tool
    [infographic]

    Further reading

    Secure IT/OT Convergence

    Create a holistic IT/OT security culture.

    Analyst Perspective

    Are you ready for secure IT/OT convergence?

    IT/OT convergence is less of a convergence and more of a migration. The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.

    In the past, OT systems were engineered to be air gapped, relying on physical protection and with little or no security in design, (e.g. OT protocols without confidentiality properties). However, now, OT has become dependent on the IT capabilities of the organization, thus OT inherits IT’s security issues, that is, OT is becoming more vulnerable to attack from outside the system. IT/OT convergence is complex because the culture, policies, and rules of IT are quite foreign to OT processes such as change management, and the culture, policies, and rules of OT are likewise foreign to IT processes.

    A secure IT/OT convergence can be conceived of as a negotiation of a strong treaty between two systems: IT and OT. The essential initial step is to begin with communication between IT and OT, followed by necessary components such as governing and managing OT security priorities and accountabilities, converging security controls between IT and OT environments, assuring compliance with regulations and standards, and establishing metrics for OT security.

    Photo of Ida Siahaan, Research Director, Security and Privacy Practice, Info-Tech Research Group. Ida Siahaan
    Research Director, Security and Privacy Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    IT and OT are both very different complex systems. However, significant benefits have driven OT to converge with IT. This results in IT security leaders, OT leaders, and their teams facing challenges with:

    • Governing and managing IT and OT security and accountabilities.
    • Converging security architecture and controls between IT and OT environments.
    • Compliance with regulations and standards.
    • Metrics for OT security effectiveness and efficiency.
    Common Obstacles
    • IT/OT network segmentation and remote access issues, as most OT incidents indicate that the attackers gained access through the IT network, followed by infiltration into OT networks.
    • OT proprietary devices and unsecure protocols use outdated systems which may be insecure by design.
    • Different requirements of OT and IT security – i.e. IT (confidentiality, integrity, and availability) vs. OT (safety, reliability, and availability).
    Info-Tech’s Approach

    Info-Tech’s approach in preparing for IT/OT convergence (i.e. the Plan phase) is coordination and collaboration of IT and OT to:

    • Initiate communication to define roles and responsibilities.
    • Establish governance and build a cross-functional team.
    • Identify convergence components and compliance obligations.
    • Assess readiness.

    Info-Tech Insight

    Returning to isolated OT is not beneficial for the organization, so IT and OT need to learn to collaborate, starting with communication to build trust and to overcome their differences. Next, negotiation is needed on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.

    Consequences of unsecure IT/OT convergence

    OT systems were built with no or little security design

    90% of organizations that use OT experienced a security incident. (Fortinet, 2021. Ponemon, 2019.)

    Bar graph comparing three years, 2019-2021, of four different OT security incidents: 'Ransomeware', 'Insider breaches', 'Phishing', and 'Malware'.
    (Source: Fortinet, 2021.)
    Lack of visibility

    86% of OT security-related service engagements lack complete visibility of OT network in 2021 (90% in 2020, 81% in 2019). (Source: “Cybersecurity Year In Review” Dragos, 2022.)

    The need for secure IT/OT convergence

    Important Industrial Control System (ICS) cyber incidents

    2000
    Target: Australian sewage plant. Method: Insider attack. Impact: 265,000 gallons of untreated sewage released.
    2012
    Target: Middle East energy companies. Method: Shamoon. Impact: Overwritten Windows-based systems files.
    2014
    Target: German Steel Mill. Method: Spear-phishing. Impact: Blast furnace failed to shut down.
    2017
    Target: Middle East safety instrumented system (SIS). Method: TRISIS/TRITON. Impact: Modified SIS ladder logic.
    2022
    Target: Viasat’s KA-SAT network. Method: AcidRain. Impact: Significant loss of communication for the Ukrainian military, which relied on Viasat’s services.
    Timeline of Important Industrial Control System (ICS) cyber incidents.
    1903
    Target: Marconi wireless telegraph presentation. Method: Morse code. Impact: Fake message sent “Rats, rats, rats, rats. There was a young fellow of Italy, Who diddled the public quite prettily.”
    2010
    Target: Iranian uranium enrichment plant. Method: Stuxnet. Impact: Compromised programmable logic controllers (PLCs).
    2013
    Target: ICS supply chain. Method: Havex. Impact: Remote Access Trojan (RAT) collected information and uploaded data to command-and-control (C&C) servers
    2016
    Target: Ukrainian power grid. Method: BlackEnergy. Impact: For 1-6 hours, power outages for 230,000 consumers.
    2021
    Target: Colonial Pipeline. Method: DarkSide ransomware. Impact: Compromised billing infrastructure halted the pipeline operation.

    (Source: US Department of Energy, 2018.


    ”Significant Cyber Incidents,” CSIS, 2022


    MIT Technology Review, 2022.)

    Info-Tech Insight

    Most OT incidents start with attacks against IT networks and then move laterally into the OT environment. Therefore, converging IT and OT security will help protect the entire organization.

    Case Study

    Horizon Power
    Logo for Horizon Power.
    INDUSTRY
    Utilities
    SOURCE
    Interview

    Horizon Power is the regional power provider in Western Australia and stands out as a leader not only in the innovative delivery of sustainable power, but also in digital transformation. Horizon Power is quite mature in distributed energy resource management; moving away from centralized generation to decentralized, community-led generation, which reflects in its maturity in converging IT and OT.

    Horizon Power’s IT/OT convergence journey started over six years ago when advanced metering infrastructure (AMI) was installed across its entire service area – an area covering more than one quarter of the Australian continent.

    In these early days of the journey, the focus was on leveraging matured IT approaches such as adoption of cloud services to the OT environment, rather than converging the two. Many years later, Horizon Power has enabled OT data to be more accessible to derive business benefits such as customer usage data using data analytics with the objective of improving the collection and management of the OT data to improve business performance and decision making.

    The IT/OT convergence meets legislation such as the Australian Energy Sector Cyber Security Framework (AESCSF), which has impacts on the architectural layer of cybersecurity that support delivery of the site services.

    Results

    The lessons learned in converging IT and OT from Horizon Power were:

    • Start with forming relationships to build trust and overcome any divide between IT and OT.
    • Collaborate with IT and OT teams to successfully implement solutions, such as vulnerability management and discovery tools for OT assets.
    • Switch the focus from confidentiality and integrity to availability in solutions evaluation
    • Develop training and awareness programs for all levels of the organization.
    • Actively encourage visible sponsorship across management by providing regular updates and consistent messaging.
    • Monitor cybersecurity metrics such as vulnerabilities, mean time to treat vulnerabilities, and intrusion attempts.
    • Manage third-party vendors using a platform which not only performs external monitoring but provides third-party vendors with visibility or potential threats in their organization.

    The Secure IT/OT Convergence Framework

    IT/OT convergence is less of a convergence and more of a migration. The previously entirely separate OT ecosystem is migrating onto the IT ecosystem, to improve access via the internet and to leverage other standard IT capabilities. However, IT and OT are historically very different, and without careful calculation, simply connecting the two systems will result in a problem. Therefore, IT and OT need to learn to live together starting with communication to build trust and to overcome differences between IT and OT.
    Convergence Elements
    • Process convergence
    • Software and data convergence
    • Network and infrastructure convergence
    Target Groups
    • OT leader and teams
    • IT leader and teams
    • Security leader and teams
    Security Components
    • Governance and compliance
    • Security strategy
    • Risk management
    • Security policies
    • IR, DR, BCP
    • Security awareness and training
    • Security architecture and controls

    Plan

    • Initiate communication
    • Define roles and responsibilities
    • Establish governance and build a cross-functional team
    • Identify convergence elements and compliance obligations
    • Assess readiness

    Governance

    Compliance

    Enhance

    • Update security strategy for IT/OT convergence
    • Update risk-management framework for IT/OT convergence
    • Update security policies and procedures for IT/OT convergence
    • Update incident response, disaster recovery, and business continuity plan for IT/OT convergence

    Security strategy

    Risk management

    Security policies and procedures

    IR, DR, and BCP

    Monitor &
    Optimize

    • Implement awareness, induction, and cross-training program
    • Design and deploy converging security architecture and controls
    • Establish and monitor IT/OT security metrics on effectiveness and efficiency
    • Red-team followed by blue-team activity for cross-functional team building

    Awareness and cross-training

    Architecture and controls

    Phases
    Color-coded phases with arrows looping back up from the bottom to top phase.
    • Plan
    • Enhance
    • Monitor & Optimize
    Plan Outcomes
    • Mapping business goals to IT/OT security goals
    • RACI chart for priorities and accountabilities
    • Compliance obligations register
    • Readiness checklist
    Enhance Outcomes
    • Security strategy for IT/OT convergence
    • Risk management framework
    • Security policies & procedures
    • IR, DR, BCP
    Monitor & Optimize Outcomes
    • Security awareness and training
    • Security architecture and controls
    Plan Benefits
    • Improved flexibility and less divided IT/OT
    • Improved compliance
    Enhance Benefits
    • Increased strategic common goals
    • Increased efficiency and versatility
    Monitor & Optimize Benefits
    • Enhanced security
    • Reduced costs

    Plan

    Initiate communication

    To initiate communication between the IT and OT teams, it is important to understand how the two groups are different and to build trust to find a holistic approach which overcomes those differences.
    IT OT
    Remote Access Well-defined access control Usually single-level access control
    Interfaces Human Machine, equipment
    Software ERP, CRM, HRIS, payroll SCADA, DCS
    Hardware Servers, switches, PCs PLC, HMI, sensors, motors
    Networks Ethernet Fieldbus
    Focus Reporting, communication Up-time, precision, safety
    Change management Frequent updates and patches Infrequent updates and patches
    Security Confidentiality, integrity, availability Safety, reliability, availability
    Time requirement Normally not time critical Real time

    Info-Tech Insight

    OT interfaces with the physical world while IT system concerns more on cyber world. Thus, the two systems have different properties. The challenge is how to create strategic collaboration between IT and OT based on negotiation, and this needs top-down support.

    Identifying organization goals is the first step in aligning your secure IT/OT convergence with your organization’s vision.

    • Security leaders need to understand the direction the organization is headed in.
    • Wise security investments depend on aligning your security initiatives to the organization.
    • Secure IT/OT convergence should contribute to your organization’s objectives by supporting operational performance and ensuring brand protection and shareholder value.

    Map organizational goals to IT/OT security goals

    Input: Corporate, IT, and OT strategies

    Output: Your goals for the security strategy

    Materials: Secure IT/OT Convergence Requirements Gathering Tool

    Participants: Executive leadership, OT leader, IT leader, Security leader, Compliance, Legal, Risk management

    1. As a group, brainstorm organization goals.
      1. Review relevant corporate, IT, and OT strategies.
    2. Record the most important business goals in the Secure IT/OT Convergence Requirements Gathering Tool. Try to limit the number of business goals to no more than 10 goals. This limitation will be critical to helping focus on your secure IT/OT convergence.
    3. For each goal, identify one to two security alignment goals. These should be objectives for the security strategy that will support the identified organization goals.

    Download the Secure IT/OT Convergence Requirements Gathering Tool

    Record organizational goals

    Sample of the definitions table with columns numbered 1-4.

    Refer to the Secure IT/OT Convergence Framework when filling in the following elements.

    1. Record your identified organization goals in the Goals Cascade tab of the Secure IT/OT Convergence Requirements Gathering Tool.
    2. For each of your organizational goals, identify IT alignment goals.
    3. For each of your organizational goals, identify OT alignment goals.
    4. For each of your organizational goals, select one to two IT/OT security alignment goals from the drop-down lists.

    Establish scope and boundaries

    It is important to know at the outset of the strategy: What are we trying to secure in IT/OT convergence ?
    This includes physical areas we are responsible for, types of data we care about, and departments or IT/OT systems we are responsible for.

    This also includes what is not in scope. For some outsourced services or locations, you may not be responsible for their security. In some business departments, you may not have control of security processes. Ensure that it is made explicit at the outset what will be included and what will be excluded from security considerations.

    Physical Scope and Boundaries

    • How many offices and locations does your organization have?
    • Which locations/offices will be covered by your information security management system (ISMS)?
    • How sensitive is the data residing at each location?
    • You may have many physical locations, and it is not necessary to list each one. Rather, list exceptional cases that are specifically in or out of scope.

    IT Systems Scope and Boundaries

    • There may be hundreds of applications that are run and maintained in your organization. Some of these may be legacy applications. Do you need to secure all your programs or only a select few?
    • Is the system owned or outsourced?
    • Where are you accountable for security?
    • How sensitive is the data that each system handles?

    Organizational Scope and Boundaries

    • Will your ISMS cover all departments within your organization? For example, do certain departments (e.g. operations) not need any security coverage?
    • Do you have the ability to make security decisions for each department?
    • Who are the key stakeholders/data owners for each department?

    OT Systems Scope and Boundaries

    • There may be hundreds of OT systems that are run and maintained in your organization. Do you need to secure all OT or a select subset?
    • Is the system owned or outsourced?
    • Where are you accountable for safety and security?
    • What reliability requirements does each system handle?

    Record scope and boundaries

    Sample Scope and Boundaries table. Refer to the Secure IT/OT Convergence Framework when filling in the following elements:
    • Record your security-related organizational scope, physical location scope, IT systems scope, and OT systems scope in the Scope tab of the Secure IT/OT Convergence Requirements Gathering Tool.
    • For each item scoped, give the rationale for including it in the comments column. Careful attention should be paid to any elements that are not in scope.

    Plan

    Define roles and responsibilities

    Input: List of relevant stakeholders

    Output: Roles and responsibilities for the secure IT/OT convergence program

    Materials: Secure IT/OT Convergence RACI Chart Tool

    Participants: Executive leadership, OT leader, IT leader, Security leader

    There are many factors that impact an organization’s level of effectiveness as it relates to IT/OT convergence. How the two groups interact, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, it is imperative in the planning phase to identify stakeholders who are:

    • Responsible: The people who do the work to accomplish the activity; they have been tasked with completing the activity and/or getting a decision made.
    • Accountable: The person who is accountable for the completion of the activity. Ideally, this is a single person and will often be an executive or program sponsor.
    • Consulted: The people who provide information. This is usually several people, typically called subject matter experts (SMEs).
    • Informed: The people who are updated on progress. These are resources that are affected by the outcome of the activities and need to be kept up to date.

    Download the Secure IT/OT Convergence RACI Chart Tool

    Define RACI Chart

    Sample RACI chart with only the 'Plan' section enlarged.

    Define responsible, accountable, consulted, and informed (RACI) stakeholders.
    1. Customize the "work units" to best reflect your operation with applicable stakeholders.
    2. Customize the "action“ rows as required.
    Info-Tech Insight

    The roles and responsibilities should be clearly defined. For example, IT network should be responsible for the communication and configuration of all access points and devices from the remote client to the control system DMZ, and controls engineering should be responsible from the control system DMZ to the control system.

    Plan

    Establish governance and build cross-functional team

    To establish governance and build an IT/OT cross-functional team, it is important to understand the operation of OT systems and their interactions with IT within the organization, e.g. ad hoc, centralized, decentralized.

    The maturity ladder with levels 'Fully Converged', 'Collaborative Partners', 'Trusted Resources', 'Affiliated Entities', and 'Siloed' at the bottom. Each level has four maturity indicators listed.

    Info-Tech Insight

    To determine IT/OT convergence maturity level, Info-Tech provides the IT/OT Convergence Self-Evaluation Tool.

    Centralized security governance model example

    Example of a centralized security governance model.

    Plan

    Identify convergence elements and compliance obligations

    To switch the focus from confidentiality and integrity to safety and availability for OT system, it is important to have a common language such as the Purdue model for technical communication.
    • A lot of OT compliance standards are technically focused and do not address governance and management, e.g. IT standards like the NIST Cybersecurity Framework. For example, OT system modeling with Purdue model will help IT teams to understand assets, networking, and controls. This understanding is needed to know the possible security solutions and where these solutions could be embedded to the OT system with respect to safety, reliability, and availability.
    • However, deployment of technical solutions or patches to OT system may nullify warranty, so arrangements should be made to manage this with the vendor or manufacturer prior to modification.
    • Finally, OT modernizations such as smart grid together with the advent of IIoT where data flow is becoming less hierarchical have encouraged the birth of a hybrid Purdue model, which maintains segmentation with flexibility for communications.

    Level 5: Enterprise Network

    Level 4: Site Business

    Level 3.5: DMZ
    Example: Patch Management Server, Application Server, Remote Access Server

    Level 3: Site Operations
    Example: SCADA Server, Engineering Workstation, Historian

    Level 2: Area Supervisory Control
    Example: SCADA Client, HMI

    Level 1: Basic Control
    Example: Batch Controls, Discrete Controls, Continuous Process Controls, Safety Controls, e.g. PLCs, RTUs

    Level 0: Process
    Example: Sensors, Actuators, Field Devices

    (Source: “Purdue Enterprise Reference Architecture (PERA) Model,” ISA-99.)

    Identify compliance obligations

    To manage compliance obligations, it is important to use a platform which not only performs internal and external monitoring, but also provides third-party vendors with visibility on potential threats in their organization.
    Example table of compliance obligations standards. Example tables of compliance obligations regulations and guidelines.

    Source:
    ENISA, 2013
    DHS, 2009.

    • OT system has compliance obligations with industry regulations and security standards/regulations/guidelines. See the lists given. The lists are not exhaustive.
    • OT system owner can use the standards/regulations/guidelines as a benchmark to determine and manage the security level provided by third parties.
    • It is important to understand the various frameworks and to adhere to the appropriate compliance obligations, e.g. IEC/ISA 62443 - Security for Industrial Automation and Control Systems Series.

    IEC/ISA 62443 - Security for Industrial Automation and Control Systems Series

    International series of standards for asset owners, system integrators, and product manufacturers.
    Diagram of the international series of standards for asset owners.
    (Source: Cooksley, 2021)
    • IEC/ISA 62443 is a comprehensive international series of standards covering security for ICS systems, which recognizes three roles, namely: asset owner, system integrator, and product manufacturer.
    • In IEC/ISA 62443, requirements flow from the asset owner to the product manufacturer, while solutions flow in the opposite direction.
    • For the asset owner who owns and operates a system, IEC 62443-2 enables defining target security level with reference to a threat level and using the standard as a benchmark to determine the current security level.
    • For the system integrator, IEC 62443-3 assists to evaluate the asset owner’s requirements to create a system design. IEC 62443-3 also provides a method for verification that components provided by the product manufacturer are securely developed and support the functionality required.

    Record your compliance obligations

    Refer to the “Goals Cascade” tab of the Secure IT/OT Convergence Requirements Gathering Tool.
    1. Identify your compliance obligations. Most organizations have compliance obligations that must be adhered to. These can include both mandatory and voluntary obligations. Mandatory obligations include:
      1. Laws
      2. Government regulations
      3. Industry standards
      4. Contractual agreements
      Voluntary obligations include standards that the organization has chosen to follow for best practices and any obligations that are required to maintain certifications. Organizations will have many different compliance obligations. For the purposes of your secure IT/OT convergence, include only those that have OT security requirements.
    2. Record your compliance obligations, along with any notes, in your copy of the Secure IT/OT Convergence Requirements Gathering Tool.
    3. Refer to the “Compliance DB” tab for lists of standards/regulations/guidelines.
    Table of mandatory and voluntary security compliance obligations.

    Plan

    Assess readiness

    Readiness checklist for secure IT/OT convergence

    People

    • Define roles and responsibilities on interaction based on skill sets and the degree of support and alignment.
    • Adopt well-established security governance practices for cross-functional teams.
    • Analyze and develop skills required by implementing awareness, induction, and cross-training program.

    Process

    • Conduct a maturity assessment of key processes and highlight interdependencies.
    • Redesign cybersecurity processes for your secure IT/OT convergence program.
    • Develop a baseline and periodically review on risks, security policies and procedures, incident response, disaster recovery, and business continuity plan.

    Technology

    • Conduct a maturity assessment and identify convergence elements and compliance obligations.
    • Develop a roadmap and deploy converging security architecture and controls step by step, working with trusted technology partners.
    • Monitor security metrics on effectiveness and efficiency and conduct continuous testing by red-team and blue-team activities.

    (Source: “Grid Modernization: Optimize Opportunities And Minimize Risks,” Info-Tech)

    Enhance

    Update security strategy

    To update security strategy, it is important to actively encourage visible sponsorship across management and to provide regular updates.

    Cycle for updating security strategy: 'Architecture design', 'Procurement', 'Installation', 'Maintenance', 'Decommissioning'.
    (Source: NIST SP 800-82 Rev.3, “Guide to Operational Technology (OT) Security,” NIST, 2022.)
    • OT system life cycle is like the IT system life cycle, starting with architectural design and ending with decommissioning.
    • Currently, IT only gets involved from installation or maintenance, so they may not fully understand the OT system. Therefore, if OT security is compromised, the same personnel who commissioned the OT system (e.g. engineering, electrical, and maintenance specialists) must be involved. Thus, it is important to have the IT team collaborate with the OT team in each stage of the OT system’s life cycle.
    • Finally, it is necessary to have propositional sharing of responsibilities between IT leaders, security leaders, and OT leaders who have broader responsibilities.

    Enhance

    Update risk management framework

    The need for asset and threat taxonomy

    • One of issues in IT/OT convergence is that OT systems focus on production, so IT solutions like security patching or updates may deteriorate a machine or take a machine offline and may not be applicable. For example, some facilities run with reliability of 99.999%, which only allows maximum of 5 minutes and 35 seconds or less of downtime per year.
    • Managing risks requires an understanding of the assets and threats for IT/OT systems. Having a taxonomy of the assets and the threats cand help.
    • Applying normal IT solutions to mitigate security risks may not be applicable in an OT environment, e.g. running an antivirus tool on OT system may remove essential OT operations files. Thus, this approach must be avoided; instead, systems must be rebuilt from golden images.
    Risk management framework.
    (Source: ENISA, 2018.)

    Enhance

    Update security policies and procedures

    • Policy is the link between people, process, and technology for any size of organization. Small organizations may think that having formal policies in place is not necessary for their operations, but compliance is applicable to all organizations, and vulnerabilities affect organizations of all sizes as well. Small organizations partnering with clients or other organizations are sometimes viewed as ideal proxies for attackers.
    • Updating security policies to align with the OT system so that there is a uniform approach to securing both IT and OT environments has several benefits. For example, enhancing the overall security posture as issues are pre-emptively avoided, being better prepared for auditing and compliance requirements, and improving governance especially when OT governance is weak.
    • In updating security policies, it is important to redefine the policy framework to include the OT framework and to prioritize the development of security policies. For example, entities that own or manage US and Canadian electric power grids must comply with North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards, specifically CIP-003 for Policy and Governance. This can be achieved by understanding the current state of policies and by right-sizing the policy suite based on a policy hierarchy.
    The White House released an Executive Order on Improving the Nation’s Cybersecurity (EO 14028) in 2021 that establishes new requirements on the scope of protection and security policy such that it must include both IT and OT.

    Policy hierarchy example

    This example of a policy hierarchy features templates from Info-Tech’s Develop and Deploy Security Policies and Identify the Best Framework for Your Security Policies research.

    Example policy hierarchy with four levels, from top-down: 'Governance', 'Process-based policies', 'Prescriptive/ technical (for IT including OT elements)', 'Prescriptive/ technical (for users)'.

    Enhance

    Update IR, DR, and BCP

    A proactive approach to security is important, so actions such as updating and testing the incident response plan for OT are a must. (“Cybersecurity Year In Review” Dragos, 2022.)

    1. Customize organizational chart for IT/OT IR, DR, BCP based on governance and management model.
      E.g. ad hoc, internal distributed, internal centralized, combined distributed, and decentralized. (Software Engineering Institute, 2003)
    2. Adjust the authority of the new organizational chart and decide if it requires additional staffing.
      E.g. full authority, shared authority. (Software Engineering Institute, 2003)
    3. Update IR plan, DR plan, and BCP for IT/OT convergence.
      E.g. incorporate zero trust principles for converge network
    4. Testing updated IR plan, DR plan, and BCP.

    Optimize

    Implement awareness, induction, and cross-training

    To develop training and awareness programs for all levels of the organization, it is important to understand the common challenges in IT security that also affect secure IT/OT convergence and how to overcome those challenges.

    Alert Fatigue

    Too many false alarms, too many events to process, and an evolving threat landscape that wastes analysts’ valuable time on mundane tasks such as evidence collection. Meanwhile, only limited time is given for decision and conclusion, which results in fear of missing an incident and alert fatigue.

    Skill Shortages

    Obtaining and retaining cybersecurity-skilled talent is challenging. Organizations need to invest in the people, but not all organizations will be able to invest sufficiently to have their own dedicated security team.

    Lack of Insight

    To report progress, clear metrics are needed. However, cybersecurity still falls short in this area, as the system itself is complex, and much work is siloed. Furthermore, lessons learned are not yet distilled into insights yet for improving future accuracy.

    Lack of Visibility

    Ensuring complete visibility of the threat landscape, risks, and assets requires system integration and consistent workflow across the organization, and the convergence of OT, IoT, and IT enhances this challenge (e.g. machines cannot be scanned during operational uptime).
    (Source: Security Intelligence, 2020.)
    “Cybersecurity staff are feeling burnout and stressed to the extent that many are considering leaving their jobs.” (Danny Palmer, ZDNET News, 2022)

    Awareness may not correspond to readiness

    • An issue with IT/OT convergence training and awareness happens when awareness exists, but the personnel are trained only for IT security and are not trained for OT-specific security. For example, some organizations still use generic topics such as not opening email attachments, when the personnel do not even operate using email nor in a web browsing environment. (“Assessing Operational Readiness,” Dragos, 2022)
    • Meanwhile, as is the case with IT, OT security training topics are broad, such as OT threat intelligence, OT-specific incident response, and tabletop exercises.
    • Hence, it requires the creation of a training program development plan that considers the various audiences and topics and maps them accordingly.
    • Moreover, roles are also evolving due to convergence and modernization. These new roles require an integrative skill set. For example, the grid security & ops team might consist of an IT security specialist, SCADA technician/engineer, and OT/IIOT security specialist where OT/IIOT security specialist is a new role. (Grid Modernization: Optimize Opportunities and Minimize Risks,” Info-Tech)
    • In conclusion, it is important to approach talent development with an open mind. The ability to learn and flexibility in the face of change are important attributes, and technical skill sets can be improved with certifications and training.
    “One area regularly observed by Dragos is a weakness in overall cyber readiness and training tailored specific to the OT environment.” (“Assessing Operational Technology,” Dragos, 2022.)

    Certifications

    What are the options?
    • One of issues in certification is the complexity on relevancy in topics with respect to roles and levels.
    • An example solution is the European Union Agency for Cybersecurity (ENISA)’s approach to analyzing existing certifications by orientation, scope, and supporting bodies, grouped into specific certifications, relevant certifications, and safety certifications.

    Specific cybersecurity certification of ICS/SCADA
    Example: ISA-99/IEC 62443 Cybersecurity Certificate Program, GIAC Global Industrial Cyber Security Professional (GICSP), Certified SCADA Security Architect (CSSA), EC-Council ICS/SCADA Cybersecurity Training Course.

    Other relevant certification schemes
    Example: Network and Information Security (NIS) Driving License, ISA Certified Automation Professional (CAP), Industrial Security Professional Certification (NCMS-ISP).

    Safety Certifications
    Example: Board of Certified Safety Professionals (BCSP), European Network of Safety and Health Professional Organisations (ENSHPO).

    Order of certifications with 'Orientation' at the top, 'Scope', then 'Support'.(Source: ENISA, 2015.)

    Optimize

    Design and deploy converging security architecture and controls

    • IT/OT convergence architecture can be modeled as a layered structure based on security. In this structure, the bottom layer is referred as “OT High-Security Zone” and the topmost layer is “IT Low-Security Zone.” In this model, each layer has its own set of controls configured and acts like an additional layer of security for the zone underneath it.
    • The data flows from the “OT High-Security Zone” to the topmost layer, the “IT Low-Security Zone,” and the traffic must be verified to pass to another zone based on the need-to-know principle.
    • In the normal control flow within the “OT High-Security Zone” from level 3 to level 0, the traffic must be verified to pass to another level based on the principle of least privilege.
    • Remote access (dotted arrow) is allowed under strict access control and change control based on the zero-trust principle with clear segmentation and a point for disconnection between the “OT High-Security Zone” and the “OT Low-Security Zone”
    • This model simplifies the security process, as if the lower layers have been compromised, then the compromise can be confined on that layer, and it also prevents lateral movement as access is always verified.
    Diagram for the deployments of converging security architecture.(Source: “Purdue Enterprise Reference Architecture (PERA) model,” ISA-99.)

    Off-the-shelf solutions

    Getting the right recipe: What criteria to consider?

    Image of a shopping cart with the four headlines on the right listed in order from top to bottom.
    Icon of an eye crossed out. Visibility and Asset Management

    Passive data monitoring using various protocol layers, active queries to devices, or parsing configuration files of OT, IoT, and IT environments on assets, processes, and connectivity paths.

    Icon of gears. Threat Detection, Mitigation, and Response (+ Hunting)

    Automation of threat analysis (signature-based, specification-based, anomaly-based, sandboxing) not only in IT but also in relevant environments, e.g. IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.

    Icon of a check and pen. Risk Assessment and Vulnerability Management

    Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.

    Icon of a wallet. Usability, Architecture, Cost

    The user and administrative experience, multiple deployment options and extensive integration capabilities, and affordability.

    Optimize

    Establish and monitor IT/OT security metrics for effectiveness and efficiency

    Role of security metrics in a cybersecurity program (EPRI, 2017.)
    • Requirements for secure IT/OT are derived from mandatory or voluntary compliance, e.g. NERC CIP, NIST SP 800-53.
    • Frameworks for secure IT/OT are used to build and implement security, e.g. NIST CSF, AESCSF.
    • Maturity of secure IT/OT is used to measure the state of security, e.g. C2M2, CMMC.
    • Security metrics have the role of measuring effectiveness and efficiency.

    Icon of a person ascending stairs.
    Safety

    OT interfaces with the physical world. Thus, metrics based on risks related with life, health, and safety are crucial. These metrics motivate personnel by making clear why they should care about security. (EPRI, 2017.)

    Icon of a person ascending stairs.
    Business Performance

    The impact of security on the business can be measured in various metrics such as operational metrics, service level agreements (SLAs), and financial metrics. (BMC, 2022.)

    Icon of a person ascending stairs.
    Technology Performance

    Early detection will lead to faster remediation and less damage. Therefore, metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability. (Dark Reading, 2022)

    Icon of a person ascending stairs.
    Security Culture

    The metrics for the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.

    Further information

    Related Info-Tech Research

    Sample of 'Build an Information Security Strategy'.

    Build an Information Security Strategy

    Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.

    This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.

    Sample of 'Preparing for Technology Convergence in Manufacturing'.

    Preparing for Technology Convergence in Manufacturing

    Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.

    Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.

    Sample of 'Implement a Security Governance and Management Program'.

    Implement a Security Governance and Management Program

    Your security governance and management program needs to be aligned with business goals to be effective.

    This approach also helps provide a starting point to develop a realistic governance and management program.

    This project will guide you through the process of implementing and monitoring a security governance and management program that prioritizes security while keeping costs to a minimum.

    Bibliography

    Assante, Michael J. and Robert M. Lee. “The Industrial Control System Cyber Kill Chain.” SANS Institute, 2015.

    “Certification of Cyber Security Skills of ICS/SCADA Professionals.” European Union Agency for Cybersecurity (ENISA), 2015. Web.

    Cooksley, Mark. “The IEC 62443 Series of Standards: A Product Manufacturer‘s Perspective.” YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.

    “Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.

    “Cybersecurity and Physical Security Convergence.” Cybersecurity and Infrastructure Security Agency (CISA). Accessed 19 May 2022.

    “Cybersecurity in Operational Technology: 7 Insights You Need to Know,” Ponemon, 2019. Web.

    “Developing an Operational Technology and Information Technology Incident Response Plan.” Public Safety Canada, 2020. Accessed 6 Sep. 2022.

    Gilsinn, Jim. “Assessing Operational Technology (OT) Cybersecurity Maturity.” Dragos, 2021. Accessed 02 Sep. 2022.

    “Good Practices for Security of Internet of Things.” European Union Agency for Cybersecurity (ENISA), 2018. Web.

    Greenfield, David. “Is the Purdue Model Still Relevant?” AutomationWorld. Accessed 1 Sep. 2022

    Hemsley, Kevin E., and Dr. Robert E. Fisher. “History of Industrial Control System Cyber Incidents.” US Department of Energy (DOE), 2018. Accessed 29 Aug. 2022.

    “ICS Security Related Working Groups, Standards and Initiatives.” European Union Agency for Cybersecurity (ENISA), 2013.

    Killcrece, Georgia, et al. “Organizational Models for Computer Security Incident Response Teams (CSIRTs).” Software Engineering Institute, CMU, 2003.

    Liebig, Edward. “Security Culture: An OT Survival Story.” Dark Reading, 30 Aug. 2022. Accessed 29 Aug. 2022.

    Bibliography

    O'Neill, Patrick. “Russia Hacked an American Satellite Company One Hour Before the Ukraine Invasion.” MIT Technology Review, 10 May 2022. Accessed 26 Aug. 2022.

    Palmer, Danny. “Your Cybersecurity Staff Are Burned Out – And Many Have Thought About Quitting.” Zdnet, 08 Aug. 2022. Accessed 19 Aug. 2022.

    Pathak, Parag. “What Is Threat Management? Common Challenges and Best Practices.” SecurityIntelligence, 23 Jan. 2020. Web.

    Raza, Muhammad. “Introduction To IT Metrics & KPIs.” BMC, 5 May 2022. Accessed 12 Sep. 2022.

    “Recommended Practice: Developing an Industrial Control Systems Cybersecurity Incident Response Capability.” Department of Homeland Security (DHS), Oct. 2009. Web.

    Sharma, Ax. “Sigma Rules Explained: When and How to Use Them to Log Events.” CSO Online, 16 Jun. 2018. Accessed 15 Aug. 2022.

    “Significant Cyber Incidents.” Center for Strategic and International Studies (CSIS). Accessed 1 Sep. 2022.

    Tom, Steven, et al. “Recommended Practice for Patch Management of Control Systems.” Department of Homeland Security (DHS), 2008. Web.

    “2021 ICS/OT Cybersecurity Year In Review.” Dragos, 2022. Accessed 6 Sep. 2022.

    “2021 State of Operational Technology and Cybersecurity Report,” Fortinet, 2021. Web.

    Zetter, Kim. “Pre-Stuxnet, Post-Stuxnet: Everything Has Changed, Nothing Has Changed.” Black Hat USA, 08 Aug. 2022. Accessed 19 Aug. 2022.

    Research Contributors and Experts

    Photo of Jeff Campbell, Manager, Technology Shared Services, Horizon Power, AU. Jeff Campbell
    Manager, Technology Shared Services
    Horizon Power, AU

    Jeff Campbell has more than 20 years' experience in information security, having worked in both private and government organizations in education, finance, and utilities sectors.

    Having focused on developing and implementing information security programs and controls, Jeff is tasked with enabling Horizon Power to capitalize on IoT opportunities while maintaining the core security basics of confidentiality, integrity and availability.

    As Horizon Power leads the energy transition and moves to become a digital utility, Jeff ensures the security architecture that supports these services provides safer and more reliable automation infrastructures.

    Christopher Harrington
    Chief Technology Officer (CTO)
    Carolinas Telco Federal Credit Union

    Frank DePaola
    Vice President, Chief Information Security Officer (CISO)
    Enpro

    Kwasi Boakye-Boateng
    Cybersecurity Researcher
    Canadian Institute for Cybersecurity

    Decide What's Important and What Is Less So

    • Large vertical image:
    • member rating overall impact: Highly Rated
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    Redefining the business impact analysis through the lens of value

    The Business Impact Analysis (BIA) is easily one of the most misunderstood processes in the modern enterprise. For many, the term conjures images of dusty binders filled with disaster recovery plans. A compliance checkbox exercise focused solely on what to do when the servers are smoking or the building is flooded. This view, while not entirely incorrect, is dangerously incomplete. It relegates the BIA to a reactive, insurance-policy mindset when it should be a proactive, strategic intelligence tool.

    Yes, I got that text from AI. So recognizable. But you know what? There is a kernel of truth in this.

    A modern BIA is about understanding and protecting value more than just about planning for disaster. That is the one thing we must keep in mind at all times. The BIA really is a deep dive into the DNA of the organization. It maps the connections between information assets, operational processes, and business outcomes. It answers the critical question, “What matters? And why ? And what is the escalating cost of its absence?”

    The Strategic Starting Point: A Top-Down Business Analysis

    To answer “what matters,” the process must begin at the highest level: with senior management and, ideally, the board. Defining the organization's core mission and priorities is a foundational governance task, a principle now embedded in European regulations like DORA.

    Rank the Business Units

    The process begins at the highest level with senior management. I would say, the board. They need to decide what the business is all about. (This is in line with the DORA rules in Europe.) The core business units or departments of the organization are ranked based on their contribution to the company's mission. This ranking is frequently based on revenue generation, but it can also factor in strategic importance, market position, or essential support functions. For example, the “Production” and “Sales” units might be ranked higher than “Internal HR Administration.” This initial ranking provides the foundational context for all subsequent decisions.

    I want to make something crystal clear: this ranking is merely a practical assessment. Obviously the HR and well being departments play a pivotal role in the value delivery of the company. Happy employees make for happy customers.  

    But, being a bit Wall-Streety about it, the sales department generating the biggest returns is probably only surpassed by the business unit producing the product for those sales. And with that I just said that the person holding the wrench, who knows your critical production machine, is your most valuable HR asset. Just saying.

    Identify Critical Functions Within Each Unit

    With the business units prioritized, the next step is to drill down into each one and identify its critical operational functions. The focus here is on processes, not technology. For the top-ranked “Sales” unit, critical functions might include:

    • SF-01: Processing New Customer Orders

    • SF-02: Managing the Customer Relationship Management (CRM) System

    • SF-03: Generating Sales Quotes

    • SF-04: Closing the Sale

    These functions are then rated against each other within the business unit to create a prioritized list of what truly matters for that unit to achieve its goals.

    And here I'm going to give you some food for thought. There will be a superficial geographical difference in importance. If you value continuity then new business may not be the top critical department. I can imagine this is completely counter intuitive. But remember that it is cheaper to keep and upsell an existing client than it is to acquire a new one.

    Information asset classification is a key component of resilience.

    With a clear map of what the business does, the next logical step is to identify what it uses to get it done. This brings us to the non-negotiable foundation of resilience: comprehensive information asset classification.

    Without knowing what you have, where it is, and what it's worth, any attempt at risk management is simply guesswork. You risk spending millions protecting low/mid-value data while leaving the crown jewels exposed (I guess your Ciso will have said something 😊). In this article, we will explore how foundational asset classification can evolve into a mature, value-driven impact analysis, offering a blueprint for transforming the BIA from a tactical chore into a strategic imperative.

    Before you can determine the effect of losing an asset, you must first understand the asset itself. Information asset classification is the systematic process of inventorying, categorizing, and assigning business value to your organization's data. Now that we have terabyte-scale data on servers, cloud environments, and countless SaaS applications, you have your work cut out for you. It is, however, a most critical investment in the risk management lifecycle.

    Classification forces an organization to look beyond the raw data and evaluate it through two primary lenses: criticality and sensitivity.

    • Criticality is a measure of importance. It answers the question: “How much damage would the business suffer if this asset were unavailable or corrupted?” This is directly tied to the operational functions that depend on the asset. The criticality of a customer database, for instance, is determined by the impact on the sales, marketing, and support functions that would grind to a halt without it. This translates to the availability rating. 

    • Sensitivity is a measure of secrecy. It answers the question: “What is the potential harm if this asset were disclosed to unauthorized parties?” This considers reputational damage, competitive disadvantage, legal penalties, and customer privacy violations. This translates to the confidentiality rating.

    Without this dual understanding, it's impossible to implement a proportional and cost-effective security program. The alternative is a one-size-fits-all approach, which invariably leads to one of two expensive failures:

    1. Overprotection: Applying the highest level of security controls to all information is prohibitively expensive and creates unnecessary operational friction. It's like putting a bank vault door on a broom closet.

    2. Underprotection: Applying a baseline level of security to all assets leaves your most critical and sensitive information dangerously vulnerable. It exposes your organization to unacceptable risk. Remember assigning an A2 rating to all your infra because it cannot be related to specific business processes? The “we'll take care of it at the higher levels” approach leads to exactly this issue.

    By understanding the criticality and sensitivity of assets, organizations can ensure that security efforts are directly tied to business objectives, making the investment in protection proportional to the asset's value. Proportionality is also embedded in new European legislation.

    A practical framework for executing classification exercises

    While the concept is straightforward, the execution can be complex. A successful classification program requires a methodical framework that moves from high-level policy to granular implementation. in this first stage, we're going to talk about data.

    Step 1: Define the Classification Levels

    The first step is to establish a simple, intuitive classification scheme. When you complicate it, you lose your people. Most organizations find success with a three- or four-tiered model, which is easy for employees to understand and apply. For example:

    • Public: Information intended for public consumption with no negative impact from disclosure (e.g., marketing materials, press releases).

    • Internal: Information for use within the organization but not overly sensitive. Its disclosure would be inconvenient but not damaging (e.g., internal memos on non-sensitive topics, general project plans).

    • Confidential: Sensitive business information that, if disclosed, could cause measurable damage to the organization's finances, operations, or reputation (e.g., business plans, financial forecasts, customer lists).

    • Restricted or secret: The most sensitive data that could cause severe financial or legal damage if compromised. Access is strictly limited on a need-to-know basis (e.g., trade secrets, source code, PII, M&A details).

    Step 2: Tackle the Data Inventory Problem

    This is often the most challenging phase: identifying and locating all information assets. You must create a comprehensive inventory and detail not just the data itself but its entire context:

    • Data Owners: The business leader accountable for the data and for determining its classification.

    • Data Custodians: The IT or operational teams responsible for implementing and managing the security controls on the data.

    • Location: Where does the data live? Is it in a specific database, a cloud storage bucket, a third-party application, or a physical filing cabinet?

    • External Dependencies: Crucially, this inventory must extend beyond the company's walls. Which third-party vendors (payroll processors, cloud hosting providers, marketing agencies) handle, store, or transport your data? Their security posture is now part of your risk surface. In Europe, this is now a foundation of your data management through GDPR, DORA, the AI Act and other legislation. 

    Step 3: Establish a Lifecycle Approach

    Information isn't static. Its value and handling requirements can change over its lifecycle. Your classification process must define clear rules for each stage:

    • Creation: How is data classified when it's first created? How is it marked (e.g., digital watermarks, document headers)?

    • Storage & Use: What security controls apply to each classification level at rest and in transit (e.g., encryption standards, access control rules)? What about legislative initiatives?

    • Archiving & Retention: How long must the data be kept to meet business needs and legal requirements? What about external storage?

    • Destruction: What are the approved methods for securely destroying the data (e.g., cryptographic erasure, physical shredding) once it's no longer required?

    Without clear, consistent handling standards for each level, the classification labels themselves are meaningless. The classification directly dictates the required security measures.

    The hierarchy of importance.

    This dual (business processes and asset classification) top-down approach to determining criticality is often referred to as the 'hierarchy of importance,' which helps in systematically prioritizing assets based on their business value.

    Once assets are inventoried, the next step is to systematically determine their criticality. Randomly assigning importance to thousands of assets is futile. A far more effective method is a top-down, hierarchical approach that mirrors the structure of the business itself. This method creates a clear “chain of criticality,” where the importance of a technical asset is directly derived from the value of the business function it supports.

    Map the Supporting Assets and Resources

    Only now, once you have clearly defined the critical business functions and prioritized them, can you finally map the specific assets and resources they depend on. These are the people, technology, and facilities that enable the function. For the critical function “Processing New Customer Orders,” the supporting assets might include:

    • Application: SAP ERP System (Module SD)

    • Database: Oracle Customer Order Database

    • Hardware: Primary ERP Server Cluster

    • Personnel: Sales team and Order Entry team

    The criticality of the “Oracle Customer Order Database” is now clear. It is clearly integrated into the business; it is critically important because it is an essential asset for a top-priority function (SF-01) within a top-ranked business unit (“Sales”). This top-down structure provides a clear, business-justified view of risk that management can easily understand. It allows you to see precisely how a technical risk (e.g., a vulnerability in the Oracle database) can bubble up to impact a core business operation.

    From Criticality to Consequence: Master Impact Analysis

    With a clear understanding of what's indispensable, the BIA can now finally move to its core purpose: analyzing the tangible and intangible impacts of a disruption over time. A robust impact analysis prevents “impact inflation,” which is the common tendency to focus solely on unrealistic scenarios or self-importance assurances, as this just causes management to discount your findings. That just causes management to discount your findings. A more credible approach uses a range of outcomes that paint a realistic picture of escalating damage over time.

    Your analysis should assess the loss of the four core pillars of information security:

    • Loss of Confidentiality: The unauthorized disclosure of sensitive information. The impact can range from legal fines for a data breach to the loss of competitive advantage from a leaked product design.

    • Loss of Integrity: The unauthorized or improper modification of data. This can lead to flawed decision-making based on corrupted reports, financial fraud, or a complete loss of trust in the system.

    • Loss of Availability: The inability to access a system or process. This is the most common focus of traditional BIA, leading to lost productivity, missed sales, and an inability to deliver services.

    • Insecurity around Authenticity: Your ability to ensure you receive data from the expected party. 

    This brings us to the CIAA rating, which encompasses Confidentiality, Integrity, Availability, and Authenticity, providing a comprehensive framework for assessing information security impacts.

    Qualitative vs. Quantitative Analysis

    Impacts can be measured in two ways, and the most effective BIAs use a combination of both:

    • Qualitative Analysis: This uses descriptive scales (e.g., High, Medium, Low) to assess impacts that are difficult to assign a specific monetary value to. This is ideal for measuring things like reputational damage, loss of customer confidence, or employee morale. Its main advantage is prioritizing risks quickly, but it lacks the financial precision needed for a cost-benefit analysis.

    • Quantitative Analysis: This assigns a specific monetary value ($) to the impact. This is used for measurable losses like lost revenue per hour, regulatory fines, or the cost of manual workarounds. The major advantage is that it provides clear financial data to justify security investments. For example, “This outage will cost us $100,000 per hour in lost sales” is a powerful statement when requesting funding for a high-availability solution.

    A mature analysis might involve scenario modeling—where we walk through a small set of plausible disruption scenarios with business stakeholders to define a range of outcomes (minimum, maximum, and most likely). This provides a far more nuanced and credible dataset that aligns with how management views other business risks.

    The additional lens: The Customer Value Chain Contribution (CVCC)©

    To elevate the BIA from an internal exercise to a truly strategic tool, we can apply one more lens: the Customer Value Chain Contribution (CVCC)©. This approach reframes the impact analysis to focus explicitly on the customer. Instead of just asking, “What is the impact on our business?” we ask, “What is the impact on our customer's experience and our ability to deliver value to them?”

    The CVCC method involves mapping your critical processes and assets to specific stages of the customer journey. For example:

    • Awareness/Acquisition: A disruption to the company website or marketing automation platform directly impacts your ability to attract new customers.

    • Conversion/Sale: An outage of the e-commerce platform or CRM system prevents customers from making purchases, directly impacting revenue and frustrating users at a key moment.

    • Service Delivery/Fulfillment: A failure in the warehouse management or logistics system means orders can't be fulfilled, breaking promises made to the customer.

    • Support/Retention: If the customer support ticketing system is down, customers with problems can't get help, leading to immense frustration and potential churn.

    By analyzing impact through the CVCC lens, the consequences become far more vivid and compelling. “Loss of the CRM system” becomes “a complete inability to process new sales leads or support existing customers, causing direct revenue loss and significant reputational damage.” This framing aligns the BIA directly with the goal of any business: creating and retaining satisfied customers. It transforms the discussion from technical risk to the preservation of the customer relationship and the value chain that supports it.

    From document to real value

    When you build your BIA on this framework, meaning that it is rooted in sound asset classification, structured by the correct top-down criticality analysis, and enriched by the customer-centric view of impact, then it is no longer a static document. It becomes the dynamic, strategic blueprint for organizational resilience.

    These insights generate business decisions:

    • Prioritized risk mitigation: they show exactly where to focus security efforts and resources for the greatest return on investment.

    • Justified security spending: they provide the quantitative and qualitative data needed to make a compelling business case for new security controls, technologies, and processes.

    • Informed recovery planning: they establish clear, business-justified Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) that form the foundation of any effective business continuity and disaster recovery plan.

    I'm convinced that this expanded vision of the business impact analysis embeds the right analytical understanding of value and risk into the fabric of the organization. I want you to move beyond the fear of disaster and toward a confident, proactive posture of resilience. Like that, you ensure that in a world of constant change and disruption, the things that truly matter are always understood, always protected, and always available.

    Always happy to chat.

    There should never be only one.

    • Large vertical image:
    • member rating overall impact: High Impact
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    Today, we're talking about a concept that’s both incredibly simple and dangerously overlooked: the single point of failure, or SPOF for short.

    Imagine you’ve built an impenetrable fortress. It has high walls, a deep moat, and strong gates. But the entire fortress can only be accessed through a single wooden bridge. That bridge is your single point of failure. If it collapses or is destroyed, your magnificent fortress is completely cut off. It doesn't matter how strong the rest of it is; that one weak link renders the entire system useless.

    In your work, your team, and your processes and technology, these single bridges are everywhere. A SPOF is any part of a system that, if it stops working, will cause the entire system to shut down. It’s the one critical component, the one indispensable person, or the one vital process that everything else depends on.

    When you identify and fix these weak points you aren't being pessimistic; you're fixing the very foundation of something that can withstand shocks and surprises. It’s about creating truly resilient systems and teams, not just seemingly strong ones. So, let’s explore where these risks hide and what you can do about them.

    When People Become the Problem

    For those of you who know me, saying something like this feels at odds with who I am. And yet, it's one of the most common and riskiest areas in any organization. Human single points of failure don't happen because of malicious intent. They typically grow out of good intentions, hard work, and necessity. But the result is the same: a fragile system completely dependent on an individual.

    The Rise of the Hero

    We all know a colleague like this. The “hero” is the one person who has all the answers. When a critical system goes down at 3 AM, they're the only one who can fix it. They understand the labyrinthine codebase nobody else dares to touch. They have the historical context for every major decision made in the last decade. On the surface, this person is invaluable. Management loves them because they solve problems. The team relies on them because they’re a walking encyclopedia.

    But here’s the inconvenient truth: your hero is your biggest liability.

    This isn’t their fault. They likely became the hero by stepping up when no one else would or could. The hero may actually feel like they are the only ones qualified to handle the issue because “management” does not take the necessary actions to train other people. Or “management” places other priorities. Be aware, this is a perception thing. The manager is very likely to be very concerned about the well-being of their employee. (I'm taking "black companies", akin to black sites, out of the equation for a moment and concentrating on generally healthy workplaces.) The hero will likely feel a strong bond to their environment. Also, every hero is different. There is a single point of failure, but not a single type of person. Every person has a different driver.

    I watched a YouTube video by a famous entrepreneur the other day. And she said something that triggered a response in me, because it sows the seeds of the hero. She said, Would you rather have an employee who just fixes it, handles it, and deals with it? Or an employee that talks about it? Obviously, the large majority will take the person behind door number 1. I would too. But then you need to step up as a manager, as an owner, as an executive, and enforce knowledge sharing.

    If you channel all critical knowledge and capabilities through one person, if you let this person become your go-to specialist for everything, you've created a massive SPOF. What happens when your hero gets sick, takes a well deserved two week vacation to a place with no internet, or leaves the company for a new opportunity? The system grinds to a halt. A minor issue becomes a major crisis because the only person who can fix it is unavailable.

    This overreliance doesn't just create a risk; it stifles growth. Other team members don't get the opportunity to learn and develop new skills because the hero is always there to swoop in and save the day. The answer? I guess that depends on your situation and what your ability is to keep this person happy without alienating the rest of the team. The answer may lie in the options discussed later in the article around KPIs.

    The Knowledge Hoarders

    A step beyond the individual hero is the team that acts as a collective SPOF. This is the team that “protects” its know how. They might use complex, undocumented tools, speak in a language of acronyms only they understand, or resist any attempts to standardize their processes. They've built a silo around their work, making themselves indispensable as a unit.

    Unlike the hero, this often comes from a place of perceived self preservation. If they are the only ones who understand how something works, their jobs are secure, right? But this behavior is incredibly damaging to the organization's resilience. Not to mention that it is just plain wrong. The team becomes inundated with requests for new features, but also for help in solving incidents. The result in numerous instances is that the team succeeds in neither. Next the manager is called to the senior management because the business is complaining that things don't progress as expected. 

    This team thus has become a bottleneck. Any other team that needs to interact with their system is completely at their mercy. Progress slows to a crawl, dependent on their availability and willingness to cooperate. Preservation has turned into survival.  

    The real root cause at the heart of both the hero and the knowledge hoarding team is a failure of knowledge management. When information isn't shared, documented, and made accessible, you are actively choosing to create single points of failure. We'll dive deeper into building a robust knowledge sharing culture in a future article, but for now, recognize that knowledge kept in one person's or team's head is a disaster waiting to happen.

    When Your Technology is a House of Cards

    People aren't the only source of fragility. The way you build and manage your technology stacks can easily create critical SPOFs that leave you vulnerable. These are often less obvious at first, but they can cause dangerous failures when they finally break.

    The Danger of the Single Node

    Let's start with the most straightforward technical SPOF: the single node setup. Imagine you have a critical application like maybe your company's main website or an internal database. If you run that entire application on one single server (a single “node”), you've created a classic SPOF.

    It’s like a restaurant with only one chef. If that chef goes home, the kitchen closes. It doesn't matter how many waiters or tables you have. If that single server experiences a hardware failure, a software crash, or even just needs to be rebooted for an update, your entire service goes offline. There is no failover. The service is simply down until that one machine is fixed, patched or rebooted.

    You need to set up your systems so that when one node goes down, the other takes over. This is not just something for large enterprises. SMEs must do the same. I've had numerous calls from business owners who did something to their web server or system and now “it doesn't work!” Not only are they down, now they have to call me and I then must arrange for subject matter experts to fix it immediately. Typically at a cost much larger than if they had set up their system with active, warm or even cold standbys. 

    The Mystery of Closed Technologies

    Another major risk comes from an overreliance on closed, proprietary technologies. This happens when you build a core part of your business on a piece of software or hardware that you don't control and can't inspect. It’s a “black box.” You know what it’s supposed to do, but you have no idea how it does it, and you can’t fix it if it breaks. When something goes wrong, you are completely at the mercy of the company that created it. You have to submit a support ticket and wait.

    This is actually relatable to the next chapter, please follow along and take the advice there.

    The Trap of Vendor Lock In

    Closely related to closed technology is the concept of vendor lock-in. This is a subtle but powerful SPOF. It happens when you become so deeply integrated with a single vendor's ecosystem that the cost and effort of switching to a competitor are impossibly high. Your vendor effectively becomes a strategic single point of failure. Your ability to innovate, control costs, and pivot your strategy is now tied to the decisions of another company.

    This may even run afoul of legal standards. In Europe, we have the DORA and NIS2 regulations. DORA specifically mandates that companies have exit plans for their systems, starting with their critical and important functions. Functions refers to business services, to be clear. 

    But we get there so easily. The native functions of AWS, Azure and Google Cloud, just to name a few, are very enticing to use. They offer convenience, low code, and performance on tap. It's just that, once you integrate deeply with them, you are taken, hook, line, and sinker. And then you have people like me, or worse, your regulator, who demands “What is your exit plan?”

    Your Resilience Playbook: Practical Steps to Eliminate SPOFs

    Identifying your single points of failure is the first step. The real work is in systematically eliminating them. This isn't about a single, massive project; it's about building new habits and principles into your daily work. Here's a playbook I think you can start using today.

    Mitigate People-Based Risks

    The cure for depending on one person is to create a culture where knowledge is fluid and shared by default. Your goal is to move from individual heroics to collective resilience.

    • Mandate real vacations. This might sound strange, but one of the best ways to reveal and fix a “hero” problem is to make sure your hero takes a real, disconnected vacation. This isn't a punishment; it's a benefit to them and a necessary stress test for the team. It forces others to step up and document their processes in preparation. The first time will be painful, but it gets easier each time as the team builds its own knowledge.

    • Adopt the “teach, don't just do” rule. Coach your senior experts to see their role as multipliers. When someone asks them a question, their first instinct should be to show, not just to do. This can be a five minute screen sharing session, grabbing a colleague to pair program on a fix, or taking ten minutes to write down the answer in a shared knowledge base so it never has to be asked again.

      Many companies have knowledge sharing solutions in place. Take a moment to actually use them. Prepare for when new people come into the company. Have a place where they can get into the groove and learn the heart beat of the company. There is a reason why the Madonna song is so captivating to so many people. Getting into the groove elevates you. And the same thing happens in your company. 

    • Rotate responsibilities and run "game days". Actively move people around. Let a developer handle support tickets for a week to understand common customer issues. Have your infrastructure expert sit with the product team. Also, create “game days” where you simulate a crisis. For example: "Okay team, our lead developer is 'on vacation' today. Let's practice a full deployment without them.” This makes learning safe and proactive.

    • Celebrate team success, not individual firefighting. Shift your praise and recognition. Instead of publicly thanking a single person for working all night to resolve a problem, celebrate the team that built a system so resilient it didn't break in the first place. Reward the team that wrote excellent documentation that allowed a junior member to solve a complex issue. Culture follows what you celebrate. At the same time, if the team does not pony up, definitely praise the person and follow up with the team to fix this.

    • Host internal demos and tech talks. Create a regular, informal forum where people can share what they're working on. This could be a “brown bag lunch” session or a Friday afternoon demo. It demystifies what other teams are doing, breaks down silos, and encourages people to ask questions in a low pressure environment.

    • Remunerate sharing. Make sharing knowledge a bonus-eligible key performance indicator. The more sharing an expert does, with their peers acknowledging this, the more the expert earns. You can easily incorporate this into your peer feedback system. 

    • Run DRP exercises without your top engineers: This is taking a leap of faith, and I would never recommend this until all of the above are in place and proven. 

    Building Resilient Technical Systems

    The core principle here is to assume failure will happen and to design for it. A resilient system isn't one where parts never fail, but one where the system as a whole keeps working even when they do.

    • Embrace the rule of three. This is a simple but powerful guideline. For critical data, aim to have three copies on two different types of media, with one copy stored off-site (or in a different cloud region). For critical services, aim for at least three instances running in different availability zones. This simple rule protects you from a wide range of common failures.

    • Automate everything you can. Every manual process is a potential SPOF. It relies on a person remembering a series of steps perfectly, often under pressure. Automate your testing, your deployments, your server setup, and your backup procedures. Scripts are consistent and repeatable; tired humans at 3 AM are not.

    • Use health checks and smart monitoring. It's not enough to have a backup server; you need to know that it's healthy and ready to take over. Implement automated health checks that constantly monitor your primary and redundant systems. Your monitoring should alert you the moment a backup component fails, not just when the primary one does.

    • Practice chaos engineering. Don't wait for a real failure to test your resilience. Intentionally introduce failures in a controlled environment. This is known as chaos engineering. Start small. What happens if you turn off a non-critical service during work hours? Does the system handle it gracefully? Does the team know how to respond? This turns a potential crisis into a planned, educational drill.

    Avoiding Technology and Vendor Traps

    Your resilience also depends on the choices you make about the technology and partners you rely on. The goal is to maintain control over your destiny.

    • Build abstraction layers. Instead of having your application code talk directly to a specific vendor's service, create an intermediary layer that you control. This “abstraction layer” acts as a buffer. If you ever need to switch vendors, you only have to update your abstraction layer, not your entire application. It’s more work up front but gives you immense flexibility later.

    • Make “ease of exit” a key requirement. When you evaluate a new technology or vendor, make portability a primary concern. Ask tough questions: How do we get our data out? What is the process for migrating to a competitor? Is the technology based on open standards? Run a small proof of concept to test how hard it would be to leave before you commit fully.

    • Consider a multi-vendor strategy. For your most critical dependencies, like cloud hosting, avoid going all in on a single provider if you can. Using services from two or more vendors is an advanced strategy, but it provides the ultimate protection against a massive, platform wide outage or unfavorable changes in pricing or terms.

    It's a journey, not a destination

    You will never be “ready.” Building resilience by eliminating single points of failure isn't a one time project you can check off a list. It’s a continuous process. New SPOFs will emerge as your systems evolve, people change roles, and your business grows.

    The key is to make this thinking a part of your culture. Make “What's the bus factor for this project?” a regular question in your planning meetings. Make redundancy and documentation a non negotiable requirement for new systems. By constantly looking for the one thing that can bring everything down, you can build teams and technology that don't just survive shocks—they eat them for breakfast.

    Applications Priorities 2023

    • Buy Link or Shortcode: {j2store}186|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Architecture & Strategy
    • Parent Category Link: /architecture-and-strategy
    • Economic, social, and regulatory conditions have changed livelihoods, businesses, and marketplaces. Modern tools and technologies have acted as lifelines by minimizing operating and delivery costs, and in the process, establishing a strong foundation for growth and maturity.
    • These tools and technologies must meet the top business goals of CXOs: ensure service continuity, improve customer experience, and make data-driven decisions.
    • While today’s business applications are good and well received, there is still room for improvement. The average business application satisfaction score among IT leadership was 72% (n=1582, CIO Business Vision).

    Our Advice

    Critical Insight

    • Applications are critical components in any business strategic plan. They can directly influence an organization’s internal and external brand and reputation, such as their uniqueness, competitiveness and innovativeness in the industry
    • Business leaders are continuously looking for innovative ways to better position their application portfolio to satisfy their goals and objectives, i.e., application priorities. Given the scope and costs often involved, these priorities must be carefully crafted to clearly state achievable business outcomes that satisfies the different needs very different customers, stakeholders, and users.
    • Unfortunately, expectations on your applications team have increased while the gap between how stakeholders and applications teams perceive effectiveness remains wide. This points to a need to clarify the requirements to deliver valuable and quality applications and address the pressures challenging your teams.

    Impact and Result

    Learn and explore the technology and practice initiatives in this report to determine which initiatives should be prioritized in your application strategy and align to your business organizational objectives:

    • Optimize the effectiveness of the IT organization.
    • Boost the productivity of the enterprise.
    • Enable business growth through technology.

    Applications Priorities 2023 Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Applications Priorities Report 2023 – A report that introduces and describes five opportunities to prioritize in your 2023 application strategy.

    In this report, we explore five priorities for emerging and leading-edge technologies and practices that can improve on capabilities needed to meet the ambitions of your organization.

    • Applications Priorities 2023 Report

    Infographic

    Further reading

    Applications Priorities 2023

    Applications are the engine of the business: keep them relevant and modern

    What we are facing today is transforming the ways in which we work, live, and relate to one another. Applications teams and portfolios MUST change to meet this reality.

    Economic, social, and regulatory conditions have changed livelihoods, businesses, and marketplaces. Modern tools and technologies have acted as lifelines by minimizing operating and delivery costs, and in the process, establishing a strong foundation for growth and maturity.

    As organizations continue to strengthen business continuity, disaster recovery, and system resilience, activities to simply "keep the lights on" are not enough. Be pragmatic in the prioritization and planning of your applications initiatives, and use your technologies as a foundation for your growth.

    Your applications must meet the top business goals of your CXOs

    • Ensure service continuity
    • Improve customer experience
    • Make data-driven decisions
    • Maximize stakeholder value
    • Manage risk

    Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022, n=568.

    Select and align your applications priorities to your business goals and objectives

    Applications are critical components in any business strategic plan. They can directly influence an organization's internal and external brand and reputation, such as their:

    • Uniqueness, competitiveness, and innovativeness in the industry.
    • Ability to be dynamic, flexible, and responsive to changing expectations, business conditions, and technologies.

    Therefore, business leaders are continuously looking for innovative ways to better position their application portfolios to satisfy their goals and objectives, i.e. applications priorities. Given the scope and costs often involved, these priorities must be carefully crafted to clearly state achievable business outcomes that satisfy
    the different needs of very different customers, stakeholders, and users.

    Today's business applications are good but leave room for improvement

    72%
    Average business application satisfaction score among IT leadership in 1582 organizations.

    Source: CIO Business Vision, August 2021 to July 2022, N=190.

    Five Applications Priorities for 2023

    In this report, we explore five priorities for emerging and leading-edge technologies and practices that can improve on capabilities needed to meet the Ambitions of your organization.

    this is an image of the Five Applications Priorities for which will be addressed in this blueprint.

    Strengthen your foundations to better support your applications priorities

    These key capabilities are imperative to the success of your applications strategy.

    KPI and Metrics

    Easily attainable and insightful measurements to gauge the progress of meeting strategic objectives and goals (KPIs), and the performance of individual teams, practices and processes (metrics).

    BUSINESS ALIGNMENT

    Gain an accurate understanding and interpretation of stakeholder, end-user, and customer expectations and priorities. These define the success of business products and services considering the priorities of individual business units and teams.

    EFFICIENT DELIVERY & SUPPORT PRACTICE

    Software delivery and support roles, processes, and tools are collaborative, well equipped and resourced, and optimized to meet changing stakeholder expectations.

    Data Management & Governance

    Ensuring data is continuously reliable and trustworthy. Data structure and integrations are defined, governed, and monitored.

    Product & Service Ownership

    Complete inventory and rationalization of the product and service portfolio, prioritized backlogs, roadmaps, and clear product and service ownership with good governance. This helps ensure this portfolio is optimized to meet its goals and objectives.

    Strengthen your foundations to better support your applications priorities (cont'd)

    These key capabilities are imperative to the success of your applications strategy.

    Organizational Change Management

    Manage the adoption of new and modified processes and technologies considering reputational, human, and operational concerns.

    IT Operational Management

    Continuous monitoring and upkeep of products and services to assure business continuity, and system reliability, robustness and disaster recovery.

    Architectural Framework

    A set of principles and standards that guides the consistent, sustainable and scalable growth of enterprise technologies. Changes to the architecture are made in collaboration with affected parties, such as security and infrastructure.

    Application Security

    The measures, controls, and tactics at the application layer that prevent vulnerabilities against external and internal threats and ensure compliance to industry and regulatory security frameworks and standards.

    There are many factors that can stand in your team's way

    Expectations on your applications team have increased, while the gap between how stakeholders and applications teams perceive effectiveness remains wide. This points to a need to clarify the requirements to deliver valuable and quality applications and address the pressures challenging your teams.

    1. Attracting and retaining talent
    2. Maximizing the return on technology
    3. Confidently shifting to digital
    4. Addressing competing priorities
    5. Fostering a collaborative culture
    6. Creating high-throughput teams

    CIOs agree that at least some improvement is needed across key IT activities

    A bar graph is depicted which shows the proportion of CIOs who believe that some, or significant improvement is necessary for the following categories: Measure IT Project Success; Align IT Budget; Align IT Project Approval Process; Measure Stakeholder Satisfaction With IT; Define and Align IT Strategy; Understand Business Goals

    Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022, n=568.

    Pressure Point 1:
    Attracting and Retaining Talent

    Recent environmental pressures impacted traditional working arrangements and showed more workplace flexibility is often possible. At the same time, many employees' expectations about how, when, and where they choose to work have also evolved. Recruitment and retention are reflections of different sides of the same employee value proposition coin. Organizations that fail to reinvent their approach to attracting and retaining talent by focusing on candidate and employee experience risk turnover, vacancies, and lost opportunities that can negatively impact the bottom line.

    Address the underlying challenges

    • Lack of employee empowerment and few opportunities for learning and development.
    • Poor coworker and manager relationships.
    • Compensation and benefits are inadequate to maintain desired quality of life.
    • Unproductive work environment and conflicting balance of work and life.
    • Unsatisfactory employee experience, including lack of employee recognition
      and transparency of organizational change.

    While workplace flexibility comes with many benefits, longer work hours jeopardize wellbeing.
    62% of organizations reported increased working hours, while 80% reported an increase in flexibility.
    Source: McLean & Company, 2022; n=394.

    Be strategic in how you fill and train key IT skills and capabilities

    • Cybersecurity
    • Big Data/Analytics
    • Technical Architecture
    • DevOps
    • Development
    • Cloud

    Source: Harvey Nash Group, 2021; n=2120.

    Pressure Point 2:
    Maximizing the Return of Technology

    Recent environmental pressures impacted traditional working arrangements and showed more workplace flexibility is often possible. At the same time, many employees' expectations about how, when, and where they choose to work have also evolved. Recruitment and retention are reflections of different sides of the same employee value proposition coin. Organizations that fail to reinvent their approach to attracting and retaining talent by focusing on candidate and employee experience risk turnover, vacancies, and lost opportunities that can negatively impact the bottom line.

    Address the underlying challenges

    • Inability to analyze, propose, justify, and communicate modernization solutions in language the stakeholders understand and in a way that shows they clearly support business priorities and KPIs and mitigate risks.
    • Little interest in documenting and rationalizing products and services through business-IT collaboration.
    • Lack of internal knowledge of the system and loss of vendor support.
    • Undefined, siloed product and service ownership and governance, preventing solutions from working together to collectively deliver more value.
    • Little stakeholder appetite to invest in activities beyond "keeping the lights on."

    Only 64% of applications were identified as effective by end users.
    Effective applications are identified as at least highly important and have high feature and usability satisfaction.
    Source: Application Portfolio Assessment, August 2021 to July 2022; N=315.

    "Regardless of the many definitions of modernization floating around, the one characteristic that we should be striving for is to ensure our applications do an outstanding job of supporting the users and the business in the most effective and efficient manner possible."
    Source: looksoftware.

    Pressure Point 3:
    Confidently Shifting to Digital

    "Going digital" reshapes how the business operates and drives value by optimizing how digital and traditional technologies and tactics work together. This shift often presents significant business and technical risks to business processes, enterprise data, applications, and systems which stakeholders and teams are not aware of or prepared to accommodate.

    Address the underlying challenges

    • Differing perspectives on digital can lead to disjointed transformation initiatives, oversold benefits, and a lack of synergy among digital technologies and processes.
    • Organizations have difficulty adapting to new technologies or rethinking current business models, processes, and ways of working because of the potential human, ethical, and reputational impacts and restrictions from legacy systems.
    • Management lacks a framework to evaluate how their organization manages and governs business value delivery.
    • IT is not equipped or resourced to address these rapidly changing business, customer, and technology needs.
    • The wrong tools and technologies were chosen to support the shift to digital.

    The shift to digital processes is starting, but slowly.
    62% of respondents indicated that 1-20% of their processes were digitized during the past year.
    Source: Tech Trends and Priorities 2023; N=500

    Resistance to change and time/budget constraints are top barriers preventing companies from modernizing their applications.
    Source: Konveyor, 2022; n=600.

    Pressure Point 4:
    Addressing Competing Priorities

    Enterprise products and services are not used, operated, or branded in isolation. The various parties involved may have competing priorities, which often leads to disagreements on when certain business and technology changes should be made and how resources, budget, and other assets should be allocated. Without a broader product vision, portfolio vision, and roadmap, the various dependent or related products and services will not deliver the same level of value as if they were managed collectively.

    Address the underlying challenges

    • Undefined product and service ownership and governance, including escalation procedures when consensus cannot be reached.
    • Lack of a unified and grounded set of value and quality definitions, guiding principles, prioritization standards, and broad visibility across portfolios, business capabilities, and business functions.
    • Distrust between business units and IT teams, which leads to the scaling of unmanaged applications and fragmented changes and projects.
    • Decisions are based on opinions and experiences without supporting data.

    55% of CXOs stated some improvement is necessary in activities to understand business goals.
    Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.

    CXOs are moderately satisfied with IT's performance as a business partner (average score of 69% among all CXOs). This sentiment is similarly felt among CIOs (64%).
    Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.

    Pressure Point 5:
    Fostering a Collaborative Culture

    Culture impacts business results, including bottom-line revenue and productivity metrics. Leaders appreciate the impact culture can have on applications initiatives and wish to leverage this. How culture translates from an abstract concept to something that is measurable and actionable is not straightforward. Executives need to clarify how the desired culture will help achieve their applications strategy and need to focus on the items that will have the most impact.

    Address the underlying challenges

    • Broad changes do not consider the unique subcultures, personalities, and behaviors of the various teams and individuals in the organization.
    • Leaders mandate cultural changes without alleviating critical barriers and do not embody the principles of the target state.
    • Bureaucracy and politics restrict changes and encourage the status quo.
    • Industry standards, technologies, and frameworks do not support or cannot be tailored to fit the desired culture.
    • Some teams are deliberately excluded from the scoping, planning, and execution of key product and service delivery and management activities.

    Agile does not solve team culture challenges.
    43% of organizations cited organizational culture as a significant barrier to adopting and scaling Agile practices.
    Source: Digital.ai, 2021.

    "Providing a great employee experience" as the second priority (after recruiting) highlights the emphasis organizations are placing on helping employees adjust after having been forced to change the way work gets done.
    Source: McLean & Company, 2022; N=826.

    Use your applications priorities to help address your pressure points

    Success can be dependent on your ability to navigate around or alleviate your pressure points. Design and market your applications priorities to bring attention to your pressure points and position them as key risk factors to their success.

    Applications Priorities
    Digital Experience (DX) Intelligent Automation Proactive Application Management Multisource Systems Digital Organization as a Platform
    Attracting and Retaining Talent Enhance the employee experience Be transparent and support role changes Shift focus from maintenance to innovation Enable business-managed applications Promote and showcase achievements and successes
    Maximizing the Return on Technology Modernize or extend the use of existing investments Automate applications across multiple business functions Improve the reliability of mission-critical applications Enhance the functionality of existing applications Increase visibility of underused applications
    Confidently Shifting to Digital Prioritize DX in your shift to digital Select the capabilities that will benefit most from automation Prepare applications to support digital tools and technologies Use best-of-breed tools to meet specific digital needs Bring all applications up to a common digital standard
    Addressing Competing Priorities Ground your digital vision, goals, and objectives Recognize and evaluate the architectural impact Rationalize the health of the applications Agree on a common philosophy on system composition Map to a holistic platform vision, goals, and objectives
    Fostering a Collaborative Culture Involve all perspectives in defining and delivering DX Involve the end user in the delivery and testing of the automated process Include the technical perspective in the viability of future applications plans Discuss how applications can work together better in an ecosystem Ensure the platform is configured to meet the individual needs of the users
    Creating High-Throughput Teams Establish delivery principles centered on DX Remove manual, error-prone, and mundane tasks Simplify applications to ease delivery and maintenance Alleviate delivery bottlenecks and issues Abstract the enterprise system to expedite delivery

    Digital Experience (DX)

    PRIORITY 1

    • Deliver Valuable User, Customer, Employee, and Brand Experiences

    Delivering valuable digital experiences requires the adoption of good management, governance, and operational practices to accommodate stakeholder, employee, customer, and end-user expectations of digital experiences (e.g. product management, automation, and iterative delivery). Technologies are chosen based on what best enables, delivers, and supports these expectations.

    Introduction

    Digital transformation is not just about new tools and technologies. It is also about delivering a valuable digital experience

    What is digital experience (DX)?

    Digital experience (DX) refers to the interaction between a user and an organization through digital products and services. Digital products and services are tools, systems, devices, and resources that gather, store, and process data; are continuously modernized; and embody eight key attributes that are described on the following slide. DX is broken down into four distinct perspectives*:

    • Customer Experience – The immediate perceptions of transactions and interactions experienced through a customer's journey in the use of the organization's digital
      products and services.
    • End-User Experience – Users' emotions, beliefs, and physical and psychological responses
      that occur before, during, or after interacting with a digital product or service.
    • Brand Experience – The broader perceptions, emotions, thoughts, feelings and actions the public associate with the organization's brand and reputation or its products and services. Brand experience evolves over time as customers continuously engage with the brand.
    • Employee Experience – The satisfaction and experience of an employee through their journey with the organization, from recruitment and hiring to their departure. How an employee embodies and promotes the organization brand and culture can affect their performance, trust, respect, and drive to innovate and optimize.
    Digital Products and Services
    Customer Experience Brand Experience Employee Experience End-User Experience

    Digital products and services have a common set of attributes

    Digital transformation is not just about new tools and technologies. It is also about delivering a valuable digital experience

    • Digital products and services must keep pace with changing business and end-user needs as well as tightly supporting your maturing business model with continuous modernization. Focus your continuous modernization on the key characteristics that drive business value.
    • Fit for purpose: Functionalities are designed and implemented for the purpose of satisfying the end user's needs and solving their problems.
    • User-centric: End users see the product as rewarding, engaging, intuitive, and emotionally satisfying. They want to come back to it.
    • Adaptable: The product can be quickly tailored to meet changing end-user and technology needs with reusable and customizable components.
    • Accessible: The product is available on demand and on the end user's preferred interface.
      End users have a seamless experience across all devices.
    • Private and secured: The end user's activity and data are protected from unauthorized access.
    • Informative and insightful: The product delivers consumable, accurate, and trustworthy real-time data that is important to the end user.
    • Seamless application connection: The product facilitates direct interactions with one or more other products through an uninterrupted user experience.
    • Relationship and network building: The product enables and promotes the connection and interaction of people.

    The Business Value cycle of continuous modernization.

    Signals

    DX is critical for business growth and maturity, but the organization may not be ready

    A good DX has become a key differentiator that gives organizations an advantage over their competition and peers. Shifts in working environments; employee, customer, and stakeholder expectations; and the advancements in modern technologies have raised the importance of adopting and transitioning to digital processes and tools to stay relevant and responsive to changing business and technology conditions.

    Applications teams are critical to ensuring the successful delivery and operation of these digital processes and tools. However, they are often under-resourced and challenged to meet their DX goals.

    • 7% of both business and IT respondents think IT has the resources needed to keep up with digital transformation initiatives and meet deadlines (Cyara, 2021).
    • 43% of respondents said that the core barrier to digital transformation is a lack of skilled resources (Creatio, 2021).
    A circle graph is shown with 91% of the circle coloured in dark blue, with the number 91% in the centre.

    of organizations stated that at least 1% of processes were shifted from being manually completed to digitally completed in the last year. 29% of organizations stated at least 21% were shifted.

    Source: Tech Trends and Priorities 2023; N=500.

    A circle graph is shown with 98% of the circle coloured in dark blue, with the number 98% in the centre.

    of organizations recognized digital transformation is important for competitive advantage. 94% stated it is important to enhance customer experience, and 91% stated it will have a positive impact on revenue.

    Source: Cyara, 2021.

    Drivers

    Brand and reputation

    Customers are swayed by the innovations and advancements in digital technologies and expect your applications team to deliver and support them. Your leaders recognize the importance of these expectations and are integrating them into their business strategy and brand (how the organization presents itself to its customers, employees and the public). They hope that their actions will improve and shape the company's reputation (public perception of the company) as effective, customer-focused, and forward-thinking.

    Worker productivity

    As you evolve and adopt more complex tools and technology, your stakeholders will expect more from business units and IT teams. Unfortunately, teams employing manual processes and legacy systems will struggle to meet these expectations. Digital products and services promote the simplification of complex operations and applications and help the business and your teams better align operational practices with strategic goals and deliver valuable DX.

    Organization modernization

    Legacy processes, systems, and ways of working are no longer suitable for meeting the strategic digital objectives and DX needs stakeholders expect. They drive up operational costs without increased benefits, impede business growth and innovation, and consume scarce budgets that could be used for other priorities. Shifting to digital tools and technologies will bring these challenges to light and demonstrate how modernization is an integral part of DX success.

    Benefits & Risks

    Benefits

    • Flexibility & Satisfaction
    • Adoption
    • Reliability

    Employees and customers can choose how they want to access, modify, and consume digital products and services. They can be tailored to meet the specific functional needs, behaviors, and habits of the end user.

    The customer, end user, brand, and employee drive selection, design, and delivery of digital products and services. Even the most advanced technologies will fail if key roles do not see the value in their use.

    Digital products and services are delivered with technical quality built into them, ensuring they meet the industry, regulatory, and company standards throughout their lifespan and in various conditions.

    Risks

    • Legacy & Lore
    • Bureaucracy & Politics
    • Process Inefficiencies
    • No Quality Standards

    Some stakeholders may not be willing to change due to their familiarity and comfort of business practices.

    Competing and conflicting priorities of strategic products and services undermine digital transformation and broader modernization efforts.

    Business processes are often burdened by wasteful activities. Digital products and services are only as valuable as the processes they support.

    The performance and support of your digital products and services are hampered due to unmanageable technical debt because of a deliberate decision to bypass or omit quality good practices.

    Address your pressure points to fully realize the benefits of this priority

    Success can be dependent on your ability to address your pressure points.

    Attracting and Retaining Talent

    Enhance the employee experience.

    Design the digital processes, tools, and technologies to meet the individual needs of the employee.

    Maximizing the Return on Technology

    Modernize or extend the use of existing investments.

    Drive higher adoption of applications and higher user value and productivity by implementing digital capabilities to the applications that will gain the most.

    Confidently Shifting to Digital

    Prioritize DX in your shift to digital. Include DX as part of your definition of success.

    Your products and services are not valuable if users, customers, and employees do not use them.

    Addressing Competing Priorities

    Ground your digital vision, goals, and objectives

    Establish clear ownership of DX and digital products and services with a cross-functional prioritization framework.

    Fostering a Collaborative Culture

    Involve all perspectives in defining and delivering DX.

    Maintain a committee of owners, stakeholders, and delivery teams to ensure consensus and discuss how to address cross-functional opportunities and risks.

    Creating High-Throughput Teams

    Establish delivery principles centered on DX.

    Enforce guiding principles to streamline and simplify DX delivery, such as plug-and-play architecture and quality standards.

    Recommendations

    Build a digital business strategy

    A digital business strategy clearly articulates the goals and ambitions of the business to adopt digital practices, tools, and technologies. This document:

    • Looks for ways to transform the business by identifying what technologies to embrace, what processes to automate, and what new business models to create.
    • Unifies digital possibilities with your customer experiences.
    • Establishes accountability with the executive leadership.
    • States the importance of cross-functional participation from senior management across the organization.

    Related Research:

    Learn, understand, and empathize with your users, employees, and customers

    • To create a better product, solution, or service, understanding those who use it, their needs, and their context is critical.
    • A great experience design practice can help you balance those goals so that they are in harmony with those of your users.
    • IT leaders must find ways to understand the needs of the business and develop empathy on a much deeper level. This empathy is the foundation for a thriving business partnership.

    Related Research:

    Recommendations

    Center product and service delivery decisions and activities on DX and quality

    User, customer, employee, and brand are integral perspectives on the software development lifecycle (SDLC) and the management and governance practices supporting digital products and services. It ensures quality standards and controls are consistently upheld while maintaining alignment with various needs and priorities. The goal is to come to a consensus on a universal definition and approach to embed quality and DX-thinking throughout the delivery process.

    Related Research:

    Instill collaborative delivery practices

    Today's rapidly scaling and increasingly complex digital products and services create mounting pressure on delivery teams to release new features and changes quickly and with sufficient quality. This pressure is further compounded by the competing priorities of individual stakeholders and the nuances among different personas of digital products and services.

    A collaborative delivery practice sets the activities, channels, and relationships needed to deliver a valuable and quality product or service with cross-functional awareness, accountability, and agreement.

    Related Research:

    Recommendations

    Continuously monitor and modernize your digital products and services

    Today's modern digital products and services are tomorrow's shelfware. They gradually lose their value, and the supporting technologies will become obsolete. Modernization is a continuous need.

    Data-driven insights help decision makers decide which products and services to retire, upgrade, retrain on, or maintain to meet the demands of the business.

    Enhancements focusing on critical business capabilities strengthen the case for investment and build trust with all stakeholders.

    Related Research:

    CASE STUDY
    Mastercard in Asia

    Focus on the customer journey

    Chief Marketing Officer M.V. Rajamannar (Raja) wanted to change Mastercard's iconic "Priceless" ad campaign (with the slogan "There are some things money can't buy. For everything else there's Mastercard."). The main reasons were that the campaign relied on one-way communication and targeted end customers, even though Mastercard doesn't issue cards directly to customers; partner banks do. To drive the change in campaign, Raja and his team created a digital engine that leveraged digital and social media. Digital engine is a seven-step process based on insights gleaned from data and real-time optimization.

    1. Emotional spark: Using data to understand customers' passion points, Mastercard builds videos and creatives to ignite an emotional spark and give customers a reason to engage. For example, weeks before New Year's Eve, Mastercard produced a video with Hugh Jackman to encourage customers to submit a story about someone who deeply mattered to them. The authors of the winning story would be flown to reunite with those both distant and dear.
    2. Engagement: Mastercard targets the right audience with a spark video through social media to encourage customers to share their stories.
    3. Offers: To help its partner banks and merchants in driving their business, the company identifies the best offers to match consumers' interests. In the above campaign, Mastercard's Asia-Pacific team found that Singapore was a favorite destination for Indian customers, so they partnered with Singapore's Resorts World Sentosa with an attractive offer.
    4. Real-time optimization: Mastercard optimizes, in real time, a portfolio of several offers through A/B testing and other analysis.
    5. Amplification: Real-time testing provides confidence to Mastercard about the potential success of these offers and encourages its bank and merchant partners to co-market and co-fund these campaigns.
    6. Network effects: A few weeks after consumers submitted their stories about distant loved ones, Mastercard selected winners, produced videos of them surprising their friends and families, and used these videos in social media to encourage sharing.
    7. Incremental transactions: These programs translate into incremental business for banks who issue cards, for merchants where customers spend money, and for Mastercard, which gets a portion of every transaction.

    Source: Harvard Business Review Press

    CASE STUDY
    Mastercard in Asia (cont'd)

    Focus on the customer journey

    1. Emotional Spark
      Drives genuine personal stories
    2. Engagement
      Through Facebook
      and social media
    3. Offers
      From merchants
      and Mastercard assets
    4. Optimization
      Real-time testing of offers and themes
    5. Amplification
      Paid and organic programmatic buying
    6. Network Effects
      Sharing and
      mass engagement
    7. Incremental Transactions
      Win-win for all parties

    CASE STUDY
    Mastercard in Asia (cont'd)

    The Mastercard case highlights important lessons on how to engage customers:

    • Have a broad message. Brands need to connect with consumers over how they live and spend their time. Organizations need to go beyond the brand or product message to become more relevant to consumers' lives. Dove soap was very successful in creating a conversation among consumers with its "Real Beauty" campaign, which focused not on the brand or even the product category, but on how women and society view beauty.
    • Shift from storytelling to story making. To break through the clutter of advertising, companies need to move from storytelling to story making. A broader message that is emotionally engaging allows for a two-way conversation.
    • Be consistent with the brand value. The brand needs to stand for something, and the content should be relevant to and consistent with the image of the brand. Pepsi announced an award of $20 million in grants to individuals, businesses, and nonprofits that promote a new idea to make a positive impact on community. A large number of submissions were about social causes that had nothing to do with Pepsi, and some, like reducing obesity, were in conflict with Pepsi's product.
    • Create engagement that drives business. Too much entertainment in ads may engage customers but detract from both communicating the brand message and increasing sales. Simply measuring the number of video views provides only a partial picture of a program's success.

    Intelligent Automation

    PRIORITY 2

    • Extend Automation Practices with AI and ML

    AI and ML are rapidly growing. Organizations see the value of machines intelligently executing high-performance and dynamic tasks such as driving cars and detecting fraud. Senior leaders see AI and ML as opportunities to extend their business process automation investments.

    Introduction

    Intelligent automation is the next step in your business process automation journey

    What is intelligent automation (IA)?

    Intelligent automation (IA) is the combination of traditional automation technologies, such as business process management (BPM) and robotic process automation (RPA), with AI and ML. The goal is to further streamline and scale decision making across various business processes by:

    • Removing human interactions.
    • Addressing decisions that involve complex variables.
    • Automatically adapting processes to changing conditions.
    • Bridging disparate automation technologies into an integrated end-to-end value delivery pipeline.

    "For IA to succeed, employees must be involved in the transformation journey so they can experience firsthand the benefits of a new way of working and creating business value," (Cognizant).

    What is the difference between IA and hyperautomation?

    "Hyperautomation is the act of automating everything in an organization that can be automated. The intent is to streamline processes across an organization using intelligent automation, which includes AI, RPA and other technologies, to run without human intervention. … Hyperautomation is a business-driven, disciplined approach that organizations use to rapidly identify, vet, and automate as many business and IT processes as possible" (IBM, 2021).

    Note that hyperautomation often enables IA, but teams solely adopting IA do not need to abide to its automation-first principles.

    IA is a combination of various tools and technologies

    What tools and technologies are involved in IA?

    • Artificial intelligence (AI) & Machine Learning (ML) – AI systems perform tasks mimicking human intelligence such as learning from experience and problem solving. AI is making its own decisions without human intervention. Machine learning systems learn from experience and without explicit instructions. They learn patterns from data then analyze and make predictions based on past behavior and the patterns learned. AI is a combination of technologies and can include machine learning.
    • Intelligent Business Process Management System (iBPMS) – Combination of BPM tools with AI and other intelligence capabilities.
    • Robotic Process Automation (RPA) – Robots leveraging an application's UI rather than programmatic access. Automate rules-based, repetitive tasks performed by human workers with AI/ML.
    • Process Mining & Discovery – Process mining involves reading system event logs and application transactions and applying algorithmic analysis to automatically identify and map inferred business processes. Process discovery involves unintrusive virtual agents that sit on a user's desktop and record and monitor how they interact with applications to perform tasks and processes. Algorithms are then used to map and analyze the processes.
    • Intelligent Document Processing – The conversion of physical or unstructured documents into a structured, digital format that can be used in automation solutions. Optical character recognition (OCR) and natural language processing (NPL) are common tools used to enable this capability.
    • Advanced Analytics – The gathering, synthesis, transformation, and delivery of insightful and consumable information that supports data-driven decision making. Data is queried from various disparate sources and can take on a variety of structured and unstructured formats.

    The cycle of IA technologies

    Signals

    Process automation is an executive priority and requires organizational buy-in

    Stakeholders recognize the importance of business process automation and AI and are looking for ways to deliver more value using these technologies.

    • 90% of executives stated automating business workflows post-COVID-19 will ensure business continuity (Kofax, 2022).
    • 88% of executives stated they need to fast-track their end-to-end digital transformation (Kofax, 2022).

    However, the advertised benefits to vendors of enabling these desired automations may not be easily achievable because of:

    • Manual and undocumented business processes.
    • Fragmented and inaccessible systems.
    • Poor data quality, insights, and security.
    • The lack of process governance and management practice.
    A circle graph is shown with 49% of the circle coloured in dark blue, with the number 49% in the centre.

    of CXOs stated staff sufficiency, skill and engagement issues as a minor IT pain point compared to 51% of CIOs stated this issue as a major pain point.

    Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.

    A circle graph is shown with 36% of the circle coloured in dark blue, with the number 36% in the centre.

    of organizations have already invested in AI or machine learning.

    Source: Tech Trends and Priorities 2023; N=662

    Drivers

    Quality & throughput

    Products and services delivered through an undefined and manual process risk the creation of preventable and catchable defects, security flaws and holes, missing information, and other quality issues. IA solutions consistently reinforce quality standards the same way across all products and services while tailoring outputs to meet an individual's specific needs. Success is dependent on the accurate interpretation and application of quality standards and the user's expectations.

    Worker productivity

    IA removes the tedious, routine, and mundane tasks that distract and restrict employees from doing more valuable, impactful, and cognitively focused activities. Practical insights can also be generated through IA tools that help employees make data-driven decisions, evaluate problems from different angles, and improve the usability and value of the products and services they produce.

    Good process management practices

    Automation magnifies existing inefficiencies of a business process management practice, such as unclear and outdated process documentation and incorrect assumptions. IA reinforces the importance of good business process optimization practices, such as removing waste and inefficiencies in a thoughtful way, choosing the most appropriate automation solution, and configuring the process in the right way to maximize the solution's value.

    Benefits & Risks

    Benefits

    • Documentation
    • Hands-Off
    • Reusability

    All business processes must be mapped and documented to be automated, including business rules, data entities, applications, and control points.

    IA can be configured and orchestrated to automatically execute when certain business, process, or technology conditions are met in an unattended or attended manner.

    IA is applicable in use cases beyond traditional business processes, such as automated testing, quality control, audit, website scraping, integration platform, customer service, and data transfer.

    Risks

    • Data Quality & Bias
    • Ethics
    • Recovery & Security
    • Management

    The accuracy and relevance of the decisions IA makes are dependent on the overall quality of the data
    used to train it.

    Some decisions can have significant reputational, moral, and ethical impacts if made incorrectly.
    The question is whether it is appropriate for a non-human to make that decision.

    IA is composed of technologies that can be compromised or fail. Without the proper monitoring, controls,
    and recovery protocols, impacted IA will generate significant business and IT costs and can potentially harm customers, employees, and the organization.

    Low- and no-code capabilities ease and streamline IA development, which makes it susceptible to becoming unmanageable. Discipline is needed to ensure IA owners are aware of the size and health of the IA portfolio.

    Address your pressure points to fully realize the benefits of this priority

    Success can be dependent on your ability to address your pressure points.

    Attracting and Retaining Talent

    Be transparent and support role changes.

    Plan to address the human sentiment with automation (e.g. job security) and the transition of the role to other activities.

    Maximizing the Return on Technology

    Automate applications across multiple business functions.

    Recognize the value opportunities of improving and automating the integration of cross-functional processes.

    Confidently Shifting to Digital

    Maximize the learning of automation fit.

    Select the right capabilities to demonstrate the value of IA while using lessons learned to establish the appropriate support.

    Addressing Competing Priorities

    Recognize automation opportunities with capability maps.

    Use a capability diagram to align strategic IA objectives with tactical and technical IA initiatives.

    Fostering a Collaborative Culture

    Involve the user in the delivery process.

    Maximize automation adoption by ensuring the user finds value in its use before deployment.

    Creating High-Throughput Teams

    Remove manual, error-prone, and mundane tasks.

    Look for ways to improve team throughput by removing wasteful activities, enforcing quality, and automating away tasks driving down productivity.

    Recommendations

    Build your business process automation playbook and practice

    Formalize your business process automation practice with a good toolkit and a repeatable set of tactics and techniques.

    • Clarify the problem being solved with IA.
    • Optimate your processes. Apply good practices to first optimize (opti-) and then automate (-mate) key business processes.
    • Deliver minimum viable automations (MVAs). Maximize the learning of automation solutions and business operational changes through small, strategic automation use cases.

    Related Research:

    Explore the various IA tooling options

    Each IA tool will address a different problem. Which tool to choose is dependent on a variety of factors, such as functional suitability, technology suitability, delivery and support capabilities, alignment to strategic business goals, and the value it is designed to deliver.

    Related Research:

    Recommendations

    Introduce AI and ML thoughtfully and with a plan

    Despite the many promises of AI, organizations are struggling to fully realize its potential. The reasons boil down to a lack of understanding of when these technologies should and shouldn't be used, as well as a fear of the unknown. The plan to adopt AI should include:

    • Understanding of what AI really means in practice.
    • Identifying specific applications of AI in the business.
    • Understanding the type of AI applicable for the situation.

    Related Research:

    Mitigate AI and ML bias

    Biases can be introduced into an IA system at any stage of the development process, from the data you collect, to the way you collect it, to which algorithms are used and what assumptions were made. In most cases, AI and ML bias is a is a social, political, and business problem.

    While bias may not be intentional nor completely prevented or eliminated, early detection, good design, and other proactive preventative steps can be taken to minimize its scope and impact.

    Related Research:

    CASE STUDY
    University Hospitals

    Challenge

    University Hospitals Cleveland (UH) faces the same challenge that every major hospital confronts regarding how to deliver increasingly complex, high-quality healthcare to a diverse population efficiently and economically. In 2017, UH embarked on a value improvement program aiming to improve quality while saving $400 million over a five-year period.

    In emergency department (ED) and inpatient units, leaders found anticipating demand difficult, and consequently units were often over-staffed when demand was low and under-staffed when demand was high. Hospital leaders were uncertain about how to reallocate resources based on capacity needs.

    Solution

    UH turned to Hospital IQ's Census Solution to proactively manage capacity, staff, and flow in the ED and inpatient areas.

    By applying AI, ML, and external data (e.g. weather forecasts) to the hospital's own data (including EMR data and hospital policies), the solution helped UH make two-day census forecasts that managers used to determine whether to open or close in-patient beds and, when necessary, divert low-acuity patients to other hospitals in the system to handle predicted patient volume.

    Source: University Hospitals

    Results

    ED boarding hours have declined by 10% and the hospital has seen a 50% reduction in the number of patients who leave the hospital without
    being seen.

    UH also predicts in advance patients ready for discharge and identifies roadblocks, reducing the average length of stay by 15%. UH is able to better manage staff, reducing overtime and cutting overall labor costs.

    The hospital has also increased staff satisfaction and improved patient safety by closing specific units on weekends and increasing the number of rooms that can be sterilized.

    Proactive Application Management

    PRIORITY 3

    • Strengthen Applications to Prevent and Minimize the Impact of Future Issues

    Application management is often viewed as a support function rather than an enabler of business growth. Focus and investments are only placed on application management when it becomes a problem. The lack of governance and practice accountability leaves this practice in a chaotic state: politics take over, resources are not strategically allocated, and customers are frustrated. As a result, application management is often reactive and brushed aside for new development.

    Introduction

    What is application management?

    Application management ensures valuable software is successfully delivered and is maintained for continuous and sustainable business operations. It contains a repeatable set of activities needed to rationalize and roadmap products and services while balancing priorities of new features and maintenance tasks.

    Unfortunately, application management is commonly perceived as a practice that solely addresses issues, updates, and incidents. However, application management teams are also tasked with new value delivery that was not part of the original release.

    Why is an effective application maintenance (reactive) practice not good enough?

    Application maintenance is the "process of modifying a software system or its components after delivery to correct faults, improve performance or other attributes, or adapt to a changed environment or business process," (IEEE, 1998). While it is critical to quickly fix defects and issues when they occur, reactively addressing them is more expensive than discovering them early and employing the practices to prevent them.

    Even if an application is working well, its framework, architecture, and technology may not be compatible with the possible upcoming changes stakeholders and vendors may want to undertake. Applications may not be problems now, but they soon can be.

    What motivates proactive application changes?

    This image shows the motivations for proactive application changes, sorted by external and internal sources.

    Proactive application management must be disciplined and applied strategically

    Proactive application management practices are critical to maintaining business continuity. They require continuous review and modification so that applications are resilient and can address current and future scenarios. Depending on the value of the application, its criticality to business operations, and its susceptibility to technology change, a more proactive management approach may be warranted. Stakeholders can then better manage resources and budget according to the needs of specific products.

    Reactive Management

    Run-to-Failure

    Fix and enhance the product when it breaks. In most cases, a plan is in place ahead of a failure, so that the problem can be addressed without significant disruption and costs.

    Preventive

    Regularly inspect and optimize the product to reduce the likelihood that it will fail in the future. Schedule inspections based on a specific timeframe or usage threshold.

    Predictive

    Predict failures before they happen using performance and usage data to alert teams when products are at risk of failure according to specified conditions.

    Reliability and Risk Based

    Analyze all possible failure scenarios for each component of the product and create tailored delivery plans to improve the stability, reliability, and value of each product.

    Proactive Management

    Signals

    Applications begin to degrade as soon as they are used

    Today's applications are tomorrow's shelfware. They gradually lose their value, stability, robustness, and compatibility with other enterprise technologies. The longer these applications are left unattended or simply "keeping the lights on," the more risks they will bring to the application portfolio, such as:

    • Discovery and exploitation of security flaws and gaps.
    • Increasing the lock-in to specific vendor technologies.
    • Inconsistent application performance across various workloads.

    These impacts are further compounded by the continuous work done on a system burdened with technical debt. Technical debt describes the result of avoided costs that, over time, cause ongoing business impacts. Left unaddressed, technical debt can become an existential threat that risks your organization's ability to effectively compete and serve its customers. Unfortunately, most organizations have a significant, growing, unmanageable technical debt portfolio.

    A circle graph is shown with 60% of the circle coloured in dark green, with the number 60% in the centre.

    of respondents stated they saw an increase in perceived change in technical debt during the past three years. A quarter of respondents indicated that it stayed the same.

    Source: McKinsey Digital, 2020.

    US
    $4.35
    Million

    is the average cost of a data breach in 2022. This figure represents a 2.6% increase from last year. The average cost has climbed 12.7% since 2020.

    Source: IBM, 2022; N=537.

    Drivers

    Technical debt

    Historical decisions to meet business demands by deferring key quality, architectural, or other software delivery activities often lead to inefficient and incomplete code, fragile legacy systems, broken processes, data quality problems, and the other contributors to technical debt. The impacts for this challenge is further heightened if organizations are not actively refactoring and updating their applications behind the scenes. Proactive application management is intended to raise awareness of application fragility and prioritize comprehensive refactoring activities alongside new feature development.

    Long-term application value

    Applications are designed, developed, and tested against a specific set of parameters which may become less relevant over time as the business matures, technology changes, and user behaviors and interactions shift. Continuous monitoring of the application system, regular stakeholder and user feedback, and active technology trend research and vendor engagement will reveal tasks to prepare an application for future value opportunities or stability and resilience concerns.

    Security and resiliency

    Innovative approaches to infiltrating and compromising applications are becoming prevailing stakeholder concerns. The loopholes and gaps in existing application security protocols, control points, and end-user training are exploited to gain the trust of unsuspecting users and systems. Proactive application management enforces continuous security reviews to determine whether applications are at risk. The goal is to prevent an incident from happening by hardening or complementing measures already in place.

    Benefits & Risks

    Benefits

    • Consistent Performance
    • Robustness
    • Operating Costs

    Users expect the same level of performance and experience from their applications in all scenarios. A proactive approach ensures the configurations meet the current needs of users and dependent technologies.

    Proactively managed applications are resilient to the latest security concerns and upcoming trends.

    Continuous improvements to the underlying architecture, codebase, and interfaces can minimize the cost to maintain and operate the application, such as the transition to a loosely coupled architecture and the standardization of REST APIs.

    Risks

    • Stakeholder Buy-In
    • Delayed Feature Releases
    • Team Capacity
    • Discipline

    Stakeholders may not see the association between the application's value and its technical quality.

    Updates and enhancements are system changes much like any application function. Depending
    on the priority of these changes, new functions may be pushed off to a future release cycle.

    Applications teams require dedicated capacity to proactively manage applications, but they are often occupied meeting other stakeholder demands.

    Overinvesting in certain application management activities (such as refactoring, re-architecture, and redesign) can create more challenges. Knowing how much to do is important.

    Address your pressure points to fully realize the benefits of this priority

    Success can be dependent on your ability to address your pressure points.

    Attracting and Retaining Talent

    Shift focus from maintenance to innovation.

    Work on the most pressing and critical requests first, with a prioritization framework reflecting cross-functional priorities.

    Maximizing the Return on Technology

    Improve the reliability of mission-critical applications.

    Regularly verify and validate applications are up to date with the latest patches and fixes and comply with industry good practices and regulations.

    Confidently Shifting to Digital

    Prepare applications to support digital tools and technologies.

    Focus enhancements on the key components required to support the integration, performance, and security needs of digital.

    Addressing Competing Priorities

    Rationalize the health of the applications.

    Use data-driven, compelling insights to justify the direction and prioritization of applications initiatives.

    Fostering a Collaborative Culture

    Include the technical perspective in the viability of future applications plans.

    Demonstrate how poorly maintained applications impede the team's ability to deliver confidently and quickly.

    Creating High-Throughput Teams

    Simplify applications to ease delivery and maintenance.

    Refactor away application complexities and align the application portfolio to a common quality standard to reduce the effort to deliver and test changes.

    Recommendations

    Reinforce your application maintenance practice

    Maintenance is often viewed as a support function rather than an enabler of business growth. Focus and investments are only placed on maintenance when it becomes a problem.

    • Justify the necessity of streamlined maintenance.
    • Strengthen triaging and prioritization practices.
    • Establish and govern a repeatable process.

    Ensure product issues, incidents, defects, and change requests are promptly handled to minimize business and IT risks.

    Related Research:

    Build an application management practice

    Apply the appropriate management approaches to maintain business continuity and balance priorities and commitments among maintenance and new development requests.

    This practice serves as the foundation for creating exceptional customer experience by emphasizing cross-functional accountability for business value and product and service quality.

    Related Research:

    Recommendations

    Manage your technical debt

    Technical debt is a type of technical risk, which in turn is business risk. It's up to the business to decide whether to accept technical debt or mitigate it. Create a compelling argument to stakeholders as to why technical debt should be a business priority rather than just an IT one.

    • Define and identify your technical debt.
    • Conduct a business impact analysis.
    • Identify opportunities to better manage technical debt.

    Related Research:

    Gauge your application's health

    Application portfolio management is nearly impossible to perform without an honest and thorough understanding of your portfolio's alignment to business capabilities, business value, total cost of ownership, end-user reception and satisfaction, and technical health.

    Develop data-driven insights to help you decide which applications to retire, upgrade, retrain on, or maintain to meet the demands of the business.

    Related Research:

    Recommendations

    Adopt site reliability engineering (SRE) and DevOps practices

    Site reliability engineering (SRE) is an operational model for running online services more reliably by a team of dedicated reliability-focused engineers.

    DevOps, an operational philosophy promoting development and operations collaboration, can bring the critical insights to make application management practices through SRE more valuable.

    Related Research:

    CASE STUDY
    Government Agency

    Goal

    A government agency needed to implement a disciplined, sustainable application delivery, planning, and management process so their product delivery team could deliver features and changes faster with higher quality. The goal was to ensure change requests, fixes, and new features would relieve requester frustrations, reduce regression issues, and allow work to be done on agreeable and achievable priorities organization-wide. The new model needed to increase practice efficiency and visibility in order to better manage technical debt and focus on value-added solutions.

    Solution

    This organization recognized a number of key challenges that were inhibiting its team's ability to meet its goals:

    • The product backlog had become too long and unmanageable.
    • Delivery resources were not properly allocated to meet the skills and capabilities needed to successfully meet commitments.
    • Quality wasn't defined or enforced, which generated mounting technical debt.
    • There was a lack of clear metrics and defined roles and responsibilities.
    • The business had unrealistic and unachievable expectations.

    Source: Info-Tech Workshop

    Key practices implemented

    • Schedule quarterly business satisfaction surveys.
    • Structure and facilitate regular change advisory board meetings.
    • Define and enforce product quality standards.
    • Standardize a streamlined process with defined roles.
    • Configure management tools to better handle requests.

    Multisource Systems

    PRIORITY 4

    • Manage an Ecosystem Composed of In-House and Outsourced Systems

    Various market and company factors are motivating a review on resource and system sourcing strategies. The right sourcing model provides key skills, resources, and capabilities to meet innovation, time to market, financial, and quality goals of the business. However, organizations struggle with how best to support sourcing partners and to allocate the right number of resources to maximize success.

    Introduction

    A multisource system is an ecosystem of integrated internally and externally developed applications, data, and infrastructure. These technologies can be custom developed, heavily configured vendor solutions, or they may be commercial off-the-shelf (COTS) solutions. These systems can also be developed, supported, and managed by internal staff, in partnership with outsourced contractors, or be completely outsourced. Multisource systems should be configured and orchestrated in a way that maximizes the delivery of specific value drivers for the targeted audience.

    Successfully selecting a sourcing approach is not a simple RFP exercise to choose the lowest cost

    Defining and executing a sourcing approach can be a significant investment and risk because of the close interactions third-party services and partners will have with internal staff, enterprise applications and business capabilities. A careful selection and design is necessary.

    The selection of a sourcing partner is not simple. It involves the detailed inspection and examination of different candidates and matching their fit to the broader vision of the multisource system. In cases where control is critical, technology stack and resource sourcing consolidation to a few vendors and partners is preferred. In other cases, where worker productivity and system flexibility are highly prioritized, a plug-and-play best-of-breed approach is preferred.

    Typical factors involved in sourcing decisions.

    Sourcing needs to be driven by your department and system strategies

    How does the department want to be perceived?

    The image that your applications department and teams want to reflect is frequently dependent on the applications they deliver and support, the resources they are composed of, and the capabilities they provide.

    Therefore, choosing the right sourcing approach should be driven by understanding who the teams are and want to be (e.g. internal builder, an integrator, a plug-in player), what they can or want to do (e.g. custom-develop or implement), and what they can deliver or support (e.g. cloud or on-premises) must be established.

    What value is the system delivering?

    Well-integrated systems are the lifeblood of your organization. They provide the capabilities needed to deliver value to customers, employees, and stakeholders. However, underlying system components may not be sourced under a unified strategy, which can lead to duplicate vendor services and high operational costs.

    The right sourcing approach ensures your partners address key capabilities in your system's delivery and support, and that they are positioned to maximize the value of critical and high-impact components.

    Signals

    Business demand may outpace what vendors can support or offer

    Outsourcing and shifting to a buy-over-build applications strategy are common quick fixes to dealing with capacity and skills gaps. However, these quick fixes often become long-term implementations that are not accounted for in the sourcing selection process. Current application and resource sourcing strategies must be reviewed to ensure that vendor arrangements meet the current and upcoming demands and challenges of the business, customers, and enterprise technologies, such as:

    • Pressure from stakeholders to lower operating costs while maintaining or increasing quality and throughput.
    • Technology lock-in that addresses short-term needs but inhibits long-term growth and maturity.
    • Team capacity and talent acquisition not meeting the needs of the business.
    A circle graph is shown with 42% of the circle coloured in dark brown, with the number 42% in the centre.

    of respondents stated they outsourced software development fully or partly in the last 12 months (2021).

    Source: Coding Sans, 2021.

    A circle graph is shown with 65% of the circle coloured in dark brown, with the number 65% in the centre.

    of respondents stated they were at least somewhat satisfied with the result of outsourcing software development.

    Source: Coding Sans, 2021.

    Drivers

    Business-managed applications

    Employees are implementing and building applications without consulting, notifying, or heeding the advice of IT. IT is often ill-equipped and under-resourced to fight against shadow IT. Instead, organizations are shifting the mindset of "fight shadow IT" to "embrace business-managed applications," using good practices in managing multisource systems. A multisource approach strikes the right balance between user empowerment and centralized control with the solutions and architecture that can best enable it.

    Unique problems to solve

    Point solutions offer features to address unique use cases in uncommon technology environments. However, point solutions are often deployed in siloes with limited integration or overlap with other solutions. The right sourcing strategy accommodates the fragmented nature of point solutions into a broader enterprise system strategy, whether that be:

    • Multisource best of breed – integrate various technologies that provide subsets of the features needed for supporting business functions.
    • Multisource custom – integrate systems built in-house with technologies developed by external organizations.
    • Vendor add-ons and integrations – enhance an existing vendor's offering by using their system add-ons as upgrades, new add-ons, or integrations.

    Vendor services

    Some vendor services in a multisource environment may be redundant, conflicting, or incompatible. Given that multisource systems are regularly changing, it is difficult to identify what services are affected, what would be needed to fill the gap of the removed solution, or which redundant services should be removed.

    A multisource approach motivates the continuous rationalization of your vendor services and partners to determine the right mixture of in-house and outsourced resources, capabilities, and technologies.

    Benefits & Risks

    Benefits

    • Business-Focused Solution
    • Flexibility
    • Cost Optimization

    Multisource systems can be designed to support an employee's ability to select the tools they want and need.

    The environment is architected in a loosely coupled approach to allow applications to be easily added, removed, and modified with minimized impact to other integrated applications.

    Rather than investing in large solutions upfront, applications are adopted when they are needed and are removed when little value is gained. Disciplined application portfolio management is necessary to see the full value of this benefit.

    Risks

    • Manageable Sprawl
    • Policy Adherence
    • Integration & Compatibility

    The increased number and diversity of applications in multisource system environments can overwhelm system managers who do not have an effective application portfolio management practice.

    Fragmented application implementations risk inconsistent adherence to security and other quality policies, especially in situations where IT is not involved.

    Application integration can quickly become tangled, untraceable, and unmanageable because of varying team and vendor preferences for specific integration technologies and techniques.

    Address your pressure points to fully realize the benefits of this priority

    Success can be dependent on your ability to address your pressure points.

    Attracting and Retaining Talent

    Enable business-managed applications.

    Create the integrations to enable the easy connection of desired tools to enterprise systems with the appropriate guardrails.

    Maximizing the Return on Technology

    Enhance the functionality of existing applications.

    Complement current application capability gaps with data, features, and services from third-party applications.

    Confidently Shifting to Digital

    Use best-of-breed tools to meet specific digital needs.

    Select the best tools to meet the unique and special functional needs of the digital vision.

    Addressing Competing Priorities

    Agree on a common philosophy on system composition.

    Establish an owner of the multisource system to guide how the system should mature as the organization grows.

    Fostering a Collaborative Culture

    Discuss how applications can work together better in an ecosystem.

    Build committees to discuss how applications can better support each other and drive more value.

    Creating High-Throughput Teams

    Alleviate delivery bottlenecks and issues.

    Leverage third-party sources to fill skills and capacity gaps until a long-term solution can be implemented.

    Recommendations

    Define the goals of your applications department and product vision

    Understanding the applications team's purpose and image is critical in determining how the system they are managing and the skills and capacities they need should be sourced.

    Changing and conflicting definitions of value and goals make it challenging to convey an agreeable strategy of the multisource system. An achievable vision and practical tactics ensure all parties in the multisource system are moving in the same direction.

    Related Research:

    Develop a sourcing partner strategy

    Almost half of all sourcing initiatives do not realize projected savings, and the biggest reason is the choice of partner (Zhang et al., 2018). Making the wrong choice means inferior products, higher costs and the loss of both clients and reputation.

    Choosing the right sourcing partner involves understanding current skills and capacities, finding the right matching partner based on a desired profile, and managing a good working relationship that sees short-term gains and supports long-term goals.

    Related Research:

    Recommendations

    Strengthen enterprise integration practices

    Integration strategies that are focused solely on technology are likely to complicate rather than simplify because little consideration is given on how other systems and processes will be impacted. Enterprise integration needs to bring together business process, applications, and data – in that order.

    Kick-start the process of identifying opportunities for improvement by mapping how applications and data are coordinated to support business activities.

    Related Research:

    Manage your solution architecture and application portfolio

    Haphazardly implementing and integrating applications can generate significant security, performance, and data risks. A well-thought-through solution architecture is essential in laying the architecture quality principles and roadmap on how the multisource system can grow and evolve in a sustainable and maintainable way.

    Good application portfolio management complements the solution architecture as it indicates when low-value and unused applications should be removed to reduce system complexity.

    Related Research:

    Recommendations

    Embrace business-managed applications

    Multisource systems bring a unique opportunity to support the business and end users' desire to implement and develop their own applications. However, traditional models of managing applications may not accommodate the specific IT governance and management practices required to operate business-managed applications:

    • A collaborative and trusting business-IT relationship is key.
    • The role of IT must be reimagined.
    • Business must be accountable for its decisions.

    Related Research:

    CASE STUDY
    Cognizant

    Situation

    • Strives to be primarily an industry-aligned organization that delivers multiple service lines in multiple geographies.
    • Cognizant seeks to carefully consider client culture to create a one-team environment.
    • Value proposition is a consultative approach bringing thought leadership and mutually adding value to the relationship vs. the more traditional order-taker development partner.
    • Wants to share in solution development to facilitate shared successes. Geographic alignment drives knowledge of the client and their challenges, not just about time zone and supportability.
    • Offers one of the largest offshore capabilities in the world, supported by local and nearshore resources to drive local knowledge.
    • Today's clients don't typically want a black box, they are sophisticated and want transparency around the process and solution, to have a partner.
    • Clients do want to know where the work is being delivered from, how it's being done.

    Source: interview with Jay MacIsaac, Cognizant.

    Approach

    • Best relationship comes where teams operate as one.
    • Clients are seeking value, not a development black box.
    • Clients want to have a partner they can engage with, not just an order taker.
    • Want to build a one-team culture with shared goals and deliver business value.
    • Seek a partner that will add to their thinking not echo it.

    Results

    • Cognizant is continuing to deliver double-digit growth and continues to strive for top quartile performance.
    • Growth in the client base has seen the company grow to over 340,000 associates worldwide.

    Digital Organization as a Platform

    PRIORITY 5

    • Create a Common Digital Interface to Access All Products and Services

    A digital platform enables organizations to leverage a flexible, reliable, and scalable foundation to create a valuable DX, ease delivery and management efforts, maximize existing investments, and motivate the broader shift to digital. This approach provides a standard to architect, integrate, configure, and modernize the applications that compose the platform.

    Introduction

    What is digital organization as a platform (DOaaP)?

    Digital organization as a platform (DOaaP) is a collection of integrated digital services, products, applications, and infrastructure that is used as a vehicle to meet and exceed an organization's digital strategies. It often serves as an accessible "place for exchanges of information, goods, or services to occur between producers and consumers as well as the community that interacts
    with said platform" (Watts, 2020).

    DOaaP involves a strategy that paves the way for organizations to be digital. It helps organizations use their assets (e.g. data, processes, products, services) in the most effective ways and become more open to cooperative delivery, usage, and management. This opens opportunities for innovation and cross-department collaborations.

    How is DOaaP described?

    1. Open and Collaborative
      • Open organization: open data, open APIs, transparency, and user participation.
      • Collaboration, co-creation, crowdsourcing, and innovation
    2. Accessible and Connected
      • Digital inclusion
      • Channel ubiquity
      • Integrity and interoperability
      • Digital marketplace
    3. Digital and Programmable
      • Digital identity
      • Policies and processes as code
      • Digital products and services
      • Enabling digital platforms

    Digital organizations follow a common set of principles and practices

    Customer-centricity

    Digital organizations are driven by customer focus, meeting and exceeding customer expectations. It must design its services with a "digital first" principle, providing access through every expected channel and including seamless integration and interoperability with various departments, partners, and third-party services. It also means creating trust in its ability to provide secure services and to keep privacy and ethics as core pillars.

    Leadership, management, and strategies

    Digital leadership brings customer focus to the enterprise and its structures and organizes efficient networks and ecosystems. Accomplishing this means getting rid of silos and a siloed mentality and aligning on a digital vision to design policies and services that are efficient, cost-effective, and provide maximum benefit to the user. Asset sharing, co-creation, and being open and transparent become cornerstones of a digital organization.

    Infrastructure

    Providing digital services across demographics and geographies requires infrastructure, and that in turn requires long-term vision, smart investments, and partnerships with various source partners to create the necessary foundational infrastructure upon which to build digital services.

    Digitization and automation

    Automation and digitization of processes and services, as well as creating digital-first products, lead to increased efficiency and reach of the organization across demographics and geographies. Moreover, by taking a digital-first approach, digital organizations future-proof their services and demonstrate their commitment to stakeholders.

    Enabling platforms

    DOaaP embraces open standards, designing and developing organizational platforms and ecosystems with a cloud-first mindset and sound API strategies. Developer experience must also take center stage, providing the necessary tools and embracing Agile and DevOps practices and culture become prerequisites. Cybersecurity and privacy are central to the digital platform; hence they must be part of the design and development principles and practices.

    Signals

    The business expects support for digital products and services

    Digital transformation continues to be a high-priority initiative for many organizations, and they see DOaaP as an effective way to enable and exploit digital capabilities. However, DOaaP unleashes new strategies, opportunities, and challenges that are elusive or unfamiliar to business leaders. Barriers in current business operating models may limit DOaaP success, such as:

    • Department and functional silos
    • Dispersed, fragmented and poor-quality data
    • Ill-equipped and under-skilled resources to support DOaaP adoption
    • System fragmentation and redundancies
    • Inconsistent integration tactics employed across systems
    • Disjointed user experience leading to low engagement and adoption

    DOaaP is not just about technology, and it is not the sole responsibility of either IT or business. It is the collective responsibility of the organization.

    A circle graph is shown with 47% of the circle coloured in dark blue, with the number 47% in the centre.

    of organizations plan to unlock new value through digital. 50% of organizations are planning major transformation over the next three years.

    Source: Nash Squared, 2022.

    A circle graph is shown with 70% of the circle coloured in dark blue, with the number 70% in the centre.

    of organizations are undertaking digital expansion projects focused on scaling their business with technology. This result is up from 57% in 2021.

    Source: F5 Inc, 2022.

    Drivers

    Unified brand and experience

    Users should have the same experience and perception of a brand no matter what product or service they use. However, fragmented implementation of digital technologies and inconsistent application of design standards makes it difficult to meet this expectation. DOaaP embraces a single design and DX standard for all digital products and services, which creates a consistent perception of your organization's brand and reputation irrespective of what products and services are being used and how they are accessed.

    Accessibility

    Rapid advancement of end-user devices and changes to end-user behaviors and expectations often outpace an organization's ability to meet these requirements. This can make certain organization products and services difficult to find, access and leverage. DOaaP creates an intuitive and searchable interface to all products and services and enables the strategic combination of technologies to collectively deliver more value.

    Justification for modernization

    Many opportunities are left off the table when legacy systems are abstracted away rather than modernized. However, legacy systems may not justify the investment in modernization because their individual value is outweighed by the cost. A DOaaP initiative motivates decision makers to look at the entire system (i.e. modern and legacy) to determine which components need to be brought up to a minimum digital state. The conversation has now changed. Legacy systems should be modernized to increase the collective benefit of the entire DOaaP.

    Benefits & Risks

    Benefits

    • Look & Feel
    • User Adoption
    • Shift to Digital

    A single, modern, customizable interface enables a common look and feel no matter what and how the platform is being accessed.

    Organizations can motivate and encourage the adoption and use of all products and services through the platform and increase the adoption of underused technologies.

    DOaaP motivates and supports the modernization of data, processes, and systems to meet the goals and objectives outlined in the broader digital transformation strategy.

    Risks

    • Data Quality
    • System Stability
    • Ability to Modernize
    • Business Model Change

    Each system may have a different definition of commonly used entities (e.g. customer), which can cause data quality issues when information is shared among these systems.

    DOaaP can stress the performance of underlying systems due to the limitations of some systems to handle increased traffic.

    Some systems cannot be modernized due to cost constraints, business continuity risks, vendor lock-in, legacy and lore, or other blocking factors.

    Limited appetite to make the necessary changes to business operations in order to maximize the value of DOaaP technologies.

    Address your pressure points to fully realize the benefits of this priority

    Success can be dependent on your ability to address your pressure points.

    Attracting and Retaining Talent Promote and showcase achievements and successes. Share the valuable and innovative work of your teams across the organization and with the public.
    Maximizing the Return on Technology Increase visibility of underused applications. Promote the adoption and use of all products and services through the platform and use the lessons learned to justify removal, updates or modernizations.
    Confidently Shifting to Digital Bring all applications up to a common digital standard. Define the baseline digital state all applications, data, and processes must be in to maximize the value of the platform.
    Addressing Competing Priorities Map to a holistic platform vision, goals and objectives. Work with relevant stakeholders, teams and end users to agree on a common directive considering all impacted perspectives.
    Fostering a Collaborative Culture Ensure the platform is configured to meet the individual needs of the users. Tailor the interface and capabilities of the platform to address users' functional and personal concerns.
    Creating High-Throughput Teams Abstract the enterprise system to expedite delivery. Use the platform to standardize application system access to simplify platform changes and quicken development and testing.

    Recommendations

    Define your platform vision

    Organizations realize that a digital model is the way to provide more effective services to their customers and end users in a cost-effective, innovative, and engaging fashion. DOaaP is a way to help support this transition.

    However, various platform stakeholders will have different interpretations of and preferences for what this platform is intended to solve, what benefits it is supposed to deliver, and what capabilities it will deliver. A grounded vision is imperative to steer the roadmap and initiatives.

    Related Research:

    Assess and modernize your applications

    Certain applications may not sufficiently support the compatibility, flexibility, and efficiency requirements of DOaaP. While workaround technologies and tactics can be employed to overcome these application challenges, the full value of the DOaaP may not be realized.

    Reviewing the current state of the application portfolio will indicate the functional and value limitations of what DOaaP can provide and an indication of the scope of investment needed to bring applications up to a minimum state.

    Related Research:

    Recommendations

    Understand and evaluate end-user needs

    Technology has reached a point where it's no longer difficult for teams to build functional and valuable digital platforms. Rather, the difficulty lies in creating an interface and platform that people want to use and use frequently.

    While it is important to increase the access and promotion of all products and services, orchestrating and configuring them in a way to deliver a satisfying experience is even more important. Applications teams must first learn about and empathize with the needs of end users.

    Related Research:

    Architect your platform

    Formalizing and constructing DOaaP just for the sake of doing so often results in an initiative that is lengthy and costly and ends up being considered a failure.

    The build and optimization of the platform must be predicated on a thorough understanding of the DOaaP's goals, objectives, and priorities and the business capabilities and process they are meant to support and enable. The appropriate architecture and delivery practices can then be defined and employed.

    Related Research:

    CASE STUDY
    e-Estonia

    Situation

    The digital strategy of Estonia resulted in e-Estonia, with the vision of "creating a society with more transparency, trust, and efficiency." Estonia has addressed the challenge by creating structures, organizations, and a culture of innovation, and then using the speed and efficiency of digital infrastructure, apps, and services. This strategy can reduce or eliminate bureaucracy through transparency and automation.

    Estonia embarked on its journey to making digital a priority in 1994-1996, focusing on a committed investment in infrastructure and digital literacy. With that infrastructure in place, they started providing digital services like an e-banking service (1996), e-tax and mobile parking (2002), and then went full steam ahead with a digital information interoperability platform in 2001, digital identity in 2002, e-health in 2008, and e-prescription in 2010. The government is now strategizing for AI.

    Results

    This image contains the results of the e-Estonia case study results

    Source: e-Estonia

    Practices employed

    The e-Estonia digital government model serves as a reference for governments across the world; this is acknowledged by the various awards it has received, like #2 in "internet freedom," awarded by Freedom House in 2019; #1 on the "digital health index," awarded by the Bertelsmann Foundation in 2019; and #1 on "start-up friendliness," awarded by Index Venture in 2018.

    References

    "15th State of Agile Report." Digital.ai, 2021. Web.
    "2022 HR Trends Report." McLean & Company, 2022.
    "2022: State of Application Strategy Report." F5 Inc, 2022.
    "Are Executives Wearing Rose-Colored Glasses Around Digital Transformation?" Cyara, 2021. Web.
    "Cost of a Data Breach Report 2022." IBM, 2022. Web.
    Dalal, Vishal, et al. "Tech Debt: Reclaiming Tech Equity." McKinsey Digital, Oct. 2020. Web.
    "Differentiating Between Intelligent Automation and Hyperautomation." IBM, 15 October 2021. Web.
    "Digital Leadership Report 2021." Harvey Nash Group, 2021.
    "Digital Leadership Report 2022: The State of Digital." Nash Squared, 2022. Web.
    Gupta, Sunil. "Driving Digital Strategy: A Guide to Reimagining Your Business." Harvard Business Review Press, 2018. Web.
    Haff, Gordon. "State of Application Modernization Report 2022." Konveyor, 2022. Web.
    "IEEE Standard for Software Maintenance: IEEE Std 1219-1998." IEEE Standard for Software Maintenance, 1998. Accessed Dec. 2015.
    "Intelligent Automation." Cognizant, n.d. Web.
    "Kofax 2022: Intelligent Automation Benchmark Study". Kofax, 2021. Web.
    McCann, Leah. "Barco's Virtual Classroom at UCL: A Case Study for the Future of All University Classrooms?" rAVe, 2 July 2020, Web.
    "Proactive Staffing and Patient Prioritization to Decompress ED and Reduce Length of Stay." University Hospitals, 2018. Web.
    "Secrets of Successful Modernization." looksoftware, 2013. Web.
    "State of Software Development." Coding Sans, 2021. Web.
    "The State of Low-Code/No-Code." Creatio, 2021. Web.
    "We Have Built a Digital Society and We Can Show You How." e-Estonia. n.d. Web.
    Zanna. "The 5 Types of Experience Series (1): Brand Experience Is Your Compass." Accelerate in Experience, 9 February 2020. Web.
    Zhang, Y. et al. "Effects of Risks on the Performance of Business Process Outsourcing Projects: The Moderating Roles of Knowledge Management Capabilities." International Journal of Project Management, 2018, vol. 36 no. 4, 627-639.

    Research Contributors and Experts

    This is a picture of Chris Harrington

    Chris Harrington
    Chief Technology Officer
    Carolinas Telco Federal Credit Union

    Chris Harrington is Chief Technology Officer (CTO) of Carolinas Telco Federal Credit Union. Harrington is a proven leader with over 20 years of experience developing and leading information technology and cybersecurity strategies and teams in the financial industry space.

    This is a picture of Benjamin Palacio

    Benjamin Palacio
    Senior Information Technology Analyst County of Placer

    Benjamin Palacio has been working in the application development space since 2007 with a strong focus on system integrations. He has seamlessly integrated applications data across multiple states into a single reporting solution for management teams to evaluate, and he has codeveloped applications to manage billions in federal funding. He is also a CSAC-credentialed IT Executive (CA, USA).

    This is a picture of Scott Rutherford

    Scott Rutherford
    Executive Vice President, Technology
    LGM Financial Services Inc.

    Scott heads the Technology division of LGM Financial Services Inc., a leading provider of warranty and financing products to automotive OEMs and dealerships in Canada. His responsibilities include strategy and execution of data and analytics, applications, and technology operations.

    This is a picture of Robert Willatts

    Robert Willatts
    IT Manager, Enterprise Business Solutions and Project Services
    Town of Newmarket

    Robert is passionate about technology, innovation, and Smart City Initiatives. He makes customer satisfaction as the top priority in every one of his responsibilities and accountabilities as an IT manager, such as developing business applications, implementing and maintaining enterprise applications, and implementing technical solutions. Robert encourages communication, collaboration, and engagement as he leads and guides IT in the Town of Newmarket.

    This is a picture of Randeep Grewal

    Randeep Grewal
    Vice President, Enterprise Applications
    Red Hat

    Randeep has over 25 years of experience in enterprise applications, advanced analytics, enterprise data management, and consulting services, having worked at numerous blue-chip companies. In his most recent role, he is the Vice President of Enterprise Applications at Red Hat. Reporting to the CIO, he is responsible for Red Hat's core business applications with a focus on enterprise transformation, application architecture, engineering, and operational excellence. He previously led the evolution of Red Hat into a data-led company by maturing the enterprise data and analytics function to include data lake, streaming data, data governance, and operationalization of analytics for decision support.

    Prior to Red Hat, Randeep was the director of global services strategy at Lenovo, where he led the strategy using market data to grow Lenovo's services business by over $400 million in three years. Prior to Lenovo, Randeep was the director of advanced analytics at Alliance One and helped build an enterprise data and analytics function. His earlier work includes seven years at SAS, helping SAS become a leader in business analytics, and at KPMG consulting, where he managed services engagements at Fortune 100 companies.

    Standardize the Service Desk

    • Buy Link or Shortcode: {j2store}477|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $24,155 Average $ Saved
    • member rating average days saved: 24 Average Days Saved
    • Parent Category Name: Service Desk
    • Parent Category Link: /service-desk
    • Not everyone embraces their role in service support. Specialists would rather work on projects than provide service support.
    • The Service Desk lacks processes and workflows to provide consistent service. Service desk managers struggle to set and meet service-level expectations, which further compromises end-user satisfaction.

    Our Advice

    Critical Insight

    • Service desk improvement is an exercise in organizational change. Engage specialists across the IT organization in building the solution. Establish a single service-support team across the IT group and enforce it with a cooperative, customer-focused culture.
    • Don’t be fooled by a tool that’s new. A new service desk tool alone won’t solve the problem. Service desk maturity improvements depend on putting in place the right people and processes to support the technology.

    Impact and Result

    • Create a consistent customer service experience for service desk patrons, and increase efficiency, first-call resolution, and end-user satisfaction with the Service Desk.
    • Decrease time and cost to resolve service desk tickets.
    • Understand and address reporting needs to address root causes and measure success and build a solid foundation for future IT service improvements.

    Standardize the Service Desk Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Standardize the Service Desk Research – A step-by-step document that helps you improve customer service by driving consistency in your support approach and meet SLAs.

    Use this blueprint to standardize your service desk by assessing your current capability and laying the foundations for your service desk, design an effective incident management workflow, design a request fulfillment process, and apply the discussions and activities to make an actionable plan for improving your service desk.

    • Standardize the Service Desk – Phases 1-4

    2. Service Desk Maturity Assessment – An assessment tool to help guide process improvement efforts and track progress.

    This tool is designed to assess your service desk process maturity, identify gaps, guide improvement efforts, and measure your progress.

    • Service Desk Maturity Assessment

    3. Service Desk Project Summary – A template to help you organize process improvement initiatives using examples.

    Use this template to organize information about the service desk challenges that the organization is facing, make the case to build a right-sized service desk to address those challenges, and outline the recommended process changes.

    • Service Desk Project Summary

    4. Service Desk Roles and Responsibilities Guide – An analysis tool to determine the right roles and build ownership.

    Use the RACI template to determine roles for your service desk initiatives and to build ownership around them. Use the template and replace it with your organization's information.

    • Service Desk Roles and Responsibilities Guide

    5. Incident Management and Service Desk Standard Operating Procedure – A template designed to help service managers kick-start the standardization of service desk processes.

    The template will help you identify service desk roles and responsibilities, build ticket management processes, put in place sustainable knowledgebase practices, document ticket prioritization scheme and SLO, and document ticket workflows.

    • Incident Management and Service Desk SOP

    6. Ticket and Call Quality Assessment Tool – An assessment tool to check in on ticket and call quality quarterly and improve the quality of service desk data.

    Use this tool to help review the quality of tickets handled by agents and discuss each technician's technical capabilities to handle tickets.

    • Ticket and Call Quality Assessment Tool

    7. Workflow Library – A repository of typical workflows.

    The Workflow Library provides examples of typical workflows that make up the bulk of the incident management and request fulfillment processes at the service desk.

    • Incident Management and Service Desk Workflows (Visio)
    • Incident Management and Service Desk Workflows (PDF)

    8. Service Desk Ticket Categorization Schemes – A repository of ticket categories.

    The Ticket Categorization Schemes provide examples of ticket categories to organize the data in the service desk tool and produce reports that help managers manage the service desk and meet business requirements.

    • Service Desk Ticket Categorization Schemes

    9. Knowledge Manager – A job description template that includes a detailed explication of the responsibilities and expectations of a Knowledge Manager role.

    The Knowledge Manager's role is to collect, synthesize, organize, and manage corporate information in support of business units across the enterprise.

    • Knowledge Manager

    10. Knowledgebase Article Template – A comprehensive record of the incident management process.

    An accurate and comprehensive record of the incident management process, including a description of the incident, any workarounds identified, the root cause (if available), and the profile of the incident's source, will improve incident resolution time.

    • Knowledgebase Article Template

    11. Sample Communication Plan – A sample template to guide your communications around the integration and implementation of your overall service desk improvement initiatives.

    Use this template to develop a communication plan that outlines what stakeholders can expect as the process improvements recommended in the Standardize the Service Desk blueprint are implemented.

    • Sample Communication Plan

    12. Service Desk Roadmap – A structured roadmap tool to help build your service desk initiatives timeline.

    The Service Desk Roadmap helps track outstanding implementation activities from your service desk standardization project. Use the roadmap tool to define service desk project tasks, their owners, priorities, and timeline.

    • Service Desk Roadmap
    [infographic]

    Workshop: Standardize the Service Desk

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Lay Service Desk Foundations

    The Purpose

    Discover your challenges and understand what roles, metrics, and ticket handling procedures are needed to tackle the challenges.

    Key Benefits Achieved

    Set a clear understanding about the importance of service desk to your organization and service desk best practices.

    Activities

    1.1 Assess current state of the service desk.

    1.2 Review service desk and shift-left strategy.

    1.3 Identify service desk metrics and reports.

    1.4 Identify ticket handling procedures

    Outputs

    Current state assessment

    Shift-left strategy and implications

    Service desk metrics and reports

    Ticket handling procedures

    2 Design Incident Management

    The Purpose

    Build workflows for incident and critical incident tickets.

    Key Benefits Achieved

    Distinguish incidents from service requests.

    Ticket categorization facilitates ticket. routing and reporting.

    Develop an SLA for your service desk team for a consistent service delivery.

    Activities

    2.1 Build incident and critical incident management workflows.

    2.2 Design ticket categorization scheme and proper ticket handling guidelines.

    2.3 Design incident escalation and prioritization guidelines.

    Outputs

    Incident and critical incident management workflows

    Ticket categorization scheme

    Ticket escalation and prioritization guidelines

    3 Design Request Fulfilment

    The Purpose

    Build service request workflows and prepare self-service portal.

    Key Benefits Achieved

    Standardize request fulfilment processes.

    Prepare for better knowledge management and leverage self-service portal to facilitate shift-left strategy.

    Activities

    3.1 Build service request workflows.

    3.2 Build a targeted knowledgebase.

    3.3 Prepare for a self-serve portal project.

    Outputs

    Distinguishing criteria for requests and projects

    Service request workflows and SLAs

    Knowledgebase article template, processes, and workflows

    4 Build Project Implementation Plan

    The Purpose

    Now that you have laid the foundation of your service desk, put all the initiatives into an action plan.

    Key Benefits Achieved

    Discuss priorities, set timeline, and identify effort for your service desk.

    Identify the benefits and impacts of communicating service desk initiatives to stakeholders and define channels to communicate service desk changes.

    Activities

    4.1 Build an implementation roadmap.

    4.2 Build a communication plan

    Outputs

    Project implementation and task list with associated owners

    Project communication plan and workshop summary presentation

    Further reading

    Analyst Perspective

    "Customer service issues are rarely based on personality but are almost always a symptom of poor and inconsistent process. When service desk managers are looking to hire to resolve customer service issues and executives are pushing back, it’s time to look at improving process and the support strategy to make the best use of technicians’ time, tools, and knowledge sharing. Once improvements have been made, it’s easier to make the case to add people or introduce automation.

    Replacing service desk solutions will also highlight issues around poor process. Without fixing the baseline services, the new solution will simply wrap your issues in a prettier package.

    Ultimately, the service desk needs to be the entry point for users to get help and the rest of IT needs to provide the appropriate support to ensure the first line of interaction has the knowledge and tools they need to resolve quickly and preferably on first contact. If your plans include optimization to self-serve or automation, you’ll have a hard time getting there without standardizing first."

    Sandi Conrad

    Principal Research Director, Infrastructure & Operations Practice

    Info-Tech Research Group

    A method for getting your service desk out of firefighter mode

    This Research Is Designed For:

    • The CIO and senior IT management who need to increase service desk effectiveness and timeliness and improve end-user satisfaction.
    • The service desk manager who wants to lead the team from firefighting mode to providing consistent and proactive support.

    This Research Will Also Assist:

    • Service desk teams who want to increase their own effectiveness and move from a help desk to a service desk.
    • Infrastructure and applications managers who want to decrease reactive support activities and increase strategic project productivity by shifting repetitive and low-value work left.

    This Research Will Help You:

    • Create a consistent customer service experience for service desk patrons.
    • Increase efficiency, first-call resolution, and end-user satisfaction with the Service Desk.
    • Decrease time and cost to resolve service desk tickets.
    • Understand and address reporting needs to address root causes and measure success.
    • Build a solid foundation for future IT service improvements.

    Executive Summary

    Situation

    • The CIO and senior IT management who need to increase service desk effectiveness and timeliness and improve end-user satisfaction.
    • If only the phone could stop ringing, the Service Desk could become proactive, address service levels, and improve end-user IT satisfaction.

    Complication

    • Not everyone embraces their role in service support. Specialists would rather work on projects than provide service support.
    • The Service Desk lacks processes and workflows to provide consistent service. Service desk managers struggle to set and meet service-level expectations, which further compromises end-user satisfaction.

    Resolution

    • Go beyond the blind adoption of best-practice frameworks. No simple formula exists for improving service desk maturity. Use diagnostic tools to assess the current state of the Service Desk. Identify service support challenges and draw on best-practice frameworks intelligently to build a structured response to those challenges.
    • An effective service desk must be built on the right foundations. Understand how:
      • Service desk structure affects cost and ticket volume capacity.
      • Incident management workflows can improve ticket handling, prioritization, and escalation.
      • Request fulfillment processes create opportunities for streamlining and automating services.
      • Knowledge sharing supports the processes and workflows essential to effective service support.

    Info-Tech Insight

    Service desk improvement is an exercise in organizational change. Engage specialists across the IT organization in building the solution. Establish a single service-support team across the IT group and enforce it with a cooperative, customer-focused culture. Don’t be fooled by a tool that’s new. A new service desk tool alone won’t solve the problem. Service desk maturity improvements depend on putting in place the right people and processes to support the technology

    Directors and executives understand the importance of the service desk and believe IT can do better

    A double bar graph is depicted. The blue bars represent Effectiveness and the green bars represent Importance in terms of service desk at different seniority levels, which include frontline, manager, director, and executive.

    Source: Info-Tech, 2019 Responses (N=189 organizations)

    Service Desk Importance Scores

      No Importance: 1.0-6.9
      Limited Importance: 7.0-7.9
      Significant Importance: 8.0-8.9
      Critical Importance: 9.0-10.0

    Service Desk Effectiveness Scores

      Not in Place: N/A
      Not Effective: 0.0-4.9
      Somewhat Ineffective: 5.0-5.9
      Somewhat Effective: 6.0-6.9
      Very Effective: 7.0-10.0

    Info-Tech Research Group’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified the service desk as an area to leverage.

    Business stakeholders consistently rank the service desk as one of the top five most important services that IT provides

    Since 2013, Info-Tech has surveyed over 40,000 business stakeholders as part of our CIO Business Vision program.

    Business stakeholders ranked the following 12 core IT services in terms of importance:

    Learn more about the CIO Business Vision Program.
    *Note: IT Security was added to CIO Business Vision 2.0 in 2019

    Top IT Services for Business Stakeholders

    1. Network Infrastructure
    2. IT Security*
    3. Data Quality
    4. Service Desk
    5. Business Applications
    6. Devices
    7. Client-Facing Technology
    8. Analytical Capability
    9. IT Innovation Leadership
    10. Projects
    11. Work Orders
    12. IT Policies
    13. Requirements Gathering
    Source: Info-Tech Research Group, 2019 (N=224 organizations)

    Having an effective and timely service desk correlates with higher end-user satisfaction with all other IT services

    A double bar graph is depicted. The blue bar represents dissatisfied ender user, and the green bar represents satisfied end user. The bars show the average of dissatisfied and satisfied end users for service desk effectiveness and service desk timeliness.

    On average, organizations that were satisfied with service desk effectiveness rated all other IT processes 46% higher than dissatisfied end users.

    Organizations that were satisfied with service desk timeliness rated all other IT processes 37% higher than dissatisfied end users.
    “Satisfied” organizations had average scores =8.“Dissatisfied" organizations had average scores “Dissatisfied" organizations had average scores =6. Source: Info-Tech Research Group, 2019 (N=18,500+ respondents from 75 organizations)

    Standardize the service desk the Info-Tech way to get measurable results

    More than one hundred organizations engaged with Info-Tech, through advisory calls and workshops, for their service desk projects in 2016. Their goal was either to improve an existing service desk or build one from scratch.

    Organizations that estimate the business impact of each project phase help us shed light on the average measured value of the engagements.

    "The analysts are an amazing resource for this project. Their approach is very methodical, and they have the ability to fill in the big picture with detailed, actionable steps. There is a real opportunity for us to get off the treadmill and make real IT service management improvements"

    - Rod Gula, IT Director

    American Realty Advisors

    Three circles are depicted. The top circle shows the sum of measured value dollar impact which is US$1,659,493.37. The middle circle shows the average measured value dollar impact which is US$19,755.87. The bottom circle shows the average measured value time saved which is 27 days.

    Info-Tech’s approach to service desk standardization focuses on building service management essentials

    This image depicts all of the phases and steps in this blueprint.

    Info-Tech draws on the COBIT framework, which focuses on consistent delivery of IT services across the organization

    This image depicts research that can be used to improve IT processes. Service Desk is circled to demonstrate which research is being used.

    The service desk is the foundation of all other service management processes.

    The image shows how the service desk is a foundation for other service management processes.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Standardize the Service Desk – project overview

    This image shows the project overview of this blueprint.

    Info-Tech delivers: Use our tools and templates to accelerate your project to completion

    Project Summary

    Image of template.

    Service Desk Standard Operating Procedures

    Image of tool.

    Service Desk Maturity Assessment Tool

    Image of tool.

    Service Desk Implementation Roadmap

    Image of tool Incident, knowledge, and request management workflows

    Incident, knowledge, and request management workflows

    The project’s key deliverable is a service desk standard operating procedure

    Benefits of documented SOPs:

    Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks).

    IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved.

    Compliance: Compliance audits are more manageable because the documentation is already in place.

    Transparency: Visually documented processes answer the common business question of “why does that take so long?”

    Cost savings: Work solved at first contact or with a minimal number of escalations will result in greater efficiency and more cost-effective support. This will also lead to better customer service.

    Impact of undocumented/undefined SOPs:

    Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff

    IT automation built on poorly defined, unoptimized processes leads to inconsistent results.

    Documenting SOPs to prepare for an audit becomes a major time-intensive project.

    Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.

    Support costs are highest through inefficient processes, and proactive work becomes more difficult to schedule, making the organization vulnerable to costly disruptions.

    Workshop Overview

    Image depicts workshop overview occurring over four days.

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Phase 1

    Lay Service Desk Foundations

    Step 1.1:Assess current state

    Image shows the steps in phase 1. Highlight is on step 1.1

    This step will walk you through the following activities:

    • 1.1.1 Outline service desk challenges
    • 1.1.2 Assess the service desk maturity

    This step involves the following participants:

    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Alignment on the challenges that the service desk faces, an assessment of the current state of service desk processes and technologies, and baseline metrics against which to measure improvements.

    Deliverables

    • Service Desk Maturity Assessment

    Standardizing the service desk benefits the whole business

    The image depicts 3 circles to represent the service desk foundations.

    Embrace standardization

    • Standardization prevents wasted energy on reinventing solutions to recurring issues.
    • Standardized processes are scalable so that process maturity increases with the size of your organization.

    Increase business satisfaction

    • Improve confidence that the service desk can meet service levels.
    • Create a single point of contact for incidents and requests and escalate quickly.
    • Analyze trends to forecast and meet shifting business requirements.

    Reduce recurring issues

    • Create tickets for every task and categorize them accurately.
    • Generate reliable data to support root-cause analysis.

    Increase efficiency and lower operating costs

    • Empower end users and technicians with a targeted knowledgebase (KB).
    • Cross-train to improve service consistency.

    Case Study: The CIO of Westminster College took stock of existing processes before moving to empower the “helpless desk”

    Scott Lowe helped a small staff of eight IT professionals formalize service desk processes and increase the amount of time available for projects.

    When he joined Westminster College as CIO in 2006, the department faced several infrastructure challenges, including:

    • An unreliable network
    • Aging server replacements and no replacement plan
    • IT was the “department of no”
    • A help desk known as the “helpless desk”
    • A lack of wireless connectivity
    • Internet connection speed that was much too slow

    As the CIO investigated how to address the infrastructure challenges, he realized people cared deeply about how IT spent its time.

    The project load of IT staff increased, with new projects coming in every day.

    With a long project list, it became increasingly important to improve the transparency of project request and prioritization.

    Some weeks, staff spent 80% of their time working on projects. Other weeks, support requirements might leave only 10% for project work.

    He addressed the infrastructure challenges in part by analyzing IT’s routine processes.

    Internally, IT had inefficient support processes that reduced the amount of time they could spend on projects.

    They undertook an internal process analysis effort to identify processes that would have a return on investment if they were improved. The goal was to reduce operational support time so that project time could be increased.

    Five years later, they had a better understanding of the organization's operational support time needs and were able to shift workloads to accommodate projects without compromising support.

    Common challenges experienced by service desk teams

    Unresolved issues

    • Tickets are not created for all incidents.
    • Tickets are lost or escalated to the wrong technicians.
    • Poor data impedes root-cause analysis of incidents.

    Lost resources/accountability

    • Lack of cross-training and knowledge sharing.
    • Lack of skills coverage for critical applications and services.
    • Time is wasted troubleshooting recurring issues.
    • Reports unavailable due to lack of data and poor categorization.

    High cost to resolve

    • Tier 2/3 resolve issues that should be resolved at tier 1.
    • Tier 2/3 often interrupt projects to focus on service support.

    Poor planning

    • Lack of data for effective trend analysis leads to poor demand planning.
    • Lack of data leads to lost opportunities for templating and automation.

    Low business satisfaction

    • Users are unable to get assistance with IT services quickly.
    • Users go to their favorite technician instead of using the service desk.

    Outline the organization’s service desk challenges

    1.1.1 Brainstorm service desk challenges

    Estimated Time: 45 minutes

    A. As a group, outline the areas where you think the service desk is experiencing challenges or weaknesses. Use sticky notes or a whiteboard to separate the challenges into People, Process, and Technology so you have a wholistic view of the constraints across the department.

    B. Think about the following:

    • What have you heard from users? (e.g. slow response time)
    • What have you heard from executives? (e.g. poor communication)
    • What should you start doing? (e.g. documenting processes)
    • What should you stop doing? (e.g. work that is not being entered as tickets)

    C. Document challenges in the Service Desk Project Summary.

    Participants:

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    Assess current service desk maturity to establish a baseline and create a plan for service desk improvement

    A current-state assessment will help you build a foundation for process improvements. Current-state assessments follow a basic formula:

    1. Determine the current state of the service desk.
    2. Determine the desired state of the service desk.
    3. Build a practical path from current to desired state.
    Image depicts 2 circles and a box. The circle on the 1. left has assess current state. The circle on the right has 2. assess target state. The box has 3. build a roadmap.

    Ideally, the current-state assessment should align the delivery of IT services with organizational needs. The assessment should achieve the following goals:

    1. Identify service desk pain points.
    2. Map each pain point to business services.
    3. Assign a broad business value to the resolution of each pain point.
    4. Map each pain point to a process.

    Expert Insight

    Image of expert.

    “How do you know if you aren’t mature enough? Nothing – or everything – is recorded and tracked, customer satisfaction is low, frustration is high, and there are multiple requests and incidents that nobody ever bothers to address.”

    Rob England

    IT Consultant & Commentator

    Owner Two Hills

    Also known as The IT Skeptic

    Assess the process maturity of the service desk to determine which project phase and steps will bring the most value

    1.1.2 Measure which activity will have the greatest impact

    The Service Desk Maturity Assessmenttool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.

    The tool will help guide improvement efforts and measure your progress.

    • The second tab of the tool walks through a qualitative assessment of your service desk practices. Questions will prompt you to evaluate how you are executing key activities. Select the answer in the drop-down menus that most closely aligns with your current state.
    • The third tab displays your rate of process completeness and maturity. You will receive a score for each phase, an overall score, and advice based on your performance.
    • Document the results of the efficiency assessment in the Service Desk Project Summary.

    The tool is intended for periodic use. Review your answers each year and devise initiatives to improve the process performance where you need it most.

    Where do I find the data?

    Consult:

    • Service Manager
    • Service Desk Tools
    Image is the service desk tools.

    Step 1.2:Review service support best practices

    Image shows the steps in phase 1. Highlight is on step 1.2.

    This step will walk you through the following activities:

    1. 1.2.1 Identify roles and responsibilities in your organization
    2. 1.2.2 Map out the current and target structure of the service desk

    This step involves the following participants:

    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Identifying who is accountable for different support practices in the service desk will allow workload to be distributed effectively between functional teams and individuals. Closing the gaps in responsibilities will enable the execution of a shift-left strategy.

    Deliverables

    • Roles & responsibilities guide
    • Service desk structure

    Everyone in IT contributes to the success of service support

    Regardless of the service desk structure chosen to meet an organization’s service support requirements, IT staff should not doubt the role they play in service support.

    If you try to standardize service desk processes without engaging specialists in other parts of the IT organization, you will fail. Everyone in IT has a role to play in providing service support and meeting service-level agreements.

    Service Support Engagement Plan

    • Identify who is accountable for different service support processes.
    • Outline the different responsibilities of service desk agents at tier 1, tier 2, and tier 3 in meeting service-level agreements for service support.
    • Draft operational-level agreements between specialty groups and the service desk to improve accountability.
    • Configure the service desk tool to ensure ticket visibility and ownership across queues.
    • Engage tier 2 and tier 3 resources in building workflows for incident management, request fulfilment, and writing knowledgebase articles.
    • Emphasize the benefits of cooperation across IT silos:
      • Better customer service and end-user satisfaction.
      • Shorter time to resolve incidents and implement requests.
      • A higher tier 1 resolution rate, more efficient escalations, and fewer interruptions from project work.

    Info-Tech Insight

    Specialists tend to distance themselves from service support as they progress through their career to focus on projects.

    However, their cooperation is critical to the success of the new service desk. Not only do they contribute to the knowledgebase, but they also handle escalations from tiers 1 and 2.

    Clear project complications by leveraging roles and responsibilities

    R

    Responsible: This person is the staff member who completes the work. Assign at least one Responsible for each task, but this could be more than one.

    A

    Accountable: This team member delegates a task and is the last person to review deliverables and/or task. Sometimes Responsible and Accountable can be the same staff. Make sure that you always assign only one Accountable for each task and not more.

    C

    Consulted: People who do not carry out the task but need to be consulted. Typically, these people are subject matter experts or stakeholders.

    I

    Informed: People who receive information about process execution and quality and need to stay informed regarding the task.

    A RACI analysis is helpful with the following:

    • Workload Balancing: Allowing responsibilities to be distributed effectively between functional teams and individuals.
    • Change Management: Ensuring key functions and processes are not overlooked during organizational changes.
    • Onboarding: New employees can identify their own roles and responsibilities.

    A RACI chart outlines which positions are Responsible, Accountable, Consulted, and Informed

    Image shows example of RACI chart

    Create a list of roles and responsibilities in your organization

    1.2.1 Create RACI matrix to define responsibilities

    1. Use the Service Desk Roles and Responsibilities Guidefor a better understanding of the roles and responsibilities of different service desk tiers.
    2. In the RACI chart, replace the top row with specific roles in your organization.
    3. Modify or expand the process tasks, as needed, in the left column.
    4. For each role, identify the responsibility values that the person brings to the service desk. Fill out each column.
    5. Document in the Service Desk SOP. Schedule a time to share the results with organization leads.
    6. Distribute the chart between all teams in your organization.

    Notes:

    • Assign one Accountable for each task.
    • Have at least one Responsible for each task.
    • Avoid generic responsibilities, such as “team meetings.”
    • Keep your RACI definitions in your documents, as they are sometimes tough to remember.

    Participants

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    What You'll Need

    • Service Desk SOP
    • Roles and Responsibilities Guide
    • Flip Chart
    • Whiteboard

    Build a single point of contact for the service desk

    Regardless of the service desk structure chosen to meet your service support requirements, end users should be in no doubt about how to access the service.

    Provide end users with:

    • A single phone number.
    • A single email address.
    • A single web portal for all incidents and requests.

    A single point of contact will ensure:

    • An agent is available to field incidents and requests.
    • Incidents and requests are prioritized according to impact and urgency.
    • Work is tracked to completion.

    This prevents ad hoc ticket channels such as shoulder grabs or direct emails, chats, or calls to a technician from interrupting work.

    A single point of contact does not mean the service desk is only accessible through one intake channel, but rather all tickets are directed to the service desk (i.e. tier 1) to be resolved or redirected appropriately.

    Image depicts 2 boxes. The smaller box labelled users and the larger box labelled Service Desk Tier 1. There are four double-sided arrows. The top is labelled email, the second is walk-in, the third is phone, the fourth is web portal.

    Directors and executives understand the importance of the service desk and believe IT can do better

    A double bar graph is depicted. The blue bars represent Effectiveness and the green bars represent Importance in terms of service desk at different seniority levels, which include frontline, manager, director, and executive.

    Source: Info-Tech, 2019 Responses (N=189 organizations)

    Service Desk Importance Scores

      No Importance: 1.0-6.9
      Limited Importance: 7.0-7.9
      Significant Importance: 8.0-8.9
      Critical Importance: 9.0-10.0

    Service Desk Effectiveness Scores

      Not in Place: N/A
      Not Effective: 0.0-4.9
      Somewhat Ineffective: 5.0-5.9
      Somewhat Effective: 6.0-6.9
      Very Effective: 7.0-10.0

    Info-Tech Research Group’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified the service desk as an area to leverage.

    Business stakeholders consistently rank the service desk as one of the top five most important services that IT provides

    Since 2013, Info-Tech has surveyed over 40,000 business stakeholders as part of our CIO Business Vision program.

    Business stakeholders ranked the following 12 core IT services in terms of importance:

    Learn more about the CIO Business Vision Program.
    *Note: IT Security was added to CIO Business Vision 2.0 in 2019

    Top IT Services for Business Stakeholders

    1. Network Infrastructure
    2. IT Security*
    3. Data Quality
    4. Service Desk
    5. Business Applications
    6. Devices
    7. Client-Facing Technology
    8. Analytical Capability
    9. IT Innovation Leadership
    10. Projects
    11. Work Orders
    12. IT Policies
    13. Requirements Gathering
    Source: Info-Tech Research Group, 2019 (N=224 organizations)

    Having an effective and timely service desk correlates with higher end-user satisfaction with all other IT services

    A double bar graph is depicted. The blue bar represents dissatisfied ender user, and the green bar represents satisfied end user. The bars show the average of dissatisfied and satisfied end users for service desk effectiveness and service desk timeliness.

    On average, organizations that were satisfied with service desk effectiveness rated all other IT processes 46% higher than dissatisfied end users.

    Organizations that were satisfied with service desk timeliness rated all other IT processes 37% higher than dissatisfied end users.
    “Satisfied” organizations had average scores =8.“Dissatisfied" organizations had average scores “Dissatisfied" organizations had average scores =6. Source: Info-Tech Research Group, 2019 (N=18,500+ respondents from 75 organizations)

    Standardize the service desk the Info-Tech way to get measurable results

    More than one hundred organizations engaged with Info-Tech, through advisory calls and workshops, for their service desk projects in 2016. Their goal was either to improve an existing service desk or build one from scratch.

    Organizations that estimate the business impact of each project phase help us shed light on the average measured value of the engagements.

    "The analysts are an amazing resource for this project. Their approach is very methodical, and they have the ability to fill in the big picture with detailed, actionable steps. There is a real opportunity for us to get off the treadmill and make real IT service management improvements"

    - Rod Gula, IT Director

    American Realty Advisors

    Three circles are depicted. The top circle shows the sum of measured value dollar impact which is US$1,659,493.37. The middle circle shows the average measured value dollar impact which is US$19,755.87. The bottom circle shows the average measured value time saved which is 27 days.

    Info-Tech’s approach to service desk standardization focuses on building service management essentials

    This image depicts all of the phases and steps in this blueprint.

    Info-Tech draws on the COBIT framework, which focuses on consistent delivery of IT services across the organization

    This image depicts research that can be used to improve IT processes. Service Desk is circled to demonstrate which research is being used.

    The service desk is the foundation of all other service management processes.

    The image shows how the service desk is a foundation for other service management processes.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Standardize the Service Desk – project overview

    This image shows the project overview of this blueprint.

    Info-Tech delivers: Use our tools and templates to accelerate your project to completion

    Project Summary

    Image of template.

    Service Desk Standard Operating Procedures

    Image of tool.

    Service Desk Maturity Assessment Tool

    Image of tool.

    Service Desk Implementation Roadmap

    Image of tool Incident, knowledge, and request management workflows

    Incident, knowledge, and request management workflows

    The project’s key deliverable is a service desk standard operating procedure

    Benefits of documented SOPs:

    Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks).

    IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved.

    Compliance: Compliance audits are more manageable because the documentation is already in place.

    Transparency: Visually documented processes answer the common business question of “why does that take so long?”

    Cost savings: Work solved at first contact or with a minimal number of escalations will result in greater efficiency and more cost-effective support. This will also lead to better customer service.

    Impact of undocumented/undefined SOPs:

    Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff

    IT automation built on poorly defined, unoptimized processes leads to inconsistent results.

    Documenting SOPs to prepare for an audit becomes a major time-intensive project.

    Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.

    Support costs are highest through inefficient processes, and proactive work becomes more difficult to schedule, making the organization vulnerable to costly disruptions.

    Workshop Overview

    Image depicts workshop overview occurring over four days.

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Phase 1

    Lay Service Desk Foundations

    Step 1.1:Assess current state

    Image shows the steps in phase 1. Highlight is on step 1.1

    This step will walk you through the following activities:

    • 1.1.1 Outline service desk challenges
    • 1.1.2 Assess the service desk maturity

    This step involves the following participants:

    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Alignment on the challenges that the service desk faces, an assessment of the current state of service desk processes and technologies, and baseline metrics against which to measure improvements.

    Deliverables

    • Service Desk Maturity Assessment

    Standardizing the service desk benefits the whole business

    The image depicts 3 circles to represent the service desk foundations.

    Embrace standardization

    • Standardization prevents wasted energy on reinventing solutions to recurring issues.
    • Standardized processes are scalable so that process maturity increases with the size of your organization.

    Increase business satisfaction

    • Improve confidence that the service desk can meet service levels.
    • Create a single point of contact for incidents and requests and escalate quickly.
    • Analyze trends to forecast and meet shifting business requirements.

    Reduce recurring issues

    • Create tickets for every task and categorize them accurately.
    • Generate reliable data to support root-cause analysis.

    Increase efficiency and lower operating costs

    • Empower end users and technicians with a targeted knowledgebase (KB).
    • Cross-train to improve service consistency.

    Case Study: The CIO of Westminster College took stock of existing processes before moving to empower the “helpless desk”

    Scott Lowe helped a small staff of eight IT professionals formalize service desk processes and increase the amount of time available for projects.

    When he joined Westminster College as CIO in 2006, the department faced several infrastructure challenges, including:

    • An unreliable network
    • Aging server replacements and no replacement plan
    • IT was the “department of no”
    • A help desk known as the “helpless desk”
    • A lack of wireless connectivity
    • Internet connection speed that was much too slow

    As the CIO investigated how to address the infrastructure challenges, he realized people cared deeply about how IT spent its time.

    The project load of IT staff increased, with new projects coming in every day.

    With a long project list, it became increasingly important to improve the transparency of project request and prioritization.

    Some weeks, staff spent 80% of their time working on projects. Other weeks, support requirements might leave only 10% for project work.

    He addressed the infrastructure challenges in part by analyzing IT’s routine processes.

    Internally, IT had inefficient support processes that reduced the amount of time they could spend on projects.

    They undertook an internal process analysis effort to identify processes that would have a return on investment if they were improved. The goal was to reduce operational support time so that project time could be increased.

    Five years later, they had a better understanding of the organization's operational support time needs and were able to shift workloads to accommodate projects without compromising support.

    Common challenges experienced by service desk teams

    Unresolved issues

    • Tickets are not created for all incidents.
    • Tickets are lost or escalated to the wrong technicians.
    • Poor data impedes root-cause analysis of incidents.

    Lost resources/accountability

    • Lack of cross-training and knowledge sharing.
    • Lack of skills coverage for critical applications and services.
    • Time is wasted troubleshooting recurring issues.
    • Reports unavailable due to lack of data and poor categorization.

    High cost to resolve

    • Tier 2/3 resolve issues that should be resolved at tier 1.
    • Tier 2/3 often interrupt projects to focus on service support.

    Poor planning

    • Lack of data for effective trend analysis leads to poor demand planning.
    • Lack of data leads to lost opportunities for templating and automation.

    Low business satisfaction

    • Users are unable to get assistance with IT services quickly.
    • Users go to their favorite technician instead of using the service desk.

    Outline the organization’s service desk challenges

    1.1.1 Brainstorm service desk challenges

    Estimated Time: 45 minutes

    A. As a group, outline the areas where you think the service desk is experiencing challenges or weaknesses. Use sticky notes or a whiteboard to separate the challenges into People, Process, and Technology so you have a wholistic view of the constraints across the department.

    B. Think about the following:

    • What have you heard from users? (e.g. slow response time)
    • What have you heard from executives? (e.g. poor communication)
    • What should you start doing? (e.g. documenting processes)
    • What should you stop doing? (e.g. work that is not being entered as tickets)

    C. Document challenges in the Service Desk Project Summary.

    Participants:

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    Assess current service desk maturity to establish a baseline and create a plan for service desk improvement

    A current-state assessment will help you build a foundation for process improvements. Current-state assessments follow a basic formula:

    1. Determine the current state of the service desk.
    2. Determine the desired state of the service desk.
    3. Build a practical path from current to desired state.
    Image depicts 2 circles and a box. The circle on the 1. left has assess current state. The circle on the right has 2. assess target state. The box has 3. build a roadmap.

    Ideally, the current-state assessment should align the delivery of IT services with organizational needs. The assessment should achieve the following goals:

    1. Identify service desk pain points.
    2. Map each pain point to business services.
    3. Assign a broad business value to the resolution of each pain point.
    4. Map each pain point to a process.

    Expert Insight

    Image of expert.

    “How do you know if you aren’t mature enough? Nothing – or everything – is recorded and tracked, customer satisfaction is low, frustration is high, and there are multiple requests and incidents that nobody ever bothers to address.”

    Rob England

    IT Consultant & Commentator

    Owner Two Hills

    Also known as The IT Skeptic

    Assess the process maturity of the service desk to determine which project phase and steps will bring the most value

    1.1.2 Measure which activity will have the greatest impact

    The Service Desk Maturity Assessmenttool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.

    The tool will help guide improvement efforts and measure your progress.

    • The second tab of the tool walks through a qualitative assessment of your service desk practices. Questions will prompt you to evaluate how you are executing key activities. Select the answer in the drop-down menus that most closely aligns with your current state.
    • The third tab displays your rate of process completeness and maturity. You will receive a score for each phase, an overall score, and advice based on your performance.
    • Document the results of the efficiency assessment in the Service Desk Project Summary.

    The tool is intended for periodic use. Review your answers each year and devise initiatives to improve the process performance where you need it most.

    Where do I find the data?

    Consult:

    • Service Manager
    • Service Desk Tools
    Image is the service desk tools.

    Step 1.2:Review service support best practices

    Image shows the steps in phase 1. Highlight is on step 1.2.

    This step will walk you through the following activities:

    1. 1.2.1 Identify roles and responsibilities in your organization
    2. 1.2.2 Map out the current and target structure of the service desk

    This step involves the following participants:

    • Project Sponsor
    • IT Director, CIO
    • IT Managers and Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Identifying who is accountable for different support practices in the service desk will allow workload to be distributed effectively between functional teams and individuals. Closing the gaps in responsibilities will enable the execution of a shift-left strategy.

    Deliverables

    • Roles & responsibilities guide
    • Service desk structure

    Everyone in IT contributes to the success of service support

    Regardless of the service desk structure chosen to meet an organization’s service support requirements, IT staff should not doubt the role they play in service support.

    If you try to standardize service desk processes without engaging specialists in other parts of the IT organization, you will fail. Everyone in IT has a role to play in providing service support and meeting service-level agreements.

    Service Support Engagement Plan

    • Identify who is accountable for different service support processes.
    • Outline the different responsibilities of service desk agents at tier 1, tier 2, and tier 3 in meeting service-level agreements for service support.
    • Draft operational-level agreements between specialty groups and the service desk to improve accountability.
    • Configure the service desk tool to ensure ticket visibility and ownership across queues.
    • Engage tier 2 and tier 3 resources in building workflows for incident management, request fulfilment, and writing knowledgebase articles.
    • Emphasize the benefits of cooperation across IT silos:
      • Better customer service and end-user satisfaction.
      • Shorter time to resolve incidents and implement requests.
      • A higher tier 1 resolution rate, more efficient escalations, and fewer interruptions from project work.

    Info-Tech Insight

    Specialists tend to distance themselves from service support as they progress through their career to focus on projects.

    However, their cooperation is critical to the success of the new service desk. Not only do they contribute to the knowledgebase, but they also handle escalations from tiers 1 and 2.

    Clear project complications by leveraging roles and responsibilities

    R

    Responsible: This person is the staff member who completes the work. Assign at least one Responsible for each task, but this could be more than one.

    A

    Accountable: This team member delegates a task and is the last person to review deliverables and/or task. Sometimes Responsible and Accountable can be the same staff. Make sure that you always assign only one Accountable for each task and not more.

    C

    Consulted: People who do not carry out the task but need to be consulted. Typically, these people are subject matter experts or stakeholders.

    I

    Informed: People who receive information about process execution and quality and need to stay informed regarding the task.

    A RACI analysis is helpful with the following:

    • Workload Balancing: Allowing responsibilities to be distributed effectively between functional teams and individuals.
    • Change Management: Ensuring key functions and processes are not overlooked during organizational changes.
    • Onboarding: New employees can identify their own roles and responsibilities.

    A RACI chart outlines which positions are Responsible, Accountable, Consulted, and Informed

    Image shows example of RACI chart

    Create a list of roles and responsibilities in your organization

    1.2.1 Create RACI matrix to define responsibilities

    1. Use the Service Desk Roles and Responsibilities Guidefor a better understanding of the roles and responsibilities of different service desk tiers.
    2. In the RACI chart, replace the top row with specific roles in your organization.
    3. Modify or expand the process tasks, as needed, in the left column.
    4. For each role, identify the responsibility values that the person brings to the service desk. Fill out each column.
    5. Document in the Service Desk SOP. Schedule a time to share the results with organization leads.
    6. Distribute the chart between all teams in your organization.

    Notes:

    • Assign one Accountable for each task.
    • Have at least one Responsible for each task.
    • Avoid generic responsibilities, such as “team meetings.”
    • Keep your RACI definitions in your documents, as they are sometimes tough to remember.

    Participants

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    What You'll Need

    • Service Desk SOP
    • Roles and Responsibilities Guide
    • Flip Chart
    • Whiteboard

    Build a tiered generalist service desk to optimize costs

    A tiered generalist service desk with a first-tier resolution rate greater than 60% has the best operating cost and customer satisfaction of all competing service desk structural models.

    Image depicts a tiered generalist service desk example. It shows a flow from users to tier 1 and to tiers 2 and 3.

    The success of a tiered generalist model depends on standardized, defined processes

    Image lists the processes and benefits of a successful tiered generalist service desk.

    Define the structure of the service desk

    1.2.2 Map out the current and target structure of the service desk

    Estimated Time: 45 minutes

    Instructions:

    1. Using the model from the previous slides as a guide, discuss how closely it matches the current service desk structure.
    2. Map out a similar diagram of your existing service desk structure, intake channels, and escalation paths.
    3. Review the structure and discuss any changes that could be made to improve efficiency. Revise as needed.
    4. Document the outcome in the Service Desk Project Summary.

    Image depicts a tiered generalist service desk example. It shows a flow from users to tier 1 and to tiers 2 and 3.

    Participants

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    Use a shift-left strategy to lower service support costs, reduce time to resolve, and improve end-user satisfaction

    Shift-left strategy:

    • Shift service support tasks from specialists to generalists.
    • Implement self-service.
    • Automate incident resolution.
    Image shows the incident and service request resolution in a graph. It includes metrics of cost per ticket, average time to resolve, and end-user satisfaction.

    Work through the implications of adopting a shift-left strategy

    Overview:

    Identify process gaps that you need to fill to support the shift-left strategy and discuss how you could adopt or improve the shift-left strategy, using the discussion questions below as a guide.

    Which process gaps do you need to fill to identify ticket trends?

    • What are your most common incidents and service requests?
    • Which tickets could be resolved at tier 1?
    • Which tickets could be resolved as self-service tickets?
    • Which tickets could be automated?

    Which processes do you most need to improve to support a shift-left strategy?

    • Which incident and request processes are well documented?
    • Do you have recurring tickets that could be automated?
    • What is the state of your knowledgebase maintenance process?
    • Which articles do you most need to support tier 1 resolution?
    • What is the state of your web portal? How could it be improved to support self-service?

    Document in the Project Summary

    Step 1.3: Identify service desk metrics and reports

    Image shows the steps in phase 1. Highlight is on step 1.3.

    This step will walk you through the following activities:

    • 1.3 Create a list of required reports to identify relevant metrics

    This step involves the following participants:

    • Project Sponsor
    • IT Managers and Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Managers and analysts will have service desk metrics and reports that help set expectations and communicate service desk performance.

    Deliverables

    • A list of service desk performance metrics and reports

    Engage business unit leaders with data to appreciate needs

    Service desk reports are an opportunity to communicate the story of IT and collect stakeholder feedback. Interview business unit leaders and look for opportunities to improve IT services.

    Start with the following questions:

    • What are you hearing from your team about working with IT?
    • What are the issues that are contributing to productivity losses?
    • What are the workarounds your team does because something isn’t working?
    • Are you able to access the information you need?

    Work with business unit leaders to develop an action plan.

    Remember to communicate what you do to address stakeholder grievances.

    The service recovery paradox is a situation in which end users think more highly of IT after the organization has corrected a problem with their service compared to how they would regard the company if the service had not been faulty in the first place.

    The point is that addressing issues (and being seen to address issues) will significantly improve end-user satisfaction. Communicate that you’re listening and acting, and you should see satisfaction improve.

    Info-Tech Insight

    Presentation is everything:

    If you are presenting outside of IT, or using operational metrics to create strategic information, be prepared to:

    • Discuss trends.
    • Identify organizational and departmental impacts.
    • Assess IT costs and productivity.

    For example, “Number of incidents with ERP system has decreased by 5% after our last patch release. We are working on the next set of changes and expect the issues to continue to decrease.”

    Engage technicians to ensure they input quality data in the service desk tool

    You need better data to address problems. Communicate to the technical team what you need from them and how their efforts contribute to the usefulness of reports.

    Tickets MUST:

    • Be created for all incidents and service requests.
    • Be categorized correctly, and categories updated when the ticket is resolved.
    • Be closed after the incidents and service requests are resolved or implemented.

    Emphasize that reports are analyzed regularly and used to manage costs, improve services, and request more resources.

    Info-Tech Insight

    Service Desk Manager: Technical staff can help themselves analyze the backlog and improve service metrics if they’re looking at the right information. Ensure their service desk dashboards are helping them identify high-priority and quick-win tickets and anticipate potential SLA breaches.

    Produce service desk reports targeted to improve IT services

    Use metrics and reports to tell the story of IT.

    Metrics should be tied to business requirements and show how well IT is meeting those requirements and where obstacles exist.

    Tailor metrics and reports to specific stakeholders.

    Technicians require mostly real-time information in the form of a dashboard, providing visibility into a prioritized list of tickets for which they are responsible.

    Supervisors need tactical information to manage the team and set client expectations as well as track and meet strategic goals.

    Managers and executives need summary information that supports strategic goals. Start by looking at executive goals for the support team and then working through some of the more tactical data that will help support those goals.

    One metric doesn’t give you the whole picture

    • Don’t put too much emphasis on a single metric. At best, it will give you a distorted picture of your service desk performance. At worst, it will distort the behavior of your agents as they may adopt poor practices to meet the metric.
    • The solution is to use tension metrics: metrics that work together to give you a better sense of the state of operations.
    • Tension metrics ensure a balanced focus toward shared goals.

    Example:

    First-call resolution (FCR), end-user satisfaction, and number of tickets reopened all work together to give you a complete picture. As FCR goes up, so should end-user satisfaction, as number of tickets re-opened stays steady or declines. If the three metrics are heading in different directions, then you know you have a problem.

    Rely on internal metrics to measure and improve performance

    External metrics provide useful context, but they represent broad generalizations across different industries and organizations of different sizes. Internal metrics measured annually are more reliable.

    Internal metrics provide you with information about your actual performance. With the right continual improvement process, you can improve those metrics year over year, which is a better measure of the performance of your service desk.

    Whether a given metric is the right one for your service desk will depend on several different factors, not the least of which include:

    • The maturity of your service desk processes.
    • Your ticket volume.
    • The complexity of your tickets.
    • The degree to which your end users are comfortable with self-service.

    Info-Tech Insight

    Take external metrics with a grain of salt. Most benchmarks represent what service desks do across different industries, not what they should do. There also might be significant differences between different industries in terms of the kinds of tickets they deal with, differences which the overall average obscures.

    Use key service desk metrics to build a business case for service support improvements

    The right metrics can tell the business how hard IT works and how many resources it needs to perform:

    1. End-User Satisfactions:
      • The most important metric for measuring the perceived value of the service desk. Determine this based on a robust annual satisfaction survey of end users and transactional satisfaction surveys sent with a percentage of tickets.
    2. Ticket Volume and Cost per Ticket:
      • A key indicator of service desk efficiency, computed as the monthly operating expense divided by the average ticket volume per month.
    3. First-Contact Resolution Rate:
      • The biggest driver of end-user satisfaction. Depending on the kind of tickets you deal with, you can measure first-contact, first-tier, or first-day resolution.
    4. Average Time to Resolve (Incident) or Fulfill (Service Requests):
      • An assessment of the service desk's ability to resolve tickets effectively, measuring the time elapsed between the moment the ticket status is set to “open” and the moment it is set to “resolved.”

    Info-Tech Insight

    Metrics should be tied to business requirements. They tell the story of how well IT is meeting those requirements and help identify when obstacles get in the way. The latter can be done by pointing to discrepancies between the internal metrics you expected to reach but didn’t and external metrics you trust.

    Use service desk metrics to track progress toward strategic, operational, and tactical goals

    Image depicts a chart to show the various metrics in terms of strategic goals, tactical goals, and operational goals.

    Cost per ticket and customer satisfaction are the foundation metrics of service support

    Ultimately, everything boils down to cost containment (measured by cost per ticket) and quality of service (measured by customer satisfaction).

    Cost per ticket is a measure of the efficiency of service support:

    • A higher than average cost per ticket is not necessarily a bad thing, particularly if accompanied by higher-than-average quality levels.
    • Conversely, a low cost per ticket is not necessarily good, particularly if the low cost is achieved by sacrificing quality of service.

    Cost per ticket is the total monthly operating expense of the service desk divided by the monthly ticket volume. Operating expense includes the following components:

    • Salaries and benefits for desktop support technicians
    • Salaries and benefits for indirect personnel (team leads, supervisors, workforce schedulers, dispatchers, QA/QC personnel, trainers, and managers)
    • Technology expense (e.g. computers, software licensing fees)
    • Telecommunications expenses
    • Facilities expenses (e.g. office space, utilities, insurance)
    • Travel, training, and office supplies
    Image displays a pie chart that shows the various service desk costs.

    Create a list of required reports to identify metrics to track

    1.3.1 Start by identifying the reports you need, then identify the metrics that produce them

    1. Answer the following questions to determine the data your reports require:
      • What strategic initiatives do you need to track?
        • Example: reducing mean time to resolve, meeting SLAs
      • What operational areas need attention?
        • Example: recurring issues that need a permanent resolution
      • What kind of issues do you want to solve?
        • Example: automate tasks such as password reset or software distribution
      • What decisions or processes are held up due to lack of information?
        • Example: need to build a business case to justify infrastructure upgrades
      • How can the data be used to improve services to the business?
        • Example: recurring issues by department
    2. Document report and metrics requirements in Service Desk SOP.
    3. Provide the list to your tool administrator to create reports with auto-distribution.

    Participants

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    What You'll Need

    • Service Desk SOP
    • Flip Chart
    • Whiteboard

    Step 1.4: Review ticket handling procedures

    Image shows the steps in phase 1. Highlight is on step 1.4.

    This step will walk you through the following activities:

    • 1.4.1 Review ticket handling practices
    • 1.4.2 Identify opportunities to automate ticket creation and reduce recurring tickets

    This step involves the following participants:

    • Project Sponsor
    • IT Managers and Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Managers and analysts will have best practices for ticket handling and troubleshooting to support ITSM data quality and improve first-tier resolution.

    DELIVERABLES

    • List of ticket templates and recurring tickets
    • Ticket and Call QA Template and ticket handling best practices

    Start by reviewing the incident intake process to find opportunities for improvement

    If end users are avoiding your service desk, you may have an intake problem. Create alternative ways for users to seek help to manage the volume; keep in mind not every request is an emergency.

    Image shows the various intake channels and the recommendation.

    Identify opportunities for improvement in your ticket channels

    The two most efficient intake channels should be encouraged for the majority of tickets.

    • Build a self-service portal.
      • Do users know where to find the portal?
      • How many tickets are created through the portal?
      • Is the interface easy to use?
    • Deal efficiently with email.
      • How quickly are messages picked up?
      • Are they manually transferred to a ticket or does the service desk tool automatically create a ticket?

    The two most traditional and fastest methods to get help must deal with emergencies and escalation effectively.

    • Phone should be the fastest way to get help for emergencies.
      • Are enough agents answering calls?
      • Are voicemails picked up on time?
      • Are the automated call routing prompts clear and concise?
    • Are walk-ins permitted and formalized?
      • Do you always have someone at the desk?
      • Is your equipment secure?
      • Are walk-ins common because no one picks up the phone or is the traffic as you’d expect?

    Ensure technicians create tickets for all incidents and requests

    Why Collect Ticket Data?

    If many tickets are missing, help service support staff understand the need to collect the data. Reports will be inaccurate and meaningless if quality data isn’t entered into the ticketing system.

    Image shows example of ticket data

    Set ticket handling expectations to drive a consistent process

    Set expectations:

    • Create and update tickets, but not at the expense of good customer service. Agents can start the ticket but shouldn’t spend five minutes creating the ticket when they should be troubleshooting the problem.
    • Update the ticket when the issue is resolved or needs to be escalated. If agents are escalating, they should make sure all relevant information is passed along to the next technician.
    • Update user of ETA if issue cannot be resolved quickly.
    • Ticket templates for common incidents can lead to fast creation, data input, and categorizations. Templates can reduce the time it takes to create tickets from two minutes to 30 seconds.
    • Update categories to reflect the actual issue and resolution.
    • Reference or link to the knowledgebase article as the documented steps taken to resolve the incident.
    • Validate incident is resolved with client; automate this process with ticket closure after a certain time.
    • Close or resolve the ticket on time.

    Use the Ticket and Call Quality Assessment Tool to improve the quality of service desk data

    Build a process to check-in on ticket and call quality monthly

    Better data leads to better decisions. Use the Ticket and Call Quality Assessment Toolto check-in on the ticket and call quality monthly for each technician and improve service desk data quality.

    1. Fill tab 1 with technician’s name.
    2. Use either tab 2 (auto-scoring) or tab 3 (manual scoring) to score the agent. The assessment includes ticket evaluation, call evaluation, and overall metric.
    3. Record the results of each review in the score summary of tab 1.
    Image shows tool.

    Use ticket templates to make ticket creation, updating, and resolution more efficient

    A screenshot of the Ticket and Call Quality Assessment Tool

    Implement measures to improve ticket handling and identify ticket template candidates

    1.4.1 Identify opportunities to automate ticket creation

    1. Poll the team and discuss.
      • How many members of the team are not creating tickets? Why?
      • How can we address those barriers?
      • What are the expectations of management?
    2. Brainstorm five to ten good candidates for ticket templates.
      • What data can auto-fill?
      • What will help process the ticket faster?
      • What automations can we build to ensure a fast, consistent service?
      • Note:
        • Ticket template name
        • Information that will auto-fill from AD and other applications
        • Categories and resolution codes
        • Automated routing and email responses
    3. Document ticket template candidates in the Service Desk Roadmap to capture the actions.

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You'll Needs

    • Flip Chart
    • Whiteboard

    Phase 2

    Design Incident Management Processes

    Step 2.1: Build incident management workflows

    Image shows the steps in phase 2. Highlight is on step 2.1.

    This step will walk you through the following activities:

    • 2.1.1 Review incident management challenges
    • 2.1.2 Define the incident management workflow
    • 2.1.3 Define the critical incident management workflow
    • 2.1.4 Design critical incident communication plan

    This step involves the following participants:

    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Workflows for incident management and critical incident management will improve the consistency and quality of service delivery and prepare the service desk to negotiate reliable service levels with the organization.

    DELIVERABLES

    • Incident management workflows
    • Critical incident management workflows
    • Critical incident communication plan

    Communicate the great incident resolution work that you do to improve end-user satisfaction

    End users think more highly of IT after the organization has corrected a problem with their service than they would have had the service not been faulty in the first place.

    Image displays a graph to show the service recovery paradox

    Info-Tech Insight

    Use the service recovery paradox to your advantage. Address service desk challenges explicitly, develop incident management processes that get services back online quickly, and communicate the changes.

    If you show that the service desk recovered well from the challenges end users raised, you will get greater loyalty from them.

    Assign incident roles and responsibilities to promote accountability

    The role of an incident coordinator or manager can be assigned to anyone inside the service desk that has a strong knowledge of incident resolution, attention to detail, and knows how to herd cats.

    In organizations with high ticket volumes, a separate role may be necessary.

    Everyone must recognize that incident management is a cross-IT organization process and it does not have to be a unique service desk process.

    An incident coordinator is responsible for:

    • Improving incident management processes.
    • Tracking metrics and producing reports.
    • Developing and maintaining the incident management system.
    • Developing and maintaining critical incident processes.
    • Ensuring the service support team follows the incident management process.
    • Gathering post-mortem information from the various technical resources on root cause for critical or severity 1 incidents.

    The Director of IT Services invested in incident management to improve responsiveness and set end-user expectations

    Practitioner Insight

    Ben Rodrigues developed a progressive plan to create a responsive, service-oriented culture for the service support organization.

    "When I joined the organization, there wasn’t a service desk. People just phoned, emailed, maybe left [sticky] notes for who they thought in IT would resolve it. There wasn’t a lot of investment in developing clear processes. It was ‘Let’s call somebody in IT.’

    I set up the service desk to clarify what we would do for end users and to establish some SLAs.

    I didn’t commit to service levels right away. I needed to see how many resources and what skill sets I would need. I started by drafting some SLA targets and plugging them into our tracking application. I then monitored how we did on certain things and established if we needed other skill sets. Then I communicated those SOPs to the business, so that ‘if you have an issue, this is where you go, and this is how you do it,’ and then shared those KPIs with them.

    I had monthly meetings with different function heads to say, ‘this is what I see your guys calling me about,’ and we worked on something together to make some of the pain disappear."

    -Ben Rodrigues

    Director, IT Services

    Gamma Dynacare

    Sketch out incident management challenges to focus improvements

    Common Incident Management Challenges

    End Users

    • No faith in the service desk beyond speaking with their favorite technician.
    • No expectations for response or resolution time.
    • Non-IT staff are disrupted as people ask their colleagues for IT advice.

    Technicians

    • No one manages and escalates incidents.
    • Incidents are unnecessarily urgent and more likely to have a greater impact.
    • Agents are flooded with requests to do routine tasks during desk visits.
    • Specialist support staff are subject to constant interruptions.
    • Tickets are lost, incomplete, or escalated incorrectly.
    • Incidents are resolved from scratch rather than referring to existing solutions.

    Managers

    • Tickets are incomplete or lack historical information to address complaints.
    • Tickets in system don’t match the perceived workload.
    • Unable to gather data for budgeting or business analysis.

    Info-Tech Insight

    Consistent incident management processes will improve end-user satisfaction with all other IT services.

    However, be prepared to overcome these common obstacles as you put the process in place, including:

    • Absence of management or staff commitment.
    • Lack of clarity on organizational needs.
    • Outdated work practices.
    • Poorly defined service desk goals and responsibilities.
    • Lack of a reliable knowledgebase.
    • Inadequate training.
    • Resistance to change.

    Prepare to implement or improve incident management

    2.1.1 Review incident management challenges and metrics

    1. Review your incident management challenges and the benefits of addressing them.
    2. Review the level of service you are providing with the current resources. Define clear goals and deliverables for the improvement initiative.
    3. Decide how the incident management process will interface with the service desk. Who will take on the responsibility for resolving incidents? Specifically, who will:
      • Log incidents.
      • Perform initial incident troubleshooting.
      • Own and monitor tickets.
      • Communicate with end users.
      • Update records with the resolution.
      • Close incidents.
      • Implement next steps (e.g. initiate problem management).
    4. Document recommendations and the incident management process requirements in the Service Desk SOP.

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You’ll Need

    • Service Desk SOP
    • Flip Chart
    • Whiteboard

    Distinguish between different kinds of tickets for better SLAs

    Different ticket types are associated with radically different prioritization, routing, and service levels. For instance, most incidents are resolved within a business day, but requests take longer to implement.

    If you fail to distinguish between ticket types, your metrics will obscure service desk performance.

    Common Service Desk Tickets

    • Incidents
      • An unanticipated interruption of a service.
        • The goal of incident management is to restore the service as soon as possible, even if the resolution involves a workaround.
    • Problems
      • The root cause of several incidents.
        • The goal of problem management is to detect the root cause and provide long-term resolution and prevention.
    • Requests
      • A generic description for small changes or service access
        • Requests are small, frequent, and low risk. They are best handled by a process distinct from incident, change, and project management.
    • Changes
      • Modification or removal of anything that could influence IT services.
        • The scope includes significant changes to architectures, processes, tools, metrics, and documentation.

    Info-Tech Insight

    Organizations sometimes mistakenly classify small projects as service requests, which can compromise your data, resulting in a negative impact to the perceived value of the service desk.

    Separate incidents and service requests for increased customer service and better-defined SLAs

    Defining the differences between service requests and incidents is not just for reporting purposes. It also has a major impact on how service is delivered.

    Incidents are unexpected disruptions to normal business processes and require attempts to restore services as soon as possible (e.g. the printer is not working).

    Service requests are tasks that don’t involve something that is broken or has an immediate impact on services. They do not require immediate resolution and can typically be scheduled (e.g. new software).

    Image shows a chart on incidents and service requests.

    Focus on the big picture first to capture and streamline how your organization resolves incidents

    Image displays a flow chart to show how to organize resolving incidents.

    Document your incident management workflow to identify opportunities for improvement

    Image shows a flow cart on how to organize incident management.

    Workflow should include:

    • Ticket creation and closure
    • Triage
    • Troubleshooting
    • Escalations
    • Communications
    • Change management
    • Documentation
    • Vendor escalations

    Notes:

    • Notification and alerts should be used to set or reset expectations on delivery or resolution
    • Identify all the steps where a customer is informed and ensure we are not over or under communicating

    Collaborate to define each step of the incident management workflow

    2.1.2 Define the incident management workflow

    Estimated Time: 60 minutes

    Option 1: Whiteboard

    1. Discuss the workflow and draw it on the whiteboard.
    2. Assess whether you are using the best workflow. Modify it if necessary.
    3. Engage the team in refining the process workflow.
    4. Transfer data to Visio and add to the SOP.

    Option 2: Tabletop Exercise

    1. Distribute index cards to each member of the team.
    2. Have each person write a single task they perform on the index card. Be granular. Include the title or the name of the person responsible.
    3. Mark cards that are decision points. Use a card of a different color or use a marker to make a colored dot.
    4. Arrange the index cards in order, removing duplicates.
    5. Assess whether you are using the best workflow. Engage the team to refine it if necessary.
    6. Transfer data to Visio and add to the Service Desk SOP.

    Participants

    • Service Manager
    • Service Desk Support
    • Applications or Infrastructure Support

    What You’ll Need

    • Flip Chart Paper
    • Sticky Notes
    • Pens
    • Service Desk SOP
    • Project Summary

    Formalize the process for critical incident management to reduce organizational impact

    Discuss these elements to see how the organization will handle them.

    • Communication plan:
      • Who communicates with end users?
      • Who communicates with the executive team?
    • It’s important to separate the role of the technician trying to solve a problem with the need to communicate progress.
    • Change management:
    • Define a separate process for regular and emergency change management to ensure changes are timely and appropriate.
    • Business continuity plan:
    • Identify criteria to decide when a business continuity plan (BCP) must be implemented during a critical incident to minimize the business impact of the incident.
    • Post-mortems:
    • Formalize the process of discussing and documenting lessons learned, understanding outstanding issues, and addressing the root cause of incidents.
    • Source of incident notification:
    • Does the process change if users notify the service desk of an issue or if the systems management tools alert technicians?

    Critical incidents are high-impact, high-urgency events that put the effectiveness and timeliness of the service desk center stage.

    Build a workflow that focuses on quickly bringing together the right people to resolve the incident and reduces the chances of recurrence.

    Document your critical incident management workflow to identify opportunities for improvement

    Image shows a flow cart on how to organize critical incident management.

    Workflow should include:

    • Ticket creation and closure
    • Triage
    • Troubleshooting
    • Escalations
    • Communications plan
    • Change management
    • Disaster recovery or business continuity plan
    • Documentation
    • Vendor escalations
    • Post-mortem

    Collaborate to define each step of the critical incident management workflow

    2.1.3 Define the critical incident management workflow

    Estimated Time: 60 minutes

    Option 1: Whiteboard

    1. Discuss the workflow and draw it on the whiteboard.
    2. Assess whether you are using the best workflow. Modify it if necessary.
    3. Engage the team in refining the process workflow.
    4. Transfer data to Visio and add to the SOP.

    Option 2: Tabletop Exercise

    1. Distribute index cards to each member of the team.
    2. Have each person write a single task they perform on the index card. Be granular. Include the title or the name of the person responsible.
    3. Mark cards that are decision points. Use a card of a different color or use a marker to make a colored dot.
    4. Arrange the index cards in order, removing duplicates.
    5. Assess whether you are using the best workflow. Engage the team to refine it if necessary.
    6. Transfer data to Visio and add to the Service Desk SOP.

    Participants

    • Service Manager
    • Service Desk Support
    • Applications or Infrastructure Support

    What You’ll Need

    • Flip Chart Paper
    • Sticky Notes
    • Pens
    • Service Desk SOP

    Establish a critical incident management communication plan

    When it comes to communicating during major incidents, it’s important to get the information just right. Users don’t want too little, they don’t want too much, they just want what’s relevant to them, and they want that information at the right time.

    As an IT professional, you may not have a background in communications, but it becomes an important part of your job. Broad guidelines for good communication during a critical incident are:

    1. Communicate as broadly as the impact of your incident requires.
    2. Communicate as much detail as a specific audience requires, but no more than necessary.
    3. Communicate as far ahead of impact as possible.

    Why does communication matter?

    Sending the wrong message, at the wrong time, to the wrong stakeholders, can result in:

    • Drop in customer satisfaction.
    • Wasted time and resources from multiple customers contacting you with the same issue.
    • Dissatisfied executives kept in the dark.
    • Increased resolution time if the relevant providers and IT staff are not informed soon enough to help.

    Info-Tech Insight

    End users understand that sometimes things break. What’s important to them is that (1) you don’t repeatedly have the same problem, (2) you keep them informed, and (3) you give them enough notice when their systems will be impacted and when service will be returned.

    Automate communication to save time and deliver consistent messaging to the right stakeholders

    In the middle of resolving a critical incident, the last thing you have time for is worrying about crafting a good message. Create a series of templates to save time by providing automated, tailored messages for each stage of the process that can be quickly altered and sent out to the right stakeholders.

    Once templates are in place, when the incident occurs, it’s simply a matter of:

    1. Choosing the relevant template.
    2. Updating recipients and messaging if necessary.
    3. Adding specific, relevant data and fields.
    4. Sending the message.

    When to communicate?

    Tell users the information they need to know when they need to know it. If a user is directly impacted, tell them that. If the incident does not directly affect the user, the communication may lead to decreased customer satisfaction or failure to pay attention to future relevant messaging.

    What to say?

    • Keep messaging short and to the point.
    • Only say what you know for sure.
    • Provide only the details the audience needs to know to take any necessary action or steps on their side and no more. There’s no need to provide details on the reason for the failure before it’s resolved, though this can be done after resolution and restoration of service.

    You’ll need distinct messages for distinct audiences. For example:

    • To incident resolvers: “Servers X through Y in ABC Location are failing intermittently. Please test the servers and all the connections to determine the exact cause so we can take corrective action ASAP.”
    • To the IT department head: “Servers X through Y in ABC Location are failing intermittently. We are beginning tests. We will let you know when we have determined the exact cause and can give you an estimated completion time.”
    • To executives: “We’re having an issue with some servers at ABC Location. We are testing to determine the cause and will let you know the estimated completion time as soon as possible.”
    • To end users: “We are experience some service issues. We are working on a resolution diligently and will restore service as soon as possible.”

    Map out who will need to be contacted in the event of a critical incident

    2.1.4 Design the critical incident communication plan

    • Identify critical incidents that require communication.
    • Identify stakeholders who will need to be informed about each incident.
    • For each audience, determine:
      1. Frequency of communication
      2. Content of communication
    Use the sample template to the right as an example.

    Some questions to assist you:

    • Whose work will be interrupted, either by their services going down or by their workers having to drop everything to solve the incident?
    • What would happen if we didn’t notify this person?
    • What level of detail do they need?
    • How often would they want to be updated?
    Document outcomes in the Service Desk SOP. Image shows template of unplanned service outage.

    Measure and improve customer satisfaction with the use of relationship and transactional surveys

    Customer experience programs with a combination of relationship and transactional surveys tend to be more effective. Merging the two will give a wholistic picture of the customer experience.

    Relationship Surveys

    Relationship surveys focus on obtaining feedback on the overall customer experience.

    • Inform how well you are doing or where you need improvement in the broad services provided.
    • Provide a high-level perspective on the relationship between the business and IT.
    • Help with strategic improvement decisions.
    • Should be sent over a duration of time and to the entire customer base after they’ve had time to experience all the services provided by the service desk. This can be done as frequently as per quarter or on a yearly basis.
    • E.g. An annual satisfaction survey such as Info-Tech’s End User Satisfaction Diagnostic.

    Transactional Surveys

    Transactional surveys are tied to a specific interaction or transaction your end users have with a specific product or service.

    • Help with tactical improvement decisions.
    • Questions should point to a specific interaction.
    • Usually only a few questions that are quick and easy to complete following the transaction.
    • Since transactional surveys allow you to improve individual relationships, they should be sent shortly after the interaction with the service desk has occurred.
    • E.g. How satisfied are you with the way your ticket was resolved?

    Add transactional end-user surveys at ticket close to escalate unsatisfactory results

    A simple quantitative survey at the closing of a ticket can inform the service desk manager of any issues that were not resolved to the end user’s satisfaction. Take advantage of workflows to escalate poor results immediately for quick follow-up.

    Image shows example of survey question with rating.

    If a more complex survey is required, you may wish to include some of these questions:

    Please rate your overall satisfaction with the way your issue was handled (1=unsatisfactory, 5=fantastic)

    • The professionalism of the analyst.
    • The technical skills or knowledge of the analyst.
    • The timeliness of the service provided.
    • The overall service experience.

    Add an open-ended, qualitative question to put the number in context, and solicit critical feedback:

    What could the service desk have done to improve your experience?

    Define a process to respond to both negative and positive feedback

    Successful customer satisfaction programs respond effectively to both positive and negative outcomes. Late or lack of responses to negative comments may increase customer frustration, while not responding at all to the positive comments may give the perception of indifference. If customers are taking the time to fill out the survey, good or bad, they should be followed up with

    Take these steps to handle survey feedback:

    1. Assign resources to receive, read, and track responses. The entire team doesn’t need to receive every response, while a single resource may not have capacity to respond in a timely manner. Decide what makes the most sense in your environment.
    2. Respond to negative feedback: It may not be possible to respond to every customer that fills out a survey. Set guidelines for responding to negative surveys with no details on the issue; don’t spend time guessing why they were upset, simply ask the user why they were unsatisfied. The critical piece of taking advantage of the service recovery paradox is in the follow-up to the customer.
    3. Investigate and improve: Make sure you investigate the issue to ensure that it is a justified complaint or whether the issue is a symptom of another issue’s root cause. Identify remediation steps to ensure the issue does not repeat itself, and then communicate to the customer the action you have taken to improve.
    4. Act on positive feedback as well: If it’s easy for customers to provide feedback, then make room in your process for handling the positive results. Appreciate the time and effort your customers take to give kudos and use it as a tool to build a long-term relationship with that user. Saying thank you goes a long way and when customers know their time matters, they will be encouraged to fill out those surveys. This is also a good way to show what a great job the service desk team did with the interaction.

    Analyze survey feedback month over month to complement and justify metric results already in place

    When you combine the tracking and analysis of relationship and transactional survey data you will be able to dive into specific issues, identify trends and patterns, assess impact to users, and build a plan to make improvements.

    Once the survey data is centralized, categorized, and available you can start to focus on metrics. At a minimum, for transactional surveys, consider tracking:

    • Breakdown of satisfaction scores with trends over time
    • Unsatisfactory surveys that are related to incidents and service requests
    • Total surveys that have been actioned vs pending

    For relationship surveys, consider tracking:

    • Satisfaction scores by department and seniority level
    • Satisfaction with IT services, applications, and communication
    • Satisfaction with IT’s business enablement

    Scores of overall satisfaction with IT

    Image Source: Info-Tech End User Satisfaction Report

    Prioritize company-wide improvement initiatives by those that have the biggest impact to the entire customer base first and then communicate the plan to the organization using a variety of communication channels that will draw your customers in, e.g. dashboards, newsletters, email alerts.

    Info-Tech Insight

    Consider automating or using your ITSM notification system as a direct communication method to inform the service desk manager of negative survey results.

    Step 2.2: Design ticket categorization

    Image shows the steps in phase 2. Highlight is on step 2.2

    This step will walk you through the following activities:

    • 2.2.1 Assess ticket categorization
    • 2.2.2 Enhance ticket categories with resolution and status codes

    This step involves the following participants:

    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    The reviewed ticket categorization scheme will be easier to use and deploy more consistently, which will improve the categorization of data and the reliability of reports.

    DELIVERABLES

    • Optimized ticket categorization

    Design a ticket classification scheme to produce useful reports

    Reliable reports depend on an effective categorization scheme.

    Too many options cause confusion; too few options provide little value. As you build the classification scheme over the next few slides, let call routing and reporting requirements be your guide.

    Effective classification schemes are concise, easy to use correctly, and easy to maintain.

    Image shows example of a ticket classification scheme.

    Keep these guidelines in mind:

    • A good categorization scheme is exhaustive and mutually exclusive: there’s a place for every ticket and every ticket fits in only one place.
    • As you build your classification scheme, ensure the categories describe the actual asset or service involved based on final resolution, not how it was reported initially.
    • Pre-populate ticket templates with relevant categories to dramatically improve reporting and routing accuracy.
    • Use a tiered system to make the categories easier to navigate. Three tiers with 6-8 categories per tier provides up to 512 sub-categories, which should be enough for the most ambitious team.
    • Track only what you will use for reporting purposes. If you don’t need a report on individual kinds of laptops, don’t create a category beyond “laptops.”
    • Avoid “miscellaneous” categories. A large portion of your tickets will eventually end up there.

    Info-Tech Insight

    Don’t do it alone! Collaborate with managers in the specialized IT groups responsible for root-cause analysis to develop a categorization scheme that makes sense for them.

    The first approach to categorization breaks down the IT portfolio into asset types

    WHY SHOULD I START WITH ASSETS?

    Start with asset types if asset management and configuration management processes figure prominently in your practice or on your service management implementation roadmap.

    Image displays example of asset types and how to categorize them.

    Building the Categories

    Ask these questions:

    • Type: What kind of asset am I working on?
    • Category: What general asset group am I working on?
    • Subcategory: What particular asset am I working on?

    Need to make quick progress? Use Info-Tech Research Group’s Service Desk Ticket Categorization Schemes template.

    Info-Tech Insight

    Think about how you will use the data to determine which components need to be included in reports. If components won’t be used for reporting, routing, or warranty, reporting down to the component level adds little value.

    The second approach to categorization breaks down the IT portfolio into types of services

    WHY SHOULD I START WITH SERVICES?

    Start with asset services if service management generally figures prominently in your practice, especially service catalog management.

    Image displays example of service types and how to categorize them.

    Building the Categories

    Ask these questions:

    • Type: What kind of service am I working on?
    • Category: What general service group am I working on?
    • Subcategory: What particular service am I working on?

    Need to make quick progress? Use Info-Tech Research Group’s Service Desk Ticket Categorization Schemes template.

    Info-Tech Insight

    Remember, ticket categories are not your only source of reports. Enhance the classification scheme with resolution and status codes for more granular reporting.

    Improve the categorization scheme to enhance routing and reporting

    2.2.1 Assess whether the service desk can improve its ticket categorization

    1. As a group, review existing categories, looking for duplicates and designations that won’t affect ticket routing. Reconcile duplicates and remove non-essential categories.
    2. As a group, re-do the categories, ensuring that the new categorization scheme will meet the reporting requirements outlined earlier.
      • Are categories exhaustive and mutually exclusive?
      • Is the tier simple and easy to use (i.e. 3 tiers x 8 categories)?
    3. Test against recent tickets to ensure you have the right categories.
    4. Record the ticket categorization scheme in the Service Desk Ticket Categorization Schemes template.

    A screenshot of the Service Desk Ticket Categorization Schemes template.

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You’ll Need

    • Flip Chart
    • Whiteboard
    • Service Desk Ticket Categorization Scheme

    Enhance the classification scheme with resolution and status codes for more granular reporting

    Resolution codes differ from detailed resolution notes.

    • A resolution code is a field within the ticketing system that should be updated at ticket close to categorize the primary way the ticket was resolved.
    • This is important for reporting purposes as it adds another level to the categorization scheme and can help you identify knowledgebase article candidates, training needs, or problems.

    Ticket statuses are a helpful field for both IT and end users to identify the current status of the ticket and to initiate workflows.

    • The most common statuses are open, pending/in progress, resolved, and closed (note the difference between resolved and closed).
    • Waiting on user or waiting on vendor are also helpful statuses to stop the clock when awaiting further information or input.

    Common Examples:

    Resolution Codes

    • How to/training
    • Configuration change
    • Upgrade
    • Installation
    • Data import/export/change
    • Information/research
    • Reboot

    Status Fields

    • Declined
    • Open
    • Closed
    • Waiting on user
    • Waiting on vendor
    • Reopened by user

    Identify and document resolution and status codes

    2.2.2 Enhance ticket categories with resolution codes

    Discuss:

    • How can we use resolution information to enhance reporting?
    • Are current status fields telling the right story?
    • Are there other requirements like project linking?

    Draft:

    1. Write out proposed resolution codes and status fields and critically assess their value.
    2. Resolutions can be further broken down by incident and service request if desired.
    3. Test resolution codes against a few recent tickets.
    4. Record the ticket categorization scheme in the Service Desk SOP.

    Participants

    • CIO
    • Service Desk Manager
    • Service Desk Technician(s)

    What You’ll Need

    • Whiteboard or Flip Chart
    • Markers

    Step 2.3: Design incident escalation and prioritization

    Image shows the steps in phase 2. Highlight is on step 2.3.

    This step will walk you through the following activities:

    • 2.3.1 Build a small number of rules to facilitate prioritization
    • 2.3.2 Define escalation rules
    • 2.3.3 Define automated escalations
    • 2.3.4 Provide guidance to each tier around escalation steps and times

    This step involves the following participants:

    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    The reviewed ticket escalation and prioritization will streamline queue management, improve the quality of escalations, and ensure agents work on the right tickets at the right time.

    DELIVERABLES

    • Optimized ticket prioritization scheme
    • Guidelines for ticket escalations
    • List of automatic escalations

    Build a ticket prioritization matrix to make escalation assessment less subjective

    Most IT leaders agree that prioritization is one of the most difficult aspects of IT in general. Set priorities based on business needs first.

    Mission-critical systems or problems that affect many people should always come first (i.e. Severity Level 1).

    The bulk of reported problems, however, are often individual problems with desktop PCs (i.e. Severity Level 3 or 4).

    Some questions to consider when deciding on problem severity include:

    • How is productivity affected?
    • How many users are affected?
    • How many systems are affected?
    • How critical are the affected systems to the organization?

    Decide how many severity levels the organization needs the service desk to have. Four levels of severity are ideal for most organizations.

    Image shows example ticket prioritization matrix

    Collect the ticket prioritization scheme in one diagram to ensure service support aligns to business requirements

    Image shows example ticket prioritization matrix

    Prioritize incidents based on severity and urgency to foreground critical issues

    2.3.1 Build a clearly defined priority scheme

    Estimated Time: 60 minutes

    1. Decide how many levels of severity are appropriate for your organization.
    2. Build a prioritization matrix, breaking down priority levels by impact and urgency.
    3. Build out the definitions of impact and urgency to complete the prioritization matrix.
    4. Run through examples of each priority level to make sure everyone is on the same page.

    Image shows example ticket prioritization matrix

    Document in the SOP

    Participants

    • Service Managers
    • Service Desk Support
    • Applications or Infrastructure Support

    What You'll Need

    • Flip Chart Paper
    • Sticky Notes
    • Pens
    • Service Desk SOP

    Example of outcome from 2.3.1

    Define response and resolution targets for each priority level to establish service-level objectives for service support

    Image shows example of response and resolution targets.

    Build clear rules to help agents determine when to escalate

    2.3.2 Assign response, resolution, and escalation times to each priority level

    Estimated Time: 60 minutes

    Instructions:

    For each incident priority level, define the associated:

    1. Response time – time from when incident record is created to the time the service desk acknowledges to the customer that their ticket has been received and assigned.
    2. Resolution time – time from when the incident record is created to the time that the customer has been advised that their problem has been resolved.
    3. Escalation time – maximum amount of time that a ticket should be worked on without progress before being escalated to someone else.

    Participants

    • Service Managers
    • Service Desk Support
    • Applications or Infrastructure Support

    What You'll Need

    • Flip Chart Paper
    • Sticky Notes
    • Pens

    Image shows example of response and resolution targets

    Use the table on the previous slide as a guide.

    Discuss the possible root causes for escalation issues

    WHY IS ESCALATION IMPORTANT?

    Escalation is not about admitting defeat, but about using your resources properly.

    Defining procedures for escalation reduces the amount of time the service desk spends troubleshooting before allocating the incident to a higher service tier. This reduces the mean time to resolve and increases end-user satisfaction.

    You can correlate escalation paths to ticket categories devised in step 2.2.

    Image shows example on potential root causes for escalation issues.

    Build decision rights to help agents determine when to escalate

    2.3.3 Provide guidance to each tier around escalation steps and times

    Estimated Time: 60 minutes

    Instructions

    1. For each support tier, define escalation rules for troubleshooting (steps that each tier should take before escalation).
    2. For each support tier, define maximum escalation times (maximum amount of time to work on a ticket without progress before escalating).
    Example of outcome from step 2.3.3 to determine when to escalate issues.

    Create a list of application specialists to get the escalation right the first time

    2.3.4 Define automated escalations

    Estimated Time: 60 minutes

    1. Identify applications that will require specialists for troubleshooting or access rights.
    2. Identify primary and secondary specialists for each application.
    3. Identify vendors that will receive escalations either immediately or after troubleshooting.
    4. Set up application groups in the service desk tool.
    5. Set up workflows in the service desk tool where appropriate.
    6. Document the automated escalations in the categorization scheme developed in step 2.2 and in the Service Desk Roles and Responsibilities Guide.

    A screenshot of the Service Desk Roles and Responsibilities Guide

    Participants

    • Service Managers
    • Service Desk Support
    • Applications or Infrastructure Support

    What You'll Need

    • Flip Chart Paper
    • Sticky Notes
    • Pens

    Phase 3

    Design Request Fulfilment Processes

    Step 3.1: Build request workflows

    Image shows the steps in phase 3. Highlight is on step 3.1.

    This step will walk you through the following activities:

    • 3.1.1 Distinguish between requests and small projects
    • 3.1.2 Define service requests with SLAs
    • 3.1.3 Build and critique request workflows

    This step involves the following participants:

    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    Workflows for service requests will improve the consistency and quality of service delivery and prepare the service desk to negotiate reliable service levels with the organization.

    DELIVERABLES

    • Workflows for the most common service requests
    • An estimated service level for each service request
    • Request vs. project criteria

    Standardize service requests for more efficient delivery

    Definitions:

    • An incident is an unexpected disruption to normal business processes and requires attempts to restore service as soon as possible (e.g. printer not working).
    • A service request is a request where nothing is broken or impacting a service and typically can be scheduled rather than requiring immediate resolution (e.g. new software application).
    • Service requests are repeatable, predictable, and easier to commit to SLAs.
    • By committing to SLAs, expectations can be set for users and business units for service fulfillment.
    • Workflows for service requests should be documented and reviewed to ensure consistency of fulfillment.
    • Documentation should be created for service request procedures that are complex.
    • Efficiencies can be created through automation such as with software deployment.
    • All service requests can be communicated through a self-service portal or service catalog.

    PREPARE A FUTURE SERVICE CATALOG

    Standardize requests to develop a consistent offering and prepare for a future service catalog.

    Document service requests to identify time to fulfill and approvals.

    Identify which service requests can be auto-approved and which will require a workflow to gain approval.

    Document workflows and analyze them to identify ways to improve SLAs. If any approvals are interrupting technical processes, rearrange them so that approvals happen before the technical team is involved.

    Determine support levels for each service offering and ensure your team can sustain them.

    Where it makes sense, automate delivery of services such as software deployment.

    Distinguish between service requests and small projects to ensure agents and end users follow the right process

    The distinction between service requests and small projects has two use cases, which are two sides of the same resourcing issue.

    • Service desk managers need to understand the difference to ensure the right approval process is followed. Typically, projects have more stringent intake requirements than requests do.
    • PMOs need to understand the difference to ensure the right people are doing the work and that small, frequent changes are standardized, automated, and taken out of the project list.

    What’s the difference between a service request and a small project?

    • The key differences involve resource scope, frequency, and risk.
    • Requests are likely to require fewer resources than projects, be fulfilled more often, and involve less risk.
    • Requests are typically done by tier 1 and 2 employees throughout the IT organization.
    • A request can turn into a small project if the scope of the request grows beyond the bounds of a normal request.

    Example: A mid-sized organization goes on a hiring blitz and needs to onboard 150 new employees in one quarter. Submitting and scheduling 150 requests for onboarding new employees would require much more time and resources.

    Projects are different from service requests and have different criteria

    A project, by terminology, is a temporary endeavor planned around producing a specific organizational or business outcome.

    Common Characteristics of Projects:

    • Time sensitive, temporary, one-off.
    • Uncertainty around how to create the unique thing, product, or service that is the project’s goal.
    • Non-repetitive work and sizeable enough to introduce heightened risk and complexity.
    • Strategic focus, business case-informed capital funding, and execution activities driven by a charter.
    • Introduces change to the organization.
    • Multiple stakeholders involved and cross-functional resourcing.

    Info-Tech Insight

    Projects require greater risk, effort, and resources than a service request and should be redirected to the PMO.

    Standard service requests vs. non-standard service requests: criteria to make them distinct

    • If there is no differentiation between standard and non-standard requests, those tickets can easily move into the backlog, growing it very quickly.
    • Create a process to easily identify non-standard requests when they enter the ticket queue to ensure customers are made aware of any delay of service, especially if it is a product or service currently not offered. This will give time for any approvals or technical solutioning that may need to occur.
    • Take recurring non-standard requests and make them standard. This is a good way to determine if there are any gaps in services offered and another vehicle to understand what your customers want.

    Standard Requests

    • Very common requests, delivered on an on-going basis
    • Defined process
    • Measured in hours or days
    • Uses service catalog, if it exists
    • Formalized and should already be documented
    • The time to deal with the request is defined

    Non-Standard Requests

    • Higher level complexity than standard requests
    • Cannot be fulfilled via service catalog
    • No defined process
    • Not supplied by questions that Service Request Definition (SRD) offers
    • Product or service is not currently offered, and it may need time for technical review, additional approvals, and procurement processes

    The right questions can help you distinguish between standard requests, non-standard requests, and projects

    Where do we draw the line between a standard and non-standard request and a project?

    The service desk can’t and shouldn’t distinguish between requests and projects on its own. Instead, engage stakeholders to determine where to draw the line.

    Whatever criteria you choose, define them carefully.

    Be pragmatic: there is no single best set of criteria and no single best definition for each criterion. The best criteria and definitions will be the ones that work in your organizational context.

    Common distinguishing factors and thresholds:

    Image shows table of the common distinguishing factors and thresholds.

    Distinguish between standard and non-standard service requests and projects

    3.1.1 Distinguish between service requests and projects

    1. Divide the group into two small teams.
    2. Each team will brainstorm examples of service requests and small projects.
    3. Identify factors and thresholds that distinguish between the two groups of items.
    4. Bring the two groups together and discuss the two sets of criteria.
    5. Consolidate one set of criteria that will help make the distinction between projects and service requests.
    6. Capture the table in the Service Desk SOP.

    Image shows blank template of the common distinguishing factors and thresholds.

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You'll Need

    • Service Desk SOP
    • Flip Chart
    • Whiteboard

    Distinguishing factors and thresholds

    Don’t standardize request fulfilment processes alone

    Everyone in IT contributes to the fulfilment of requests, but do they know it?

    New service desk managers sometimes try to standardize request fulfilment processes on their own only to encounter either apathy or significant resistance to change.

    Moving to a tiered generalist service desk with a service-oriented culture, a high first-tier generalist resolution rate, and collaborative T2 and T3 specialists can be a big change. It is critical to get the request workflows right.

    Don’t go it alone. Engage a core team of process champions from all service support. With executive support, the right process building exercises can help you overcome resistance to change.

    Consider running the process building activities in this project phase in a working session or a workshop setting.

    Info-Tech Insight

    If they build it, they will come. Service desk improvement is an exercise in organizational change that crosses IT disciplines. Organizations that fail to engage IT specialists from other silos often encounter resistance to change that jeopardizes the process improvements they are trying to make. Overcome resistance by highlighting how process changes will benefit different groups in IT and solicit the feedback of specialists who can affect or be affected by the changes.

    Define standard service requests with SLAs and workflows

    WHY DO I NEED WORKFLOWS?

    Move approvals out of technical IT processes to make them more efficient. Evaluate all service requests to see where auto-approvals make sense. Where approvals are required, use tools and workflows to manage the process.

    Example:

    Image is an example of SLAs and workflows.

    Approvals can be the main roadblock to fulfilling service requests

    Image is example of workflow approvals.

    Review the general standard service request and inquiry fulfillment processes

    As standard service requests should follow standard, repeatable, and predictable steps to fulfill, they can be documented with workflows.

    Image is a flow chart of service and inquiry request processes.

    Review the general standard service request and inquiry fulfillment processes

    Ensure there is a standard and predictable methodology for assessing non-standard requests; inevitably those requests may still cause delay in fulfillment.

    Create a process to ensure reasonable expectations of delivery can be set with the end user and then identify what technology requests should become part of the existing standard offerings.

    Image is a flowchart of non-standard request processes

    Document service requests to ensure consistent delivery and communicate requirements to users

    3.1.2 Define service requests with SLAs

    1. On a flip chart, list standard service requests.
    2. Identify time required to fulfill, including time to schedule resources.
    3. Identify approvals required; determine if approvals can be automated through defining roles.
    4. Discuss opportunities to reduce SLAs or automate, but recognize that this may not happen right away.
    5. Discuss plans to communicate SLAs to the business units, recognizing that some users may take a bit of time to adapt to the new SLAs.
    6. Work toward improving SLAs as new opportunities for process change occur.
    7. Document SLAs in the Service Desk SOP and update as SLAs change.
    8. Build templates in the service desk tool that encapsulate workflows and routing, SLAs, categorization, and resolution.

    Participants

    • Service Desk Managers
    • Service Desk Agents

    What You'll Need

    • Service Desk SOP
    • Flip Chart
    • Whiteboard

    Info-Tech Insight

    These should all be scheduled services. Anything that is requested as a rush needs to be marked as a higher urgency or priority to track end users who need training on the process.

    Analyze service request workflows to improve service delivery

    3.1.3 Build and critique request workflows

    1. Divide the group into small teams.
    2. Each team will choose one service request from the list created in the previous module and then draw the workflow. Include decision points and approvals.
    3. Discuss availability and technical support:
      • Can the service be fulfilled during regular business hours or 24x7?
      • Is technical support and application access available during regular business hours or 24x7?
    4. Reconvene and present workflows to the group.
    5. Document workflows in Visio and add to the Service Desk SOP. Where appropriate, enter workflows in the service desk tool.

    Critique workflows for efficiencies and effectiveness:

    • Do the workflows support the SLAs identified in the previous exercise?
    • Are the workflows efficient?
    • Is the IT staff consistently following the same workflow?
    • Are approvals appropriate? Is there too much bureaucracy or can some approvals be removed? Can they be preapproved?
    • Are approvals interrupting technical processes? If so, can they be moved?

    Participants

    • Service Desk Managers
    • Service Desk Agents

    What You'll Need

    • Service Desk SOP
    • Project Summary
    • Flip Chart
    • Whiteboard

    Step 3.2: Build a targeted knowledgebase

    Image shows the steps in phase 3. Highlight is on step 3.2.

    This step will walk you through the following activities:

    • 3.2.1 Design knowledge management processes
    • 3.2.2 Create actionable knowledgebase articles

    This step involves the following participants:

    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    The section will introduce service catalogs and get the organization to envision what self-service tools it might include.

    DELIVERABLES

    • Knowledgebase policy and process

    A knowledgebase is an essential tool in the service management toolbox

    Knowledge Management

    Gathering, analyzing, storing & sharing knowledge to reduce the need to rediscover known solutions.

    Knowledgebase

    Organized repository of IT best practices and knowledge gained from practical experiences.

    • End-User KB
    • Give end users a chance to resolve simple issues themselves without submitting a ticket.

    • Internal KB
    • Shared resource for service desk staff and managers to share and use knowledge.

    Use the knowledgebase to document:

    • Steps for pre-escalation troubleshooting.
    • Known errors.
    • Workarounds or solutions to recurring issues.
    • Solutions that require research or complex troubleshooting.
    • Incidents that have many root causes. Start with the most frequent solution and work toward less likely issues.

    Draw on organizational goals to define the knowledge transfer target state

    Image is Info-Tech’s Knowledge Transfer Maturity Model
    *Source: McLean & Company, 2013; N=120

    It’s better to start small than to have nothing at all

    Service desk teams are often overwhelmed by the idea of building and maintaining a comprehensive integrated knowledgebase that covers an extensive amount of information.

    Don’t let this idea stop you from building a knowledgebase! It takes time to build a comprehensive knowledgebase and you must start somewhere.

    Start with existing documentation or knowledge that depends on the expertise of only a few people and is easy to document and you will already see the benefits.

    Then continue to build and improve from there. Eventually, knowledge management will be a part of the culture.

    Engage the team to build a knowledgebase targeted on your most important incidents and requests

    WHERE DO I START?

    Inventory and consolidate existing documentation, then evaluate it for audience relevancy, accuracy, and usability. Use the exercise and the next slides to develop a knowledgebase template.

    Produce a plan to improve the knowledgebase.

    • Identify the current top five or ten incidents from the service desk reports and create related knowledgebase articles.
    • Evaluate for end-user self-service or technician resolution.
    • Note any resolutions that require access rights to servers.
    • Assign documentation creation tasks for the knowledgebase to individual team members each week.
    • Apply only one incident per article.
    • Set goals for each technician to submit one or two meaningful articles per month.
    • Assign a knowledge manager to monitor creation and edit and maintain the database.
    • Set policy to drive currency of the knowledgebase. See the Service Desk SOP for an example of a workable knowledge policy.

    Use a phased approach to build a knowledgebase

    Image is an example of a phased approach to build a knowledge base

    Use a quarterly, phased approach to continue to build and maintain your knowledgebase

    Continual Knowledgebase Maintenance:

    • Once a knowledgebase is in place, future articles should be written using established templates.
    • Articles should be regularly reviewed and monitored for usage. Outdated information will be retired and archived.
    • Ticket trend analysis should be done on an ongoing basis to identify new articles.
    • A proactive approach will anticipate upcoming issues based on planned upgrades and maintenance or other changes, and document resolution steps in knowledgebase articles ahead of time.

    Every Quarter:

    1. Conduct a ticket trend analysis. Identify the most important and common tickets.
    2. Review the knowledgebase to identify relevant articles that need to be revised or written.
    3. Use data from knowledge management tool to track expiring content and lesser used articles.
    4. Assign the task of writing articles to all IT staff members.
    5. Build and revise ticket templates for incident and service requests.

    Assign a knowledge manager role to ensure accountability for knowledgebase maintenance

    Assign a knowledge manager to monitor creation and edit and maintain database.

    Knowledge Manager/Owner Role:

    • Has overall responsibility for the knowledgebase.
    • Ensures content is consistent and maintains standards.
    • Regularly monitors and updates the list of issues that should be added to the knowledgebase.
    • Regularly reviews existing knowledgebase articles to ensure KB is up to date and flags content to retire or review.
    • Assigns content creation tasks.
    • Optimizes knowledgebase structure and organization.
    • See Info-Tech’s knowledge manager role description if you need a hand defining this position.

    The knowledge manager role will likely be a role assigned to an existing resource rather than a dedicated position.

    Develop a template to ensure knowledgebase articles are easy to read and write

    A screenshot of the Knowledgebase Article Template

    QUICK TIPS

    • Use non-technical language whenever possible to help less-technical readers.
    • Identify error messages and use screenshots where it makes sense.
    • Take advantage of social features like voting buttons to increase use.
    • Use Info-Tech’s Knowledge Base Article Template to get you started.

    Analyze the necessary features for your knowledgebase and compare them against existing tools

    Service desk knowledgebases range in complexity from simple FAQs to fully integrated software suites.

    Options include:

    • Article search with negative and positive filters.
    • Tagging, with the option to have keywords generate top matches.
    • Role-based permissions (to prevent unauthorized deletions).
    • Ability to turn a ticket resolution into a knowledgebase article (typically only available if knowledgebase tool is part of the service desk tool).
    • Natural language search.
    • Partitioning so relevant articles only appear for specific audiences.
    • Editorial workflow management.
    • Ability to set alerts for scheduled article review.
    • Article reporting (most viewed, was it useful?).
    • Rich text fields for attaching screenshots.

    Determine which features your organization needs and check to see if your tools have them.

    For more information on knowledgebase improvement, refer to Info-Tech’s Optimize the Service Desk With a Shift-Left Strategy.

    Document your knowledge management maintenance workflow to identify opportunities for improvement

    Workflow should include:

    • How you will identify top articles that need to be written
    • How you will ensure articles remain relevant
    • How you will assign new articles to be written, inclusive of peer review
    Image of flowchart of knowledgebase maintenance process.

    Design knowledgebase management processes

    3.2.1 Design knowledgebase management processes

    1. Assign a knowledge manager to monitor creation and edit and maintain the database. See Info-Tech’s knowledge manager role description if you need a hand defining this position.
    2. Discuss how you can use the service desk tool to integrate the knowledgebase with incident management, request fulfilment, and self-service processes.
    3. Discuss the suitability of a quarterly process to build and edit articles for a target knowledgebase that covers your most important incidents and requests.
    4. Set knowledgebase creation targets for tier 1, 2, and 3 analysts.
    5. Identify relevant performance metrics.
    6. Brainstorm elements that might be used as an incentive program to encourage the creation of knowledgebase articles and knowledge sharing more generally.
    7. Set policy to drive currency of knowledgebase. See the Service Desk SOP for an example of a workable knowledge policy.

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You’ll Need

    • Service Desk SOP
    • Flip Chart
    • Whiteboard

    Create actionable knowledgebase articles

    3.2.2 Run a knowledgebase working group

    Write and critique knowledgebase articles.

    1. On a whiteboard, build a list of potential knowledgebase articles divided by audience: Technician or End User.
    2. Each team member chooses one topic and spends 20 minutes writing.
    3. Each team member either reads the article and has the team critique or passes to the technician to the right for peer review. If there are many participants, break into smaller groups.
    4. Set a goal with the team for how, when, and how often knowledgebase articles will be created.
    5. Capture knowledgebase processes in the Service Desk SOP.

    Audience: Technician

    • Password update
    • VPN printing
    • Active directory – policy, procedures, naming conventions
    • Cell phones
    • VPN client and creation set-up

    Audience: End users

    • Set up email account
    • Password creation policy
    • Voicemail – access, change greeting, activities
    • Best practices for virus, malware, phishing attempts
    • Windows 10 tips and tricks

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You’ll Need

    • Service Desk SOP
    • Flip Chart
    • Whiteboard

    Step 3.3: Prepare for a self-service portal project

    Image shows the steps in phase 3. Highlight is on step 3.3.

    This step will walk you through the following activities:

    • 3.3.1 Develop self-service tools for the end user
    • 3.3.2 Make a plan for creating or improving the self-service portal

    This step involves the following participants:

    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    The section prepares you to tackle a self-service portal project once the service desk standardization is complete.

    DELIVERABLES

    • High-level activities to create a self-service portal

    Design the self-service portal with the users’ computer skills in mind

    A study by the OECD offers a useful reminder of one of usability’s most hard-earned lessons: you are not the user.

    • There is an important difference between IT professionals and the average user that’s even more damaging to your ability to predict what will be a good self-service tool: skills in using computers, the internet, and technology in general.
    • An international research study explored the computer skills of 215,942 people aged 16-65 in 33 countries.
    • The results show that across 33 rich countries, only 5% of the population has strong computer-related abilities and only 33% of people can complete medium-complexity computer tasks.
    • End users are skilled, they just don’t have the same level of comfort with computers as the average IT professional. Design your self-service tools with that fact in mind.
    Image is of a graph showing the ability of computer skills from age 16-65 among various countries.

    Take an incremental and iterative approach to developing your self-service portal

    Use a web portal to offer self-serve functionality or provide FAQ information to your customers to start.

    • Don’t build from scratch. Ideally, use the functionality included with your ITSM tool.
    • If your ITSM tool doesn’t have an adequate self-service portal functionality, then harness other tools that IT already uses. Common examples include Microsoft SharePoint and Google Forms.
    • Make it as easy as possible to access the portal:
      • Deploy an app to managed devices or put the app in your app store.
      • Create a shortcut on people’s start menus or home screens.
      • Print the URL on swag such as mousepads.
    • Follow Info-Tech’s approach to developing your user facing service catalog.

    Some companies use vending machines as a form of self serve. Users can enter their purchase code and “buy” a thin client, mouse, keyboard, software, USB keys, tablet, headphones, or loaners.

    Info-Tech Insight

    Building the basics first will provide your users with immediate value. Incrementally add new features to your portal.

    Optimize the portal: self-service should be faster and more convenient than the alternative

    Design the portal by demand, not supply

    Don’t build a portal framed around current offerings and capabilities just for the sake of it. Build the portal based on what your users want and need if you want them to use it.

    Make user experience a top priority

    The portal should be designed for users to self-serve, and thus self-service must be seamless, clear, and attractive to users.

    Speak your users’ language

    Keep in mind that users may not have high technical literacy or be familiar with terminology that you find commonplace. Use terms that are easy to understand.

    Appeal to both clickers and searchers

    Ensure that users can find what they’re looking for both by browsing the site and by using search functionality.

    Use one central portal for all departments

    If multiple departments (i.e. HR, Finance) use or will use a portal, set up a shared portal so that users won’t have to guess where to go to ask for help.

    You won’t know unless you test

    You will know how to navigate the portal better than anyone, but that doesn’t mean it’s intuitive for a new user. Test the portal with users to collect and incorporate feedback.

    Self-service portal examples (1/2)

    Image is of an example of the self-service portal

    Image source: Cherwell Service Management

    Self-service examples (2/2)

    Image is of an example of the self-service portal

    Image source: Team Dynamix

    Keep the end-user facing knowledgebase relevant with workflows, multi-device access, and social features

    Workflows:

    • Easily manage peer reviews and editorial and relevance review.
    • Enable links and importing between tickets and knowledgebase articles.
    • Enable articles to appear based on ticket content.

    Multi-device access:

    • Encourage users to access self-service.
    • Enable technicians to solve problems from anywhere.

    Social features:

    • Display most popular articles first to solve trending issues.
    • Enable voting to improve usability of articles.
    • Allow collaboration on self-service.

    For more information on building self-service portal, refer to Info-Tech’s Optimize the Service Desk with a Shift-Left Strategy

    Draft a high-level project plan for a self-service portal project

    3.3.1 Draft a high-level project plan for a self-service portal project

    1. Identify stakeholders who can contribute to the project.
      • Who will help with FAQ creation?
      • Who can design the self-service portal?
      • Who needs to sign off on the project?
    2. Identify the high-level tasks that need to be done.
      • How many FAQs need to be created?
      • How will we design the service catalog’s web portal?
      • What might a phased approach look like?
      • How can we break down the project into design, build, and implementation tasks?
      • What is the rough timeline for these tasks?
    3. Capture the high-level activities in the Service Desk Roadmap.

    Participants

    • Service Desk Manager
    • Service Desk Agents

    What You’ll Need

    • Flip Chart
    • Whiteboard
    • Implementation Roadmap

    Once you have a service portal, you can review the business requirements for a service catalog

    A service catalog is a communications device that lists the IT services offered by an organization. The service catalog is designed to enable the creation of a self-service portal for the end user. The portal augments the service desk so analysts can spend time managing incidents and providing technical support.

    The big value comes from workflows:

    • Improved economics and a means to measure the costs to serve over time.
    • Incentive for adoption because things work better.
    • Abstracts delivery from offer to serve so you can outsource, insource, crowdsource, slow, speed, reassign, and cover absences without involving the end user.

    There are three types of catalogs:

    • Static:Informational only, so can be a basic website.
    • Routing and workflow: Attached to service desk tool.
    • Workflow and e-commerce: Integrated with service desk tool and ERP system.
    Image is an example of service catalog

    Image courtesy of University of Victoria

    Understand the time and effort involved in building a service catalog

    A service catalog will streamline IT service delivery, but putting one together requires a significant investment. Service desk standardization comes first.

    • Workflows and back-end services must be in place before setting up a service catalog.
    • Think of the catalog as just the delivery mechanism for service you currently provide. If they aren’t running well and delivery is not consistent, you don’t want to advertise SLAs and options.
    • Service catalogs require maintenance.
    • It’s not a one-time investment – service catalogs must be kept up to date to be useful.
    • Service catalog building requires input from VIPs.
    • Architects and wordsmiths are not the only ones that spend effort on the service catalog. Leadership from IT and the business also provide input on policy and content.

    Sample Service Catalog Efforts

    • A college with 17 IT staff spent one week on a simple service catalog.
    • A law firm with 110 IT staff spent two months on a service catalog project.
    • A municipal government with 300 IT people spent over seven months and has yet to complete the project.
    • A financial organization with 2,000 IT people has spent seven months on service catalog automation alone! The whole project has taken multiple years.

    “I would say a client with 2,000 users and an IT department with a couple of hundred, then you're looking at six months before you have the catalog there.”

    – Service Catalog Implementation Specialist,

    Health Services

    Draft a high-level project plan for a self-service portal project

    3.2.2 Make a plan for creating or improving the self-service portal

    Identify stakeholders who can contribute to the project.

    • Who will help with FAQs creation?
    • Who can design the self-service portal?
    • Who needs to sign off on the project?

    Evaluate tool options.

    • Will you stick with your existing tool or invest in a new tool?

    Identify the high-level tasks that need to be done.

    • How will we design the web portal?
    • What might a phased approach look like?
    • What is the rough timeline for these tasks?
    • How many FAQs need to be created?
    • Will we have a service catalog, and what type?

    Document the plan and tasks in the Service Desk Roadmap.

    Examples of publicly posted service catalogs:

    University of Victoria is an example of a catalog that started simple and now includes multiple divisions, notifications, systems status, communications, e-commerce, incident registration, and more.

    Indiana University is a student, faculty, and staff service catalog and self-service portal that goes beyond IT services.

    If you are ready to start building a service catalog, use Info-Tech’s Design and Build a User-Facing Service Catalog blueprint to get started.

    Phase 4

    Plan the Implementation of the Service Desk

    Step 4.1: Build communication plan

    Image shows the steps in phase 4. Highlight is on step 4.1.

    This step will walk you through the following activities:

    • 4.1.1 Create the communication plan

    This step involves the following participants:

    • CIO
    • IT Director
    • IT Managers
    • Service Desk Manager(s)
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    The communication plan and project summary will help project managers outline recommendations and communicate their benefits.

    DELIVERABLES

    • Communication plan
    • Project summary

    Effectively communicate the game plan to IT to ensure the success of service desk improvements

    Communication is crucial to the integration and overall implementation of your service desk improvement.

    An effective communication plan will:

    • Gain support from management at the project proposal phase.
    • Create end-user buy-in once the program is set to launch.
    • Maintainthe presence of the program throughout the business.
    • Instill ownership throughout the business, from top-level management to new hires.

    Build a communication plan to:

    1. Communicate benefits to IT:
      • Share the standard operating procedures for training and feedback.
      • Train staff on policies as they relate to end users and ensure awareness of all policy changes.
      • As changes are implemented, continue to solicit feedback on what is and is not working and communicate adjustments as appropriate.
    2. Train technicians:
      • Make sure everyone is comfortable communicating changes to customers.
    3. Measure success:
      • Review SLAs and reports. Are you consistently meeting SLAs?
      • Is it safe to communicate with end users?

    Create your communication plan to anticipate challenges, remove obstacles, and secure buy-in

    Why:

    • What problems are you trying to solve?

    What:

    • What processes will it affect (that will affect me)?

    Who:

    • Who will be affected?
    • Who do I go to if I have issues with the new process?
    3 gears are depicted. The top gear is labelled managers with an arrow going clockwise. The middle gear is labelled technical staff with an arrow going counterclockwise. The bottom gear is labelled end users with an arrow going clockwise

    When:

    • When will this be happening?
    • When will it affect me?

    How:

    • How will these changes manifest themselves?

    Goal:

    • What is the final goal?
    • How will it benefit me?

    Create a communication plan to outline the project benefits

    Improved business satisfaction:

    • Improve confidence that the service desk can solve issues within the service-level agreement.
    • Channel incidents and requests through the service desk.
    • Escalate incidents quickly and accurately.

    Fewer recurring issues:

    • Tickets are created for every incident and categorized correctly.
    • Reports can be used for root-cause analysis.

    Increased efficiency or lower cost to serve:

    • Use FAQs to enable end users to self-solve.
    • Use knowledgebase to troubleshoot once, solve many times.
    • Cross-train to improve service consistency.

    Enhanced demand planning:

    • Trend analysis and reporting improve IT’s ability to forecast and address the demands of the business.

    Organize the information to manage the deployment of key messages

    Example of how to organize and manage key messages

    Create the communication plan

    4.1.1 Create the communication plan

    Estimated Time: 45 minutes

    Develop a stakeholder analysis.

    1. Identify everyone affected by the project.
    2. Assess their level of interest, value, and influence.
    3. Develop a communication strategy tailored to their level of engagement.

    Craft key messages tailored to each stakeholder group.

    Finalize the communication plan.

    1. Examine your roadmap and determine the most appropriate timing for communications.
    2. Assess when communications must happen with executives, business unit leaders, end users, and technicians.
    3. Identify any additional communication challenges that have come up.
    4. Identify who will send out the communications.
    5. Identify multiple methods for getting the messages out (newsletters, emails, posters, company meetings).
    6. For inspiration, you can refer to the Sample Communication Plan for the project.

    Participants

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    Step 4.2: Build implementation roadmap

    Image shows the steps in phase 4. Highlight is on step 4.2.

    This step will walk you through the following activities:

    • 4.2.1 Build implementation roadmap

    This step involves the following participants:

    • CIO
    • IT Director
    • IT Managers
    • Service Desk Manager
    • Representation from tier 2 and tier 3 specialists

    Outcomes

    The implementation plan will help track and categorize the next steps and finalize the project.

    DELIVERABLES

    • Implementation roadmap

    Collaborate to create an implementation plan

    4.2.1 Create the implementation plan

    Estimated Time: 45 minutes

    Determine the sequence of improvement initiatives that have been identified throughout the project.

    The purpose of this exercise is to define a timeline and commit to initiatives to reach your goals.

    Instructions:

    1. Review the initiatives that will be taken to improve the service desk and revise tasks, as necessary.
    2. Input each of the tasks in the data entry tab and provide a description and rationale behind the task.
    3. Assign an effort, priority, and cost level to each task (high, medium, low).
    4. Assign ownership to each task.
    5. Identify the timeline for each task based on the priority, effort, and cost (short, medium, and long term).
    6. Highlight risk for each task if it will be deferred.
    7. Track the progress of each task with the status column.

    Participants

    • CIO
    • IT Managers
    • Service Desk Manager
    • Service Desk Agents

    A screenshot of the Roadmap tool.

    Document using the Roadmap tool.

    Related Info-Tech Research

    Standardize the Service Desk

    ImplementHardware and Software Asset Management

    Optimize Change Management Incident and Problem Management Build a Continual Improvement Plan for the Service Desk

    The Standardize blueprint reviews service desk structures and metrics and builds essential processes and workflows for incident management, service request fulfillment, and knowledge management practices.

    Once the service desk is operational, there are three paths to basic ITSM maturity:

    • Having the incident management processes and workflows built allows you to:
      • Introduce Change Management to reduce change-related incidents.
      • Introduce Problem Management to reduce incident recurrence.
      • Introduce Asset Management to augment service management processes with reliable data.

    Solicit targeted department feedback on core IT service capabilities, IT communications, and business enablement. Use the results to assess the satisfaction of end users, with each service broken down by department and seniority level.

    Works cited

    “Help Desk Staffing Models: Simple Analysis Can Save You Money.” Giva, Inc., 2 Sept. 2009. Web.

    Marrone et al. “IT Service Management: A Cross-national Study of ITIL Adoption.” Communications of the Association for Information Systems: Vol. 34, Article 49. 2014. PDF.

    Rumburg, Jeff. “Metric of the Month: First Level Resolution Rate.” MetricNet, 2011. Web.

    “Service Recovery Paradox.” Wikipedia, n.d. Web.

    Tang, Xiaojun, and Yuki Todo. “A Study of Service Desk Setup in Implementing IT Service Management in Enterprises.” Technology and Investment: Vol. 4, pp. 190-196. 2013. PDF.

    “The Survey of Adult Skills (PIAAC).” Organisation for Economic Co-operation and Development (OECD), 2016. Web.

    Contributors

    • Jason Aqui, IT Director, Bellevue College
    • Kevin Sigil, IT Director, Southwest Care Centre
    • Lucas Gutierrez, Service Desk Manager, City of Santa Fe
    • Rama Dhuwaraha, CIO, University of North Texas System
    • Annelie Rugg, CIO, UCLA Humanities
    • Owen McKeith, Manager IT Infrastructure, Canpotex
    • Rod Gula, IT Director, American Realty Association
    • Rosalba Trujillo, Service Desk Manager, Northgate Markets
    • Jason Metcalfe, IT Manager, Mesalabs
    • Bradley Rodgers, IT Manager, SecureTek
    • Daun Costa, IT Manager, Pita Pit
    • Kari Petty, Service Desk Manager, Mansfield Oil
    • Denis Borka, Service Desk Manager, PennTex Midstream
    • Lateef Ashekun, IT Manager, City of Atlanta
    • Ted Zeisner, IT Manager, University of Ottawa Institut de Cardiologie

    Data and Analytics Trends 2023

    • Buy Link or Shortcode: {j2store}208|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • member rating average days saved: Read what our members are saying
    • Parent Category Name: Business Intelligence Strategy
    • Parent Category Link: /business-intelligence-strategy

    Data is a unique resource that keeps growing, presenting opportunities along the way. CIOs and IT leaders can use rapidly evolving technologies and capabilities to harness this data and its value for the organization.

    IT leaders must prepare their teams and operations with the right knowledge, capabilities, and strategies to make sure they remain competitive in 2023 and beyond. Nine trends that expand on the three common Vs of data – volume, velocity, and variety – can help guide the way.

    Focus on trends that align with your opportunities and challenges

    The path to becoming more competitive in a data-driven economy differs from one company to the next. IT leaders should use the data and analytics trends that align most with their organizational goals and can lead to positive business outcomes.

    1. Prioritize your investments: Conduct market analysis and prioritize the data and analytics investments that will be critical to your business.
    2. Build a robust strategy: Identify a clear path between your data vision and business outcomes to build a strategy that’s a good fit for your organization.
    3. Inspire practical innovation: Follow a pragmatic approach to implementing trends that range from data gravity and democratization to data monetization and augmented analytics.

    Data and Analytics Trends 2023 Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Data and Analytics Trends Report 2023 – A report that explores nine data use cases for emerging technologies that can improve on capabilities needed to compete in the data-driven economy.

    Data technologies are rapidly evolving. Understanding data's art of the possible is critical. However, to adapt to these upcoming data trends, a solid data management foundation is required. This report explores nine data trends based on the proven framework of data V's: Volume, Velocity, Variety, Veracity, Value, Virtue, Visualization, Virality, and Viscosity.

    • Data and Analytics Trends Report 2023
    [infographic]

    Further reading

    Data and Analytics Trends Report 2023

    SOONER OR LATER, YOU WILL BE IN THE DATA BUSINESS!

    Nine Data Trends for 2023

    In this report, we explore nine data use cases for emerging technologies that can improve on capabilities needed to compete in the data-driven economy. Use cases combine emerging data trends and modernization of existing capabilities.

    1. VOLUME
      • Data Gravity
    2. VELOCITY
    • Democratizing Real-Time Data
  • VARIETY
    • Augmented Data Management
  • VERACITY
    • Identity Authenticity
  • VALUE
    • Data Monetization
  • VIRTUE
    • Adaptive Data Governance
  • VISUALIZATION
    • AI-Driven Storytelling & Augmented Analytics
  • VIRALITY
    • Data Marketplace
  • VISCOSITY
    • DevOps – DataOps – XOps

    VOLUME

    Data Gravity

    Trend 01 Demand for storage and bandwidth continues to grow

    When organizations begin to prioritize data, they first consider the sheer volume of data, which will influence data system design. Your data systems must consider the existing and growing volume of data by assessing industry initiatives such as digital transformation, Industry 4.0, IoT, consumer digital footprint, etc.

    The largest data center in the world is a citadel in Reno, Nevada, that stretches over 7.2 million square feet!

    Source: Cloudwards, 2022

    IoT devices will generate 79.4 zettabytes of data
    by 2025.

    Source: IDC, 2019

    There were about 97
    zettabytes of data generated worldwide in 2022.

    Source: “Volume of Data,” Statista, 2022

    VOLUME

    Data Gravity

    Data attracts more data and an ecosystem of applications and services

    SharePoint, OneDrive, Google Drive, and Dropbox offer APIs and integration opportunities for developers to enhance their products.

    Social media platforms thought about this early by allowing for an ecosystem of filters, apps, games, and effects that engage their users with little to no additional effort from internal resources.

    The image contains four logos. SharePoint, OneDrive, Google Drive, and Dropbox.

    VOLUME

    Data Gravity

    Focus on data gravity and avoid cloud repatriation

    Data gravity is the tendency of data to attract applications, services, and other data. A growing number of cloud migration decisions will be made based on the data gravity concept. It will become increasingly important in data strategies, with failure potentially resulting in costly cloud repatriations.

    Emerging technologies and capabilities:

    Data Lakehouse, Data Mesh, Data Fabric, Hybrid Data, Cloud Data, Edge Computing

    47%

    Centralized cloud storage going down in 2 years

    22%
    25%

    Hybrid storage (centralized + edge) going up in 2 years

    47%

    Source: CIO, 2022

    VOLUME

    Data Gravity

    What worked for terabytes is ineffective for petabytes

    When compared to on-premises infrastructure, cloud computing is less expensive and easier to implement. However, poor data replication and data gravity can significantly increase cloud costs to the point of failure. Data gravity will help organizations make better cloud migration decisions.

    It is also critical to recognize changes in the industry landscape. The goal of data processing and analytics is to generate the right data for users to act on. In most cases, the user is a human being, but in the case of autonomous driving (AD), the car takes on the role of the user (DXC Technology).

    To avoid cloud repatriation, it will become prudent for all organizations to consider data gravity and the timing of cloud migration.

    The image contains a diagram on data gravity.

    VELOCITY

    Democratizing Real-Time Data

    Trend 02 Real-time analytics presents an important differentiator

    The velocity element of data can be assessed from two standpoints: the speed at which data is being generated and how fast the organization needs to respond to the incoming information through capture, analysis, and use. Traditionally data was processed in a batch format (all at once or in incremental nightly data loads). There is a growing demand to process data continuously using streaming data-processing techniques.

    Emerging technologies and capabilities:

    Edge Computing

    Google announced it has a quantum computer that is 100 million times faster than any classical computer in its lab.

    Source: Science Alert, 2015

    The number of qubits in quantum computers has been increasing dramatically, from 2 qubits in 1998 to 128 qubits in 2019.

    Source: Statista, 2019

    IBM released a 433-qubit quantum chip named Osprey in 2022 and expects to surpass 1,000 qubits with its next chip, Condor, in 2023.

    Source: Nature, 2023

    VELOCITY

    Democratizing Real-Time Data

    Make data accessible to everyone in real time

    • 90% of an organization’s data is replicated or redundant.
    • Build API and web services that allow for live access to data.
    • Most social media platforms, like Twitter and Facebook, have APIs that offer access to incredible amounts of data and insights.

    VELOCITY

    Democratizing Real-Time Data

    Trend in Data Velocity

    Data democratization means data is widely accessible to all stakeholders without bottlenecks or barriers. Success in data democratization comes with ubiquitous real-time analytics. Google highlights a need to address democratization in two different frames:

    1. Democratizing stream analytics for all businesses to ensure real-time data at the company level.
    2. Democratizing stream analytics for all personas and the ability of all users to generate real-time insights.

    Emerging technologies and capabilities:

    Data Lakehouse, Streaming API Ecosystem, Industry 4.0, Zero-Copy Cloning

    Nearly 70% of all new vehicles globally will be connected to the internet by 2023.

    Source: “Connected light-duty vehicles,” Statista, 2022

    VELOCITY

    Democratizing Real-Time Data

    Enable real-time processing with API

    In the past, data democratization has largely translated into a free data set and open data portals. This has allowed the government to freely share data with the public. Also, the data science community has embraced the availability of large data sets such as weather data, stock data, etc. In the future, more focus will be on the combination of IoT and steaming analytics, which will provide better responsiveness and agility.

    Many researchers, media companies, and organizations now have easy access to the Twitter/Facebook API platform to study various aspects of human behavior and sentiments. Large technology companies have already democratized their data using real-time APIs.

    Thousands of sources for open data are available at your local municipalities alone.

    6G will push Wi-Fi connectivity to 1 terabyte per second! This is expected to become commercially available by 2030.

    VARIETY

    Augmented Data Management

    Trend 03 Need to manage unstructured data

    The variety of data types is increasingly diverse. Structured data often comes from relational databases, while unstructured data comes from several sources such as photos, video, text documents, cell phones, etc. The variety of data is where technology can drive business value. However, unstructured data also poses a risk, especially for external data.

    The number of IoT devices could rise to 30.9 billion by 2025.

    Source: “IoT and Non-IoT Connections Worldwide,” Statista, 2022

    The global edge computing market is expected to reach $250.6 billion by 2024.

    Source: “Edge Computing,” Statista, 2022

    Genomics research is expected to generate between 2 and 40 exabytes of data within the next decade.

    Source: NIH, 2022

    VARIETY

    Augmented Data Management

    Employ AI to automate data management

    New tools will enhance many aspects of data management:

    • Data preparation, integration, cataloging, and quality
    • Metadata management
    • Master data management

    Enabling AI-assisted decision-making tools

    The image contains logos of the AI-assisted decision-making tools. Informatica, collibra, OCTOPAI.

    VARIETY

    Augmented Data Management

    Trend in Data Variety

    Augmented data management will enhance or automate data management capabilities by leveraging AI and related advanced techniques. It is quite possible to leverage existing data management tools and techniques, but most experts have recognized that more work and advanced patterns are needed to solve many complex data problems.

    Emerging technologies and capabilities:

    Data Factory, Data Mesh, Data Fabric, Artificial Intelligence, Machine Learning

    VARIETY

    Augmented Data Management

    Data Fabric vs. Data Mesh: The Data Journey continues at an accelerated pace

    Data Fabric

    Data Mesh

    Data fabric is an architecture that facilitates the end-to-end integration of various data pipelines and cloud environments using intelligent and automated systems. It’s a data integration pattern to unify disparate data systems, embed governance, strengthen security and privacy measures, and provide more data accessibility to workers and particularly to business users.

    The data mesh architecture is an approach that aligns data sources by business domains, or functions, with data owners. With data ownership decentralization, data owners can create data products for their respective domains, meaning data consumers, both data scientists and business users, can use a combination of these data products for data analytics and data science.

    More Unstructured Data

    95% of businesses cite the need to manage unstructured data as a problem for their business.

    VERACITY

    Identity Authenticity

    Trend 04 Veracity of data is a true test of your data capabilities

    Data veracity is defined as the accuracy or truthfulness of a data set. More and more data is created in semi-structured and unstructured formats and originates from largely uncontrolled sources (e.g. social media platforms, external sources). The reliability and quality of the data being integrated should be a top concern. The veracity of data is imperative when looking to use data for predictive purposes. For example, energy companies rely heavily on weather patterns to optimize their service outputs, but weather patterns have an element of unpredictability.

    Data quality affects overall labor productivity by as much as 20%, and 30% of operating expenses are due to insufficient data.

    Source: Pragmatic Works, 2017

    Bad data costs up to
    15% to 25% of revenue.

    Source: MIT Sloan Management Review, 2017

    VERACITY

    Identity Authenticity

    Veracity of data is a true test of your data capabilities

    • Stop creating your own identity architectures and instead integrate a tried-and-true platform.
    • Aim for a single source of truth for digital identity.
    • Establish data governance that can withstand scrutiny.
    • Imagine a day in the future where verified accounts on social media platforms are available.
    • Zero-trust architecture should be used.

    VERACITY

    Identity Authenticity

    Trend in Data Veracity

    Veracity is a concept deeply linked to identity. As the value of the data increases, a greater degree of veracity is required: We must provide more proof to open a bank account than to make friends on Facebook. As a result, there is more trust in bank data than in Facebook data. There is also a growing need to protect marginalized communities.

    Emerging technologies and capabilities:

    Zero Trust, Blockchain, Data Governance, IoT, Cybersecurity

    The image contains a screenshot of Info-Tech's blueprint slide on Zero Trust.

    VERACITY

    Identity Authenticity

    The identity discussion is no longer limited to people or organizations. The development of new technologies, such as the IoT phenomenon, will lead to an explosion of objects, from refrigerators to shipping containers, coming online as well. If all these entities start communicating with each other, standards will be needed to establish who or what they are.

    IDENTITY
    IS

    Age

    Gender

    Address

    Fingerprint

    Face

    Voice

    Irises

    IDENTITY
    KNOWS

    Password

    Passphrase

    PIN

    Sequence

    IDENTITY
    HAS

    Access badge

    Smartcard

    Security token

    Mobile phone

    ID document

    IDENTITY
    DOES

    Motor skills

    Handwriting

    Gestures

    Keystrokes

    Applications use

    The IoT market is expected to grow 18% to 14.4 billion in 2022 and 27 billion by 2025.

    Source: IoT Analytics, 2022

    VALUE

    Data Monetization

    Trend 05 Not Many organization know the true value of their data

    Data can be valuable if used effectively or dangerous if mishandled. The rise of the data economy has created significant opportunities but also has its challenges. It has become urgent to understand the value of data, which may vary for stakeholders based on their business model and strategy. Organizations first need to understand ownership of their data by establishing a data strategy, then they must improve data maturity by developing a deeper understanding of data value.

    94% of enterprises say data is essential to business growth.

    Source: Find stack, 2021

    VALUE

    Data Monetization

    Start developing your data business

    • Blockbuster ran its business well, but Netflix transformed the video rental industry overnight!
    • Big players with data are catching up fast.
    • You don’t have to be a giant to monetize data.
    • Data monetization is probably closer than you think.
    • You simply need to find it, catalog it, and deliver it.

    The image contains logos of companies related to data monetization as described in the text above. The companies are Amazon Prime, Netflix, Disney Plus, Blockbuster, and Apple TV.

    VALUE

    Data Monetization

    Trend in Data Value

    Data monetization is the transformation of data into financial value. However, this does not imply selling data alone. Monetary value is produced by using data to improve and upgrade existing and new products and services. Data monetization demands an organization-wide strategy for value development.

    Emerging technologies and capabilities:

    Data Strategy, Data Monetization Strategy, Data Products

    Netflix uses big data to save $1 billion per year on customer retention.

    Source: Logidots, 2021

    VALUE

    Data Monetization

    Data is a strategic asset

    Data is beyond currency, assets, or commodities and needs to be a category
    of its own.

    • Data always outlives people, processes, and technology. They all come and go while data remains.
    • Oil is a limited resource. Data is not. Unlike oil, data is likely to grow over time.
    • Data is likely to outlast all other current popular financial instruments, including currency, assets, or commodities.
    • Data is used internally and externally and can easily be replicated or combined.

    Data monetization is currently in the speculative territory, which is unacceptable. It should instead be guided by sound data management theory.

    VIRTUE

    Adaptive Data Governance

    Trend 06 Five Core Virtues: Resilience, Humility, Grit, Liberal Education, Empathy (Forbes, 2020)

    We have become more and more dependent on data, analytics, and organizational protection policies. Data virtue is about leveraging data securely and ethically. This topic has become more critical with the advent of GDPR, the right to be forgotten, and related regulations. Data governance, which seeks to establish an oversight framework that manages the creation, acquisition, integrity, security, compliance, and quality of data, is essential for any organization that makes decisions about data.

    Cultural obstacles are the greatest barrier to becoming data-driven, according to 91.9% of executives.

    Source: Harvard Business Review, 2022

    Fifty million Facebook profiles were harvested for Cambridge Analytica in a major data breach.

    Source: The Guardian, 2018

    VIRTUE

    Adaptive Data Governance

    Encourage noninvasive and automated data governance

    • Data governance affects the entire organization, not just data.
    • The old model for data governance was slow and clumsy.
    • Adaptive data governance encourages faster decision making and a more collaborative approach to governance.
    • Agile data governance allows for faster and more flexible decision making.
    • Automated data governance will simplify execution across the organization.
    • It is great for compliance, quality, impact tracking, and cross-referencing and offers independence to data users.

    VIRTUE

    Adaptive Data Governance

    Trend in Data Virtue

    Adaptive data governance encourages a flexible approach that allows an organization to employ multiple data governance strategies depending on changing business situations. The other aspect of adaptive data governance is moving away from manual (and often slow) data governance and toward aggressive automation.

    Emerging technologies and capabilities:

    AI-Powered Data Catalog and Metadata Management,
    Automated Data Policy Enforcement

    “To effectively meet the needs and velocity of digital organizations and modern practices, IT governance must be embedded and automated where possible to drive success and value.”

    Source: Valence Howden, Info-Tech Research Group

    “Research reveals that the combination of AI and big data technologies can automate almost 80% of all physical work, 70% of data processing, and 64% of data collection tasks.”

    Source: Forbes, 2021

    VIRTUE

    Data Governance Automation

    Simple and easy Data Governance

    Tools are not the ultimate answer to implementing data governance. You will still need to secure stakeholders' buy-in and engagement in the data process. Data governance automation should be about simplifying the execution of roles and responsibilities.

    “When you can see where your data governance strategy can be improved, it’s time to put in place automation that help to streamline processes.”

    Source: Nintex, 2021

    VISUALIZATION

    AI-Driven Storytelling & Augmented Analytics

    Trend 07 Automated and augmented data storytelling is not that far away

    Today, data storytelling is led by the user. It’s the manual practice of combining narrative with data to deliver insights in a compelling form to assist decision makers in engaging with data and analytics. A story backed by data is more easily consumed and understood than a dashboard, which can be overwhelming. However, manual data storytelling has some major shortcomings.

    Problem # 1: Telling stories on more than just the insights noticed by people

    Problem # 2: Poor data literacy and the limitations of manual self-service

    Problem # 3: Scaling data storytelling across the business

    VISUALIZATION

    AI-Driven Storytelling & Augmented Analytics

    Use AI to enhance data storytelling

    • Tableau, Power BI, and many other applications already use
      AI-driven analytics.
    • Power BI and SharePoint can use AI to generate visuals for any SharePoint list in a matter of seconds.

    VISUALIZATION

    AI-Driven Storytelling & Augmented Analytics

    Trend in Data Visualization

    AI and natural language processing will drive future visualization and data storytelling. These tools and techniques are improving rapidly and are now designed in a streamlined way to guide people in understanding what their data means and how to act on it instead of expecting them to do self-service analysis with dashboards and charts and know what to do next. Ultimately, being able to understand how to translate emotion, tropes, personal interpretation, and experience and how to tell what’s most relevant to each user is the next frontier for augmented and automated analytics

    Emerging technologies and capabilities:

    AI-Powered Data Catalog and Metadata Management,
    Automated Data Policy Enforcement

    VISUALIZATION

    Data Storytelling

    Augmented data storytelling is not that far away

    Emotions are a cornerstone of human intelligence and decision making. Mastering the art of storytelling is not easy.

    Industry experts predict the combination of data storytelling with augmented and automated techniques; these capabilities are more than capable of generating and automating parts of a data story’s creation for end users.

    The next challenge for AI is translating emotion, tropes, personal interpretation, and experience into what is most essential to end users.

    Source: Yellowfin, 2021

    VIRALITY

    Data Marketplace

    Trend 08 Missing data marketplace

    Data virality measures data spread and popularity. However, for data virality to occur, an ecosystem comparable to that of traditional or modern digital marketplaces is required. Organizations must reevaluate their data strategies to ensure investment in appropriate data domains by understanding data virality. Data virality is the exact opposite of dark data.

    Dark data is “all the information companies collect in their regular business processes, don’t use, have no plans to use, but will never throw out.”

    Source: Forbes, 2019

    VIRALITY

    Data Marketplace

    Make data easily accessible

    • Making data accessible to a broader audience is the key to successful virality.
    • Data marketplaces provide a location for you to make your data public.
    • Why do this? Contributing to public data marketplaces builds credibility, just like contributing to public GitHub projects.
    • Big players like Microsoft, Amazon, and Snowflake already do this!
    • Snowflake introduced zero-copy cloning, which allows users to interact with source data without compromising the integrity of the original source.

    The image contains the logos of Microsoft, Amazon, and Snowflake.

    VIRALITY

    Data Marketplace

    Trend in Data Virality

    The data marketplace can be defined as a dynamic marketplace where users decide what has the most value. Companies can gauge which data is most popular based on usage and decide where to invest. Users can shop for data products within the marketplace and then join these products with other ones they’ve created to launch truly powerful data-driven projects.

    Emerging technologies and capabilities:

    AI-Powered Data Catalog and Metadata Management,
    Automated Data Policy Enforcement

    The image contains a screenshot of Info-Tech's Data-as-a-Service (DaaS) Framework.

    “Data is like garbage. You’d better know what you are going to do with it before you collect it.”

    – Mark Twain

    VIRALITY

    Data Marketplace

    Journey from siloed data platforms to dynamic data marketplaces

    Data remains a complex topic due to many missing foundational components and infrastructure. Interoperability, security, quality, discoverability, speed, and ease are some of those missing foundational components that most organizations face daily.

    Data lacks an ecosystem that is comparable to those of traditional assets or commodities. Data must be available in open or closed data marketplaces to measure its value. These data marketplaces are still in their infancy.

    “Data markets are an important component of the data economy that could unleash the full potential of data generated by the digital economy and human activity in general.”

    Source: ITU Journal, 2018

    VISCOSITY

    DevOps – DataOps – XOps

    Trend 09 Increase efficiency by removing bottlenecks

    Compared to water, a fluid with a high viscosity flows more slowly, like honey. Data viscosity measures the resistance to flow in a volume of data. The data resistance may come from other Vs (variety, velocity, etc.).

    VISCOSITY

    DevOps – DataOps – XOps

    Increase efficiency by removing bottlenecks

    Consider XOps for a second. It makes no difference what X is. What's important is matching operational requirements to enterprise capabilities.

    • For example, Operations must meet the demands of Sales – hence SalesOps
      or S&Op.
    • Development resources must meet the demands of Operations – hence DevOps.
    • Finally, Data must also meet the demand of Operations.

    These Operations guys are demanding!!

    VISCOSITY

    DevOps – DataOps – XOps

    Trend in Data Viscosity

    The merger of development (Dev) and IT Operations (Ops) started in software development with the concept of DevOps. Since then, new Ops terms have formed rapidly (AIOps, MLOps, ModelOps, PlatformOps, SalesOps, SecOps, etc.). All these methodologies come from Lean manufacturing principles, which seek to identify waste by focusing on eliminating errors, cycle time, collaboration, and measurement. Buzzwords are distractions, and the focus must be on the underlying goals and principles. XOps goals should include the elimination of errors and improving efficiencies.

    Emerging technologies and capabilities:

    Collaborative Data Management, Automation Tools

    VISCOSITY

    DataOps → Data Observability

    Data observability, a subcomponent of DataOps, is a set of technical practices, cultural norms, and architecture that enables low error rates. Data observability focuses on error rates instead of only measuring data quality at a single point in time.

    Data Quality Dimensions

    • Uniqueness
    • Timeliness
    • Validity
    • Accuracy
    • Consistency

    ERROR RATES

    Lateness: Missing Your SLA

    System Processing Issues

    Code Change That Broke Something

    Data Quality

    What’s next? Go beyond the buzzwords.

    Avoid following trends solely for the sake of following them. It is critical to comprehend the concept and apply it to your industry. Every industry has its own set of problems and opportunities.

    Highlight the data trends (or lack thereof) that have been most beneficial to you in your organizations. Follow Info-Tech’s approach to building a data practice and platform to develop your data capabilities through the establishment of data goals.

    The image contains a screenshot of Info-Tech's Build Your Data Pracrice and Platform.

    Research Authors

    Rajesh Parab Chris Dyck

    Rajesh Parab

    Director, Research & Advisory

    Data and Analytics

    Chris Dyck

    Research Lead

    Data and Analytics

    “Data technologies are rapidly evolving. Understanding what’s possible is critical. Adapting to these upcoming data trends requires a solid data management foundation.”

    – Rajesh Parab

    Contributing Experts

    Carlos Thomas John Walsh

    Carlos Thomas

    Executive Counselor

    Info-Tech Research Group

    John Walsh

    Executive Counselor

    Info-Tech Research Group

    Bibliography

    Bean, Randy. “Why Becoming a Data-Driven Organization Is So Hard.” Harvard Business Review, 24 Feb. 2022. Accessed Oct. 2022.
    Brown, Annie. “Utilizing AI And Big Data To Reduce Costs And Increase Profits In Departments Across An Organization.” Forbes, 13 April 2021.
    Accessed Oct. 2022.
    Burciaga, Aaron. “Five Core Virtues For Data Science And Artificial Intelligence.” Forbes, 27 Feb. 2020. Accessed Aug. 2022.
    Cadwalladr, Carole, and Emma Graham-Harrison. “Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach.”
    The Guardian, 17 March 2018. Accessed Aug. 2022.
    Carlier, Mathilde. “Connected light-duty vehicles as a share of total vehicles in 2023.” Statista, 31 Mar. 2021. Accessed Oct. 2022.
    Carter, Rebekah. “The Ultimate List of Big Data Statistics for 2022.” Findstack, 22 May 2021. Accessed Oct. 2022.
    Castelvecchi, Davide. “Underdog technologies gain ground in quantum-computing race.” Nature, 6 Nov. 2023. Accessed Feb. 2023.
    Clark-Jones, Anthony, et al. “Digital Identity:” UBS, 2016. Accessed Aug 2022.
    “The Cost of Bad Data Infographic.” Pragmatic Works, 25 May 2017. Accessed Oct. 2022.
    Demchenko, Yuri, et al. “Data as Economic Goods: Definitions, Properties, Challenges, Enabling Technologies for Future Data Markets.“ ITU Journal: ICT Discoveries, Special Issue, no. 2, vol. 23, Nov. 2018. Accessed Aug 2022.
    Feldman, Sarah. ”20 Years of Quantum Computing Growth.” Statista, 6 May 2019. Accessed Oct. 2022.
    “Genomic Data Science.” NIH, National Human Genome Research Institute, 5 April 2022. Accessed Oct. 2022.

    Bibliography

    Hasbe, Sudhir, and Ryan Lippert. “The democratization of data and insights: making real-time analytics ubiquitous.” Google Cloud, 15 Jan. 2021.
    Accessed Aug. 2022.
    Helmenstine, Anne. “Viscosity Definition and Examples.” Science Notes, 3 Aug. 2021. Accessed Aug. 2022.
    “How data storytelling and augmented analytics are shaping the future of BI together.” Yellowfin, 19 Aug. 2021. Accessed Aug. 2022.
    “How Netflix Saves $1B Annually using AI?” Logidots, 24 Sept. 2021. Accessed Oct. 2022
    Hui, Kenneth. “The AWS Love/Hate Relationship with Data Gravity.” Cloud Architect Musings, 30 Jan. 2017. Accessed Aug 2022.
    ICD. “The Growth in Connected IoT Devices Is Expected to Generate 79.4ZB of Data in 2025, According to a New IDC Forecast.” Business Wire, 18 June 2019. Accessed Oct 2022.
    Internet of Things (IoT) and non-IoT active device connections worldwide from 2010 to 2025” Statista, 27 Nov. 2022. Accessed Nov. 2022.
    Koch, Gunter. “The critical role of data management for autonomous driving development.” DXC Technology, 2021. Accessed Aug. 2022.
    Morris, John. “The Pull of Data Gravity.” CIO, 23 Feb. 2022. Accessed Aug. 2022.
    Nield, David. “Google's Quantum Computer Is 100 Million Times Faster Than Your Laptop.” ScienceAlert, 9 Dec. 2015. Accessed Oct. 2022.
    Redman, Thomas C. “Seizing Opportunity in Data Quality.” MIT Sloan Management Review, 27 Nov. 2017. Accessed Oct. 2022.
    Segovia Domingo, Ana I., and Álvaro Martín Enríquez. “Digital Identity: the current state of affairs.” BBVA Research, 2018. Accessed Aug. 2022.

    Bibliography

    “State of IoT 2022: Number of connected IoT devices growing 18% to 14.4 billion globally.” IOT Analytics, 18 May 2022. Accessed. 14 Nov. 2022.
    Strod, Eran. “Data Observability and Monitoring with DataOps.” DataKitchen, 10 May 2021. Accessed Aug. 2022.
    Sujay Vailshery, Lionel. “Edge computing market value worldwide 2019-2025.” Statista, 25 Feb. 2022. Accessed Oct 2022.
    Sujay Vailshery, Lionel. “IoT and non-IoT connections worldwide 2010-2025.” Statista, 6 Sept. 2022. Accessed Oct. 2022.
    Sumina, Vladimir. “26 Cloud Computing Statistics, Facts & Trends for 2022.” Cloudwards, 7 June 2022. Accessed Oct. 2022.
    Taulli, Tom. “What You Need To Know About Dark Data.” Forbes, 27 Oct. 2019. Accessed Oct. 2022.
    Taylor, Linnet. “What is data justice? The case for connecting digital rights and freedoms globally.“ Big Data & Society, July-Dec 2017. Accessed Aug 2022.
    “Twitter: Data Collection With API Research Paper.” IvyPanda, 28 April 2022. Accessed Aug. 2022.
    “Using governance automation to reduce data risk.” Nintex, 15 Nov. 2021. Accessed Oct. 2022
    “Volume of data/information created, captured, copied, and consumed worldwide from 2010 to 2020, with forecasts from 2021 to 2025.” Statista, 8 Sept. 2022. Accessed Oct 2022.
    Wang, R. “Monday's Musings: Beyond The Three V's of Big Data – Viscosity and Virality.” Forbes, 27 Feb. 2012. Accessed Aug 2022.
    “What is a data fabric?” IBM, n.d. Accessed Aug 2022.
    Yego, Kip. “Augmented data management: Data fabric versus data mesh.” IBM, 27 April 2022. Accessed Aug 2022.

    Application Maintenance

    • Buy Link or Shortcode: {j2store}30|cart{/j2store}
    • Related Products: {j2store}30|crosssells{/j2store}
    • member rating overall impact: 10.0/10
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Applications
    • Parent Category Link: /applications

    The challenge

    • If you work with application maintenance or operations teams that handle the "run" of your applications, you may find that the sheer volume and variety of requests create large backlogs.
    • Your business and product owners may want scrum or DevOps teams to work on new functionality rather than spend effort on lifecycle management.
    • Increasing complexity and increasing reliance on technology may create unrealistic expectations for your maintenance teams. Business applications must be available around the clock, and new feature roadmaps cannot be side-tracked by maintenance.

    Our advice

    Insight

    • Improving maintenance focus may mean doing less work but create more value. Your teams need to be realistic about what commitments they take—balance maintenance with business value and risk levels.
    • Treat maintenance the same as any other development practice. Use the same intake and prioritization practices. Uphold the same quality standards.

    Impact and results 

    • Justify the necessity of streamlined and regular maintenance. Understand each stakeholder's objectives and concerns, validate them against your staff's current state, processes, and technologies involved.
    • Maintenance and risk go hand in hand. And the business wants to move forward all the time as well. Strengthen your prioritization practice. Use a holistic view of the business and technical impacts, risks, urgencies across the maintenance needs and requests. That allows you to justify their respective positions in the overall development backlog. Identify opportunities to bring some requirements and features together.
    • Build a repeatable process with appropriate governance around it. Ensure that people know their roles and responsibilities and are held accountable.
    • Instill development best-practices into your maintenance processes.

    The roadmap

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    Get started.

    Read our executive brief to understand everyday struggles regarding application maintenance, the root causes, and our methodology to overcome these. We show you how we can support you.

    Understand your maintenance priorities

    Identify your stakeholders and understand their drivers.

    • Streamline Application Maintenance – Phase 1: Assess the Current Maintenance Landscape (ppt)
    • Application Maintenance Operating Model Template (doc)
    • Application Maintenance Resource Capacity Assessment (xls)
    • Application Maintenance Maturity Assessment (xls)

    Define and employ maintenance governance

    Identify the right level of governance appropriate to your company and business context for your application maintenance. That ensures that people uphold standards across maintenance practices.

    • Streamline Application Maintenance – Phase 2: Develop a Maintenance Release Schedule (ppt)

    Enhance your prioritization practices

    Most companies cannot do everything for all applications and systems. Build your maintenance triage and prioritization rules to safeguard your company, maximize business value generation and IT risks and requirements.

    • Streamline Application Maintenance – Phase 3: Optimize Maintenance Capabilities (ppt)

    Streamline your maintenance delivery

    Define quality standards in maintenance practices. Enforce these in alignment with the governance you have set up. Show a high degree of transparency and open discussions on development challenges.

    • Streamline Application Maintenance – Phase 4: Streamline Maintenance Delivery (ppt)
    • Application Maintenance Business Case Presentation Document (ppt)

     

     

    Minimize the Damage of IT Cost Cuts

    • Buy Link or Shortcode: {j2store}53|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Cost & Budget Management
    • Parent Category Link: /cost-and-budget-management
    • Average growth rates for Opex and Capex budgets are expected to continue to decline over the next fiscal year.
    • Common “quick-win” cost-cutting initiatives are not enough to satisfy the organization’s mandate.
    • Cost-cutting initiatives often take longer than expected, failing to provide cost savings before the organization’s deadline.
    • Cost-optimization projects often have unanticipated consequences that offset potential cost savings and result in business dissatisfaction.

    Our Advice

    Critical Insight

    • IT costs affect the entire business, not just IT. For this reason, IT must work with the business collaboratively to convey the full implications of IT cost cuts.
    • Avoid making all your cuts at once; phase your cuts by taking into account the magnitude and urgency of your cuts and avoid unintended consequences.
    • Don’t be afraid to completely cut a service if it should not be delivered in the first place.

    Impact and Result

    • Take a value-based approach to cost optimization.
    • Reduce IT spend while continuing to deliver the most important services.
    • Involve the business in the cost-cutting process.
    • Develop a plan for cost cutting that avoids unintended interruptions to the business.

    Minimize the Damage of IT Cost Cuts Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should take a value-based approach to cutting IT costs, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Understand the mandate and take immediate action

    Determine your approach for cutting costs.

    • Minimize the Damage of IT Cost Cuts – Phase 1: Understand the Mandate and Take Immediate Action
    • Cost-Cutting Plan
    • Cost-Cutting Planning Tool

    2. Select cost-cutting initiatives

    Identify the cost-cutting initiatives and design your roadmap.

    • Minimize the Damage of IT Cost Cuts – Phase 2: Select Cost-Cutting Initiatives

    3. Get approval for your cost-cutting plan and adopt change management best practices

    Communicate your roadmap to the business and attain approval.

    • Minimize the Damage of IT Cost Cuts – Phase 3: Get Approval for Your Cost-Cutting Plan and Adopt Change Management Best Practices
    • IT Personnel Engagement Plan
    • Stakeholder Communication Planning Tool
    [infographic]

    Workshop: Minimize the Damage of IT Cost Cuts

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Understand the Mandate and Take Immediate Action

    The Purpose

    Determine your cost-optimization stance.

    Build momentum with quick wins.

    Key Benefits Achieved

    Understand the internal and external drivers behind your cost-cutting mandate and the types of initiatives that align with it.

    Activities

    1.1 Develop SMART project metrics.

    1.2 Dissect the mandate.

    1.3 Identify your cost-cutting stance.

    1.4 Select and implement quick wins.

    1.5 Plan to report progress to Finance.

    Outputs

    Project metrics and mandate documentation

    List of quick-win initiatives

    2 Select Cost-Cutting Initiatives

    The Purpose

    Create the plan for your cost-cutting initiatives.

    Key Benefits Achieved

    Choose the correct initiatives for your roadmap.

    Create a sensible and intelligent roadmap for the cost-cutting initiatives.

    Activities

    2.1 Identify cost-cutting initiatives.

    2.2 Select initiatives.

    2.3 Build a roadmap.

    Outputs

    High-level cost-cutting initiatives

    Cost-cutting roadmap

    3 Get Approval for Your Cost-Cutting Plan and Adopt Change Management Best Practices

    The Purpose

    Finalize the cost-cutting plan and present it to the business.

    Key Benefits Achieved

    Attain engagement with key stakeholders.

    Activities

    3.1 Customize your cost-cutting plan.

    3.2 Create stakeholder engagement plans.

    3.3 Monitor cost savings.

    Outputs

    Cost-cutting plan

    Stakeholder engagement plan

    Cost-monitoring plan

    Define Service Desk Metrics That Matter

    • Buy Link or Shortcode: {j2store}491|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Service Desk
    • Parent Category Link: /service-desk
    • Consolidate your metrics and assign context and actions to ones currently tracked.
    • Establish tension metrics to see and tell the whole story.
    • Split your metrics for each stakeholder group. Assign proper cadences for measurements as a first step to building an effective dashboard.

    Our Advice

    Critical Insight

    • Identify the metrics that serve a real purpose and eliminate the rest. Establish a formal review process to ensure metrics are still valid, continue to provide the answers needed, and are at a manageable and usable level.

    Impact and Result

    • Tracking goal- and action-based metrics allows you to make meaningful, data-driven decisions for your service desk. You can establish internal benchmarks to set your own baselines.
    • Predefining the audience and cadence of each metric allows you to construct targeted dashboards to aid your metrics analysis.

    Define Service Desk Metrics That Matter Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define Service Desk Metrics That Matter Storyboard – A deck that shows you how to look beyond benchmarks and rely on internal metrics to drive success.

    Deciding which service desk metrics to track and how to analyze them can be daunting. Use this deck to narrow down your goal-oriented metrics as a starting point and set your own benchmarks.

    • Define Service Desk Metrics That Matter Storyboard

    2. Service Desk Metrics Workbook – A tool to organize your service desk metrics.

    For each metric, consider adding the relevant overall goal, audience, cadence, and action. Use the audience and cadence of the metric to split your tracked metrics into various dashboards. Your final list of metrics and reports can be added to your service desk SOP.

    • Service Desk Metrics Workbook
    [infographic]

    Further reading

    Define Service Desk Metrics That Matter

    Look beyond benchmarks and rely on internal metrics to drive success.

    Analyst Perspective

    Don’t get paralyzed by benchmarks when establishing metrics

    When establishing a suite of metrics to track, it’s tempting to start with the metrics measured by other organizations. Naturally, benchmarking will enter the conversation. While benchmarking is useful, measuring you organization against others with a lack of context will only highlight your failures. Furthermore, benchmarks will highlight the norm or common practice. It does not necessarily highlight best practice.

    Keeping the limitations of benchmarking in mind, establish your own metrics suite with action-based metrics. Define the audience, cadence, and actions for each metric you track and pair them with business goals. Measure only what you need to.

    Slowly improve your metrics process over time and analyze your environment using your own data as your benchmark.

    Benedict Chang

    Research Analyst, Infrastructure & Operations

    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • Measure the business value provided by the service desk.
    • Consolidate your metrics and assign context and actions to ones currently tracked.
    • Establish tension metrics to see and tell the whole story.
    • Split your metrics for each stakeholder group. Assign proper cadences for measurements as a first step to building an effective dashboard or effective dashboards.

    Common Obstacles

    • Becoming too focused on benchmarks or unidimensional metrics (e.g. cost, first-contact resolution, time to resolve) can lead to misinterpretation of the data and poorly informed actions.
    • Sifting through the many sources of data post hoc can lead to stalling in data analysis or slow reaction times to poor metrics.
    • Dashboards can quickly become cluttered with uninformative metrics, thus reducing the signal-to-noise ratio of meaningful data.

    Info-Tech's Approach

    • Use metrics that drive productive change and improvement. Track only what you need to report on.
    • Ensure each metric aligns with the desired business goal, is action-based, and includes the answers to what, why, how, and who.
    • Establish internal benchmarks by analyzing the trends from your own data to set baselines.
    • Act on the results of your metrics by adjusting targets and measuring success.

    Info-Tech Insight

    Identify the metrics that serve a real purpose and eliminate the rest. Establish a formal review process to ensure metrics are still valid, continue to provide the answers needed, and are at a manageable and usable level.

    Improve your metrics to align IT with strategic business goals

    The right metrics can tell the business how hard IT works and how well they perform.

    • Only 19% of CXOs feel that their organization is effective at measuring the success of IT projects with their current metrics.
    • Implementing the proper metrics can facilitate communication between the business division and IT practice.
    • The proper metrics can help IT know what issues the business has and how the CEO and CIO should tackle them.
    • If the goals above resonate with your organization, our blueprint Take Control of Infrastructure and Operations Metrics will take you through the right steps.

    Current Metrics Suite

    19% Effective

    36% Some Improvement Necessary

    45% Significant Improvement Necessary

    Source: Info-Tech Research Group’s CEO/CIO Alignment Diagnostic, 2019; N=622

    CXOs stress that value is the most critical area for IT to improve in reporting

    • You most likely have to improve your metrics suite by addressing business value.
    • Over 80% of organizations say they need improvement to their business value metrics, with 32% of organizations reporting that significant improvement is needed.
    • Of course, measuring metrics for service desk operations is important, but don’t forget business-oriented metrics such as measuring knowledgebase articles written for shift-left enablement, cost (time and money) of service desk tickets, and overall end-user satisfaction.

    The image shows a bar graph with percentages on the Y-Acis, and the following categories on the X-Axis: Business value metrics; Stakeholder satisfaction reporting; Risk metrics; Technology performance & operating metrics; Cost & Salary metrics; and Ad hoc feedback from executives and staff. Each bar is split into two sections, with the blue section marked a Significant Improvement Necessary, and the purple section labelled Some Improvement necessary. Two sections are highlighted with red circles: Business Value metrics--32% blue; 52% purple; and Technology performance & operating metrics--23% blue and 51% purple.

    Source: Info-Tech Research Group’s CEO/CIO Alignment Diagnostic, 2019; N=622

    Benchmarking used in isolation will not tell the whole story

    Benchmarks can be used as a step in the metrics process

    They can be the first step to reach an end goal, but if benchmarks are observed in isolation, it will only highlight your failures.

    Benchmarking relies on standardized models

    This does not account for all the unique variables that make up an IT organization.

    For example, benchmarks that include cost and revenue may include organizations that prioritize first-call resolution (FCR), but the variables that make up this benchmark model will be quite different within your own organization.

    Info-Tech Insight

    Benchmarks reflect the norm and common practice, not best practice.

    Benchmarks are open to interpretation

    Taking the time to establish proper metrics is often more valuable time spent than going down the benchmark rabbit hole.

    Being above or below the norm is neither a good nor a bad thing.

    Determining what the results mean for you depends on what’s being measured and the unique factors, characteristics, and priorities in your organization.

    If benchmark data is a priority within your IT organization, you may look up organizations like MetricNet, but keep the following in mind:

    Review the collected benchmark data

    See where IT organizations in your industry typically stand in relation to the overall benchmark.

    Assess the gaps

    Large gaps between yourself and the overall benchmark could indicate areas for improvement or celebration. Use the data to focus your analysis, develop deeper self-awareness, and prioritize areas for potential concern.

    Benchmarks are only guidelines

    The benchmark source data may not come from true peers in every sense. Each organization is different, so always explore your unique context when interpreting any findings.

    Rely on internal metrics to measure and improve performance

    Measure internal metrics over time to define goals and drive real improvement

    • Internally measured metrics are more reliable because they provide information about your actual performance over time. This allows for targeted improvements and objective measurements of your milestones.
    • Whether a given metric is the right one for your service desk will depend on several different factors, including:
      • The maturity and capability of your service desk processes
      • The volume of service requests and incidents
      • The complexity of your environment when resolving tickets
      • The degree to which your end users are comfortable with self-service

    Take Info-Tech’s approach to metrics management

    Use metrics that drive productive change and improvement. Track only what you need to report on.

    Ensure each metric aligns with the desired business goal, is action-based, and includes the answers to what, why, how, and who.

    Establish internal benchmarks by analyzing the trends from your own data to set baselines.

    Act on the results of your metrics by adjusting targets and measuring success.

    Define action-based metrics to cut down on analysis paralysis

    Every metric needs to be backed with the following criteria:

    • Defining audience, cadence, goal, and action for each metric allows you to keep your tracked metrics to a minimum while maximizing the value.
    • The audience and cadence of each metric may allow you to define targeted dashboards.

    Audience - Who is this metric tracked for?

    Goal - Why are you tracking this metric? This can be defined along with the CSFs and KPIs.

    Cadence - How often are you going to view, analyze, and action this metric?

    Action - What will you do if this metric spikes, dips, trends up, or trends down?

    Activity 1. Define your critical success factors and key performance indicators

    Critical success factors (CSFs) are high-level goals that help you define the direction of your service desk. Key performance indicators (KPIs) can be treated as the trend of metrics that will indicate that you are moving in the direction of your CSFs. These will help narrow the data you have to track and action (metrics).

    CSFs, or your overall goals, typically revolve around three aspects of the service desk: time spent on tickets, resources spent on tickets, and the quality of service provided.

    1. As a group, brainstorm the CSFs and the KPIs that will help narrow your metrics. Use the Service Desk Metrics Workbook to record the results.
    2. Look at the example to the right as a starting point.

    Example metrics:

    Critical success factor Key performance indicator
    High End-User Satisfaction Increasing CSAT score on transactional surveys
    High end-user satisfaction score
    Proper resolution of tickets
    Low time to resolve
    Low Cost per Ticket Decreasing cost per ticket (due to efficient resolution, FCR, automation, self-service, etc.)
    Improve Access to Self-Service (tangential to improve customer service) High utilization of knowledgebase
    High utilization of portal

    Download the Service Desk Metrics Workbook

    Activity 2. Define action-based metrics that align with your KPIs and CSFs

    1. Now that you have defined your goals, continue to fill the workbook by choosing metrics that align with those goals.
    2. Use the chart below as a guide. For every metric, define the cadence of measurement, audience of the metric, and action associated with the metric. There may be multiple metrics for each KPI.
    3. If you find you are unable to define the cadence, audience, or action associated with a metric, you may not need to track the metric in the first place. Alternatively, if you find that you may action a metric in the future, you can decide to start gathering data now.

    Example metrics:

    Critical success factor Key performance indicator Metric Cadence Audience Action
    High End-User Satisfaction Increasing CSAT score on transactional surveys Monthly average of ticket satisfaction scores Monthly Management Action low scores immediately, view long-term trends
    High end-user satisfaction score Average end-user satisfaction score from annual survey Annually IT Leadership View IT satisfaction trends to align IT with business direction
    Proper resolution of tickets Number of tickets reopened Weekly Service Desk Technicians Action reopened tickets, look for training opportunities
    SLA breach rate Daily Service Desk Technicians Action reopened tickets, look for training opportunities
    Low time to resolve Average TTR (incidents) Weekly Management Look for trends to monitor resources
    Average TTR by priority Weekly Management Look for TTR solve rates to align with SLA
    Average TTR by tier Weekly Management Look for improperly escalated tickets or shift-left opportunities

    Download the Service Desk Metrics Workbook

    Activity 3. Define the data ownership, metric viability, and dashboards

    1. For each metric, define where the data is housed. Ideally, the data is directly in the ticketing tool or ITSM tool. This will make it easy to pull and analyze.
    2. Determine how difficult the metric will be to pull or track. If the effort is high, decide if the value of tracking the metric is worth the hassle of gathering it.
    3. Lastly, for each metric, use the cadence and audience to place the metric in a reporting dashboard. This will help divide your metrics and make them easier to report and action.
    4. You may use the output of this exercise to add your tracked metrics to your service desk SOP.
    5. A full suite of metrics can be found in our Infrastructure & Operations Metrics Library in the Take Control of Infrastructure Metrics Storyboard. The metrics have been categorized by low, medium, and advanced capabilities for you.

    Example metrics:

    Metric Who Owns the Data? Efforts to Track? Dashboards
    Monthly average of ticket satisfaction scores Service Desk Low Monthly Management Meeting
    Average end-user satisfaction score Service Desk Low Leadership Meeting
    Number of tickets reopened Service Desk Low Weekly Technician Standup
    SLA breach rate Service Desk Low Daily Technician Standup
    Average TTR (incidents) Service Desk Low Weekly Technician Standup
    Average TTR by priority Service Desk Low Weekly Technician Standup
    Average TTR by tier Service Desk Low Weekly Technician Standup
    Average TTR (SRs) Service Desk Low Weekly Technician Standup
    Number of tickets reopened Service Desk Low Daily Technician Standup

    Download the Service Desk Metrics Workbook

    Keep the following considerations in mind when defining which metrics matter

    Keep the customer in mind

    Metrics are typically focused on transactional efficiency and process effectiveness and not what was achieved against the customers’ need and satisfaction.

    Understand the relationships between performance and metrics management to provide the end-to-end service delivery picture you are aiming to achieve.

    Don’t settle for tool defaults

    ITSM solutions offer an abundance of metrics to choose from. The most common ones are typically built into the reporting modules of the tool suite.

    Do not start tracking everything. Choose metrics that are specifically aligned to your organization’s desired business outcomes.

    Establish tension metrics to achieve balance

    Don’t ignore the correlation and context between the suites of metrics chosen and how one interacts and affects the other.

    Measuring metrics in isolation may lead to an incomplete picture or undesired technician behavior. Tension metrics help complete the picture and lead to proper actions.

    Adjust those targets

    An arbitrary target on a metric that is consistently met month over month is useless. Each metric should inform the overall performance by combining capable service level management and customer experience programs to prove the value IT is providing to the organization.

    Related Info-Tech Research

    Standardize the Service Desk

    This project will help you build and improve essential service desk processes, including incident management, request fulfillment, and knowledge management, to create a sustainable service desk.

    Take Control of Infrastructure and Operations Metrics

    Make faster decisions and improve service delivery by using the right metrics for the job.

    Analyze Your Service Desk Ticket Data

    Take a data-driven approach to service desk optimization.

    IT Diagnostics: Build a Data-Driven IT Strategy

    Our data-driven programs ask business and IT stakeholders the right questions to ensure you have the inputs necessary to build an effective IT strategy.

    Streamline Your Workforce During a Pandemic

    • Buy Link or Shortcode: {j2store}515|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Lead
    • Parent Category Link: /lead

    Reduced infection rates in compromised areas are providing hope that these difficult times will pass. However, organizations are facing harsh realities in real time. With significant reductions in revenue, employers are facing pressure to quickly implement cost-cutting strategies, resulting in mass layoffs of valuable employees.

    Our Advice

    Critical Insight

    Employees are an organization’s greatest asset. When faced with cost-cutting pressures, look for redeployment opportunities that use talent as a resource to get through hard times before resorting to difficult layoff decisions.

    Impact and Result

    Make the most of your workforce in this unprecedented situation by following McLean & Company’s process to initiate redeployment efforts and reduce costs. If all else fails, follow our guidance on planning for layoffs and considerations when doing so.

    Streamline Your Workforce During a Pandemic Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Meet with leadership

    Set a strategy with senior leadership, brainstorm underused and understaffed employee segments and departments, then determine an approach to redeployments and layoffs.

    • Streamline Your Workforce During a Pandemic Storyboard
    • Redeployment and Layoff Strategy Workbook

    2. Plan individual and department redeployment

    Collect key information, prepare and redeploy, and roll up information across the organization.

    • Short-Term Survival Segment Evaluation Tool
    • Skills Inventory for Redeployment Tool
    • Redeployment Action and Communication Plan
    • Crisis Communication Guide for HR
    • Crisis Communication Guide for Leaders
    • Leadership Crisis Communication Guide Template
    • 3i's of Engaging Management – Manager Guide
    • Feedback and Coaching Guide for Managers
    • Redeployment Communication Roll-up Template

    3. Plan individual and department layoffs

    Plan for layoffs, execute on the layoff plan, and communicate to employees.

    • Employee Departure Checklist Tool
    • 10 Communication Best Practices in the Face of Crisis
    • Termination Logistics Tool
    • Termination Costing Tool
    • COVID-19: Employee-Facing Frequently Asked Questions Template
    • COVID-19: Employee-Facing Frequently Asked Questions
    • Standard Internal Communications Plan

    4. Monitor and manage departmental effectiveness

    Monitor departmental performance, review organizational performance, and determine next steps.

    • HR Metrics Library
    • Standard HR Scorecard
    [infographic]

    2023-Q1 Research Agenda

    This 2023-Q1 research agenda slide deck provides you with a comprehensive overview of our most up-to-date published research. Each piece offers you valuable insights, allowing you to take effective decisions and informed actions. All TY|Info-tech research is backed by our team of expert analysts who share decades of IT and industry experience.

    Register to read more …

    Identify and Manage Reputational Risk Impacts on Your Organization

    • Buy Link or Shortcode: {j2store}220|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management

    Access to information about companies is more available to consumers than ever. Organizations must implement mechanisms to monitor and manage how information is perceived to avoid potentially disastrous consequences to their brand reputation.

    A negative event could impact your organization's reputation at any given time. Make sure you understand where such events may come from and have a plan to manage the inevitable consequences.

    Our Advice

    Critical Insight

    • Identifying and managing a vendor’s potential impact on your organization’s reputation requires efforts from multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how social media can affect your brand.
    • Organizational leadership is often caught unaware during crises, and their response plans lack the flexibility to adjust to significant market upheavals.

    Impact and Result

    • Vendor management practices educate organizations on the different potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Prioritize and classify your vendors with quantifiable, standardized rankings.
    • Prioritize focus on your high-risk vendors.
    • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

    Identify and Manage Reputational Risk Impacts on Your Organization Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify and Manage Reputational Risk Impacts on Your Organization Deck – Use the research to better understand the negative impacts of vendor actions on your brand reputation.

    Use this research to identify and quantify the potential reputational impacts caused by vendors. Use Info-Tech's approach to look at the reputational impact from various perspectives to better prepare for issues that may arise.

    • Identify and Manage Reputational Risk Impacts on Your Organization Storyboard

    2. Reputational Risk Impact Tool – Use this tool to help identify and quantify the reputational impacts of negative vendor actions.

    By playing the “what if” game and asking probing questions to draw out – or eliminate - possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    • Reputational Risk Impact Tool
    [infographic]

    Further reading

    Identify and Manage Reputational Risk Impacts on Your Organization

    Brand reputation is the most valuable asset an organization can protect.

    Analyst Perspective

    Organizations must diligently assess and protect their reputations, both in the market and internally.

    Social media, unprecedented access to good and bad information, and consumer reliance on others’ online opinions force organizations to dedicate more resources to protecting their brand reputation than ever before. Perceptions matter, and you should monitor and protect the perception of your organization with as much rigor as possible to ensure your brand remains recognizable and trusted.

    Photo of Frank Sewell, Research Director, Vendor Management, Info-Tech Research Group.

    Frank Sewell
    Research Director, Vendor Management
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Access to information about companies is more available to consumers than ever. A negative event could impact your organizational reputation at any time. As a result, organizations must implement mechanisms to monitor and manage how information is perceived to avoid potentially disastrous consequences to their brand reputation.

    Make sure you understand where negative events may come from and have a plan to manage the inevitable consequences.

    Common Obstacles

    Identifying and managing a vendor’s potential impact on your organization’s reputation requires efforts from multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how social media can affect your brand.

    Organizational leadership is often caught unaware during crises, and their response plans lack the flexibility to adjust to significant market upheavals.

    Info-Tech’s Approach

    Vendor management practices educate organizations on the different potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.

    Prioritize and classify your vendors with quantifiable, standardized rankings.

    Prioritize focus on your high-risk vendors.

    Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

    Info-Tech Insight

    Organizations must evolve their risk assessments to be more adaptive to respond to rapid changes in online media. Ongoing monitoring of social media and the vendors tied to their company is imperative to achieving success and avoiding reputational disasters.

    Info-Tech’s multi-blueprint series on vendor risk assessment

    There are many individual components of vendor risk beyond cybersecurity.

    Cube with each multiple colors on each face, similar to a Rubix cube, and individual components of vendor risk branching off of it: 'Financial', 'Reputational', 'Operational', 'Strategic', 'Security', and 'Regulatory & Compliance'.

    This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

    Out of scope:
    This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

    Reputational risk impacts

    Potential losses to the organization due to risks to its reputation and brand

    In this blueprint, we’ll explore reputational risks (risks to the brand reputation of the organization) and their impacts.

    Identify potentially negative events to assess the overall impact on your organization and implement adaptive measures to respond and correct.

    Cube with each multiple colors on each face, similar to a Rubix cube, and the vendor risk component 'Reputational' highlighted.

    Protect your most valuable asset: your brand

    25%

    of a company’s market value is due to reputation (Transmission Private, 2021)

    94%

    of consumers say that a bad review has convinced them to avoid a business (ReviewTrackers, 2022)

    14 hours

    is the average time it takes for a false claim to be corrected on social media (Risk Analysis, 2018)
    Image of an umbrella covering the word 'BRAND' and three arrows approaching from above.

    What is brand recognition?

    And the cost of rebranding

    Brand recognition is the ability of consumers to recognize an identifying characteristic of one company versus a competitor.” (Investopedia)

    Most trademark valuation is based directly on its projected future earning power, based on income history. For a new brand with no history, evaluators must apply experience and common sense to predict the brand's earning potential. They can also use feedback from industry experts, market surveys, and other studies.” (UpCounsel)

    The cost of rebranding for small to medium businesses is about 10 to 20% of the recommended overall marketing budget and can take six to eight months (Ignyte).

    Stock image of a house with a money sign chimney.

    "All we are at our core is our reputation and our brand, and they are intertwined." (Phil Bode, Principal Research Director, Info-Tech Research Group)

    What your vendor associations say about you

    Arrows of multiple colors coalescing in an Earth labelled 'Your Brand', and then a red arrow that reads 'Reputation' points to the terms on the right.

    Bad Customer Reviews

    Breach of Data

    Poor Security Posture

    Negative News Articles

    Public Lawsuits

    Poor Performance

    How a major vendor protects its brand

    An ideal state
    • There is a dedicated brand protection department.
    • All employees are educated annually on brand protection policies and procedures.
    • Brand protection is tied to cybersecurity.
    • The organization actively monitors its brand and reputation through various media formats.
    • The organization has criteria for assessing x-party vendors and holds them accountable through ongoing monitoring and validation of their activities.

    Brand Protection
    Done Right

    Sticker for a '5 Star Rating'.

    Never underestimate the power of local media on your profits

    Info-Tech Insight

    Keep in mind that too much exposure to media can be a negative in that it heightens the awareness of your organization to outside actors. If you do go through a period of increased exposure, make sure to advance your monitoring practices and vigilance.

    Story: Restaurant data breach

    Losing customer faith

    A popular local restaurant’s point of service (POS) machines were breached and the credit card data of their customers over a two-week period was stolen. The restaurant did the right thing: they privately notified the affected people, helped them set up credit monitoring services, and replaced their compromised POS system.

    Unfortunately, the local newspaper got wind of the breach. It published the story, leaving out that the restaurant had already notified affected customers and had replaced their POS machines.

    In response, the restaurant launched a campaign in the local paper and on social media to repair their reputation in the community and reassure people that they could safely transact at their business.

    For at least a month, the restaurant experienced a drastic decrease in revenue as customers either refused to come in to eat or paid only in cash. During this same period the restaurant was spending outside their budget on the advertising.
    Broken trust.

    Story: Monitor your subcontractors

    Trust but verify

    A successful general contractor with a reputation for fairness in their dealings needed a specialist to perform some expert carpentry work for a few of their clients.

    The contractor gave the specialist the clients’ contact information and trusted them to arrange the work.

    Weeks later, the contractor checked in with the clients and received a ton of negative feedback:

    • The specialist called them once and never called back.
    • The specialist refused to do the work as described and wanted to charge extra.
    • The specialist performed work to “fix” the issue but cut corners to lessen their costs.

    As a result, the contractor took extreme measures to regain the clients’ confidence and trust and lost other opportunities in the process.

    Stock image of a sad construction site supervisor.

    You work hard for your reputation. Don’t let others ruin it.

    Don’t forget to look within as well as without

    Stock image of a frustrated desk worker.

    Story: Internal reputation is vital

    Trust works both ways

    An organization’s relatively new IT and InfoSec department leadership have been upgrading the organization's systems and policies as fast as resources allow when the organization encounters a major breach of security.

    Trust in the developing IT and InfoSec departments' leadership wanes throughout the organization as people search for the root cause and blame the systems. This degradation of trust limits the effectiveness of the newly implemented process, procedures, and tools of the departments.

    The new leaders' abilities are called into question, and they must now rigorously defend and justify their decisions and positions to the executives and board.

    It will be some time before the two departments gain their prior trust and respect, and the new leaders face some tough times ahead regaining the organization's confidence.

    How could the new leaders approach the situation to mend their reputations in the wake of this (perhaps unfair) reputational hit?

    It is not enough to identify the potential risks; there must also be adequate controls in place to monitor and manage them

    Stock image of a fingerprint on a computer chip under a blacklight.

    Identify, manage, and monitor reputational risks

    Global markets
    • Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
    • Now more than ever, organizations need to be mindful of the larger global landscape and how their interactions within various regions can impact their reputation.
    Social media
    • Understanding how to monitor social media activity and online content will give you an edge in the current environment.
    • Changes in social media generally happen faster than companies can recognize them. If you are not actively monitoring those risks, the damage could set in before you even have a chance to respond.
    Global shortages
    • Organizations need to accept that shortages will recur periodically and that preparing for them will significantly increase the success potential of long-term plans.
    • Customers don’t always understand what is happening in the global supply chain and may blame you for poor service if you cannot meet demands as you have in the past.

    Which way is your reputation heading?

    • Do you understand and track items that might affect your reputation?
    • Do you understand the impact they may have on your business?

    Visualization of a Newton's Cradle perpetual motion device, aka clacky balls. The lifted ball is colored green with a smiley face and is labelled 'Your Brand Reputation'. The other four balls are red with a frowny face and are labelled 'Data Breach/ Lawsuit', 'Service Disruption', 'Customer Complaint', and 'Poor Delivery'.

    Identifying and understanding potential risks is essential to adapting to the ever-changing online landscape

    Info-Tech Insight

    Few organizations are good at identifying risks. As a result, almost none realistically plan to monitor, manage, and adapt their plans to mitigate those risks.

    Reputational risks

    Not protecting your brand can have disastrous consequences to your organization

    • Data breaches & lawsuits
    • Poor vendor performance
    • Service disruptions
    • Negative reviews

    Stock image of a smiling person on their phone rating something five stars.

    What to look for in vendors

    Identify potential reputational risk impacts
    • Check online reviews from both customers and employees.
    • Check news sites:
      • Has the vendor been affected by a breach?
      • Is the vendor frequently in the news – good or bad? Greater exposure can cause an uptick in hostile attacks, so make sure the vendor has adequate protections in line with its exposure.
    • Review its financials. Is it prime for an acquisition/bankruptcy or other significant change?
    • Review your contractual protections to ensure that you are made whole in the event something goes wrong. Has anything changed with the vendor that requires you to increase your protections?
    • Has anything changed in the vendor’s market? Is a competitor taking its business, or are its resources stretched on multiple projects due to increased demand?
    Illustration of business people in a city above various icons.

    Assessing Reputational Risk Impacts

    Zigzagging icons and numbers one through 7 alternating sides downward. Review Organizational Strategy
    Understand the organizational strategy to prepare for the “what if” game exercise.
    Identify & Understand Potential Risks
    Play the “what if” game with the right people at the table.
    Create a Risk Profile Packet for Leadership
    Pull all the information together in a presentation document.
    Validate the Risks
    Work with leadership to ensure that the proposed risks are in line with their thoughts.
    Plan to Manage the Risks
    Lower the overall risk potential by putting mitigations in place.
    Communicate the Plan
    It is important not only to have a plan but also to socialize it in the organization for awareness.
    Enact the Plan
    Once the plan is finalized and socialized put it in place with continued monitoring for success.
    (Adapted from Harvard Law School Forum on Corporate Governance)

    Insight Summary

    Reputational risk impacts are often unanticipated, causing catastrophic downstream effects. Continuously monitoring your vendors’ actions in the market can help organizations head off brand disasters before they occur.

    Insight 1

    Understanding how to monitor social media activity and online content will give you an edge in the current environment.

    Do you have dedicated individuals or teams to monitor your organization's online presence? Most organizations review and approve the online content, but many forget the need to have analysts reviewing what others are saying about them.

    Insight 2

    Organizations need to learn how to assess the likelihood of potential risks in the rapidly changing online environments and recognize how their partnerships and subcontractors’ actions can affect their brand.

    For example, do you understand how a simple news article raises your profile for short-term and long-term adverse events?

    Insight 3

    Socialize the risk management process throughout the organization to heighten awareness and enable employees to help protect the company’s reputation.

    Do you include a social media and brand protection policy in your annual education?

    Identify reputational risk

    Who should be included in the discussion?
    • While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make INFORMED decisions.
    • Getting input from your organization's marketing experts will enhance your brand's long-term protection.
    • Involving those who directly manage vendors and understand the market will aid in determining the forward path for relationships with your current vendors and identifying new emerging potential partners.
    • Organizations have a wealth of experience in their marketing departments that can help identify real-world negative scenarios.
    • Include vendor relationship managers to help track what is happening in the media for those vendors.
    Keep in mind: (R=L*I)
    Risk = Likelihood x Impact

    Impact tends to remain the same, while likelihood is a very flexible variable.

    Stock image of a flowchart asking 'Risk?', 'Yes', 'No'.

    Manage and monitor reputational risk impacts

    What can we realistically do about the risks?
    • Re-evaluate corporate policies frequently.
    • Ensure proper protections in contracts:
      • Limit the use of your brand name in the publicity and trademark clauses.
      • Make sure to include security protections for your data in the event of a breach; understand that reputation can rarely be made whole again once trust is breached.
    • Introduce continual risk assessment to monitor the relevant vendor markets.
    • Be adaptable and allow for innovations that arise from the current needs.
      • Capture lessons learned from prior incidents to improve over time and adjust your strategy based on the lessons.
    • Monitor your company’s and associated vendors’ online presence.
    • Track similar companies’ brand reputations to see how yours compares in the market.

    Social media is driving the need for perpetual diligence.

    Organizations need to monitor their brand reputation considering the pace of incidents in the modern age.

    Stock image of a person on a phone that is connected to other people.

    The “what if” game

    1-3 hours

    Input: List of identified potential risk scenarios scored by likelihood and financial impact, List of potential management of the scenarios to reduce the risk

    Output: Comprehensive reputational risk profile on the specific vendor solution

    Materials: Whiteboard/flip charts, Reputational Risk Impact Tool to help drive discussion

    Participants: Vendor Management Coordinator, Organizational Leadership, Operations Experts (SMEs), Legal/Compliance/Risk Manager, Marketing

    Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    1. Break into smaller groups (or if too small, continue as a single group).
    2. Use the Reputational Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potential risk but manage the overall process to keep the discussion on track.
    3. Collect the outputs and ask the subject matter experts for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

    Download the Reputational Risk Impact Tool

    Example: Low reputational risk

    We can see clearly in this example that the contractor suffered minimal impact from the specialist's behavior. Though they did take a hit to their overall reputation with a few customers, they should be able to course-correct with a minimal outlay of effort and almost no loss of revenue.

    Stock image of construction workers.

    Sample table of 'Sample Questions to Ask to Identify Reputational Impacts'. Column headers are 'Score', 'Weight', 'Question', and 'Comments or Notes'. At the bottom the 'Reputational Score' row has a low average score of '1.3' and '%100' total weight in their respective columns.

    Example: High reputational risk

    Note in the example how the tool can represent different weights for each of the criteria depending on your needs.

    Stock image of an older person looking out a window.

    Sample table of 'Sample Questions to Ask to Identify Reputational Impacts'. Column headers are 'Score', 'Weight', 'Question', and 'Comments or Notes'. At the bottom the 'Reputational Score' row has a high average score of '3.1' and '%100' total weight in their respective columns.

    Summary

    Be vigilant and adaptable to change
    • Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
    • Understanding how to monitor social media activity and online content will give you an edge in the current environment.
    • Bring the right people to the table to outline potential risks to your organization’s brand reputation.
    • Socialize the risk management process throughout the organization to heighten awareness and enable employees to help protect the company’s reputation.
    • Incorporate lessons learned from incidents into your risk management process to build better plans for future issues.
    Stock image of a person's face overlaid with many different images.

    Organizations must evolve their risk assessments to be more adaptive to respond to global factors in the market.

    Ongoing monitoring of online media and the vendors tied to company visibility is imperative to avoiding disaster.

    Bibliography

    "The CEO Reputation Premium: Gaining Advantage in the Engagement Era." Weber Shandwick, March 2015. Accessed June 2022.

    Glidden, Donna. "Don't Underestimate the Need to Protect Your Brand in Publicity Clauses." Info-Tech Research Group, June 2022.

    Greenaway, Jordan. "Managing Reputation Risk: A start-to-finish guide." Transmission Private, July 2020. Accessed June 2022.

    Jagiello, Robert D., and Thomas T. Hills. “Bad News Has Wings: Dread Risk Mediates Social Amplification in Risk Communication.” Risk Analysis, vol. 38, no. 10, 2018, pp. 2193-2207.

    Kenton, Will. "Brand Recognition.” Investopedia, Aug. 2021. Accessed June 2022.

    Lischer, Brian. "How Much Does it Cost to Rebrand Your Company?" Ignyte, October 2017. Accessed June 2022.

    "Powerful Examples of How to Respond to Negative Reviews." ReviewTrackers, 16 Feb. 2022. Accessed June 2022.

    Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012. Web.

    "Valuation of Trademarks: Everything You Need to Know." UpCounsel, 2022. Accessed June 2022.

    Related Info-Tech Research

    Sample of 'Assessing Financial Risk Management'. Identify and Manage Financial Risk Impacts on Your Organization
    • Identifying and managing a vendor’s potential financial impact requires multiple people in the organization across several functions – and those people all need educating on the potential risks.
    • Organizational leadership is often unaware of decisions on organizational risk appetite and tolerance, and they assume there are more protections in place against risk impact than there truly are.
    Sample of 'How to Assess Strategic Risk'. Identify and Manage Strategic Risk Impacts on Your Organization
    • Identifying and managing a vendor’s potential strategic impact requires multiple people in the organization across several functions – and those people all need coaching on the potential changes in the market and how these changes affect strategic plans.
    • Organizational leadership is often caught unaware during crises, and their plans lack the flexibility needed to adjust to significant market upheavals.
    Research coming soon. Jump Start Your Vendor Management Initiative
    • Vendor management is not “plug and play” – each organization’s vendor management initiative (VMI) needs to fit its culture, environment, and goals. The key is to adapt vendor management principles to fit your needs…not the other way around.
    • All vendors are not of equal importance to an organization. Classifying or segmenting your vendors allows you to focus your efforts on the most important vendors first, allowing your VMI to have the greatest impact possible.

    Research Contributors and Experts

    Frank Sewell

    Research Director
    Info-Tech Research Group

    Donna Glidden

    Research Director
    Info-Tech Research Group

    Steven Jeffery

    Principal Research Director
    Info-Tech Research Group

    Mark Roman

    Managing Partner
    Info-Tech Research Group

    Phil Bode

    Principal Research Director
    Info-Tech Research Group

    Sarah Pletcher

    Executive Advisor
    Info-Tech Research Group

    Scott Bickley

    Practice Lead
    Info-Tech Research Group

    Improve Your Statements of Work to Hold Your Vendors Accountable

    • Buy Link or Shortcode: {j2store}233|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $10,638 Average $ Saved
    • member rating average days saved: 16 Average Days Saved
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management
    • SOW reviews are tedious, and reviewers may lack the skills and experience to effectively complete the process.
    • Vendors draft provisions that shift the performance risk to the customer in subtle ways that are often overlooked or not identified by customers.
    • Customers don’t understand the power and implications of SOWs, treating them as an afterthought or formality.

    Our Advice

    Critical Insight

    • There is often a disconnect between what is sold and what is purchased. To gain the customer’s approval, vendors will present a solution- or outcome-based proposal. However, the SOW is task or activity based, shifting the risk for success to the customer.
    • A good SOW takes time and should not be rushed. The quality of the requirements and of the SOW wording drive success. Not allocating enough time to address both increases the risk of the project’s failure.

    Impact and Result

    • Info-Tech’s guidance and insights will help you navigate the complex process of SOW review and identify the key details necessary to maximize the protections for your organization and hold vendors accountable.
    • This blueprint provides direction on spotting vendor-biased terms and conditions and offers tips for mitigating the risk associated with words and phrases that shift responsibilities and obligations from the vendor to the customer.

    Improve Your Statements of Work to Hold Your Vendors Accountable Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should spend more time assessing your statements of work, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess SOW Terms and Conditions

    Use Info-Tech’s SOW review guidance to find common pitfalls and gotchas, to maximize the protections for your organization, and to hold vendors accountable.

    • Improve Your Statements of Work to Hold Your Vendors Accountable – Storyboard
    • Contract or SOW Guide
    • SOW Maps Tool
    • Red-Flag Words and Phrases Tool
    [infographic]

    Workshop: Improve Your Statements of Work to Hold Your Vendors Accountable

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess SOW Terms and Conditions

    The Purpose

    Gain a better understanding of common SOW clauses and phrases.

    Key Benefits Achieved

    Reduce risk

    Increase vendor accountability

    Improve negotiation positions

    Activities

    1.1 Review sample SOW provisions, identify the risks, and develop a negotiation position.

    1.2 Review Info-Tech tools.

    Outputs

    Awareness and increased knowledge

    Familiarity with the Info-Tech tools

    Key Metrics for Every CIO

    • Buy Link or Shortcode: {j2store}119|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Performance Measurement
    • Parent Category Link: /performance-measurement
    • As a CIO, you are inundated with data and information about how your IT organization is performing based on the various IT metrics that exist.
    • The information we receive from metrics is often just that – information. Rarely is it used as a tool to drive the organization forward.
    • CIO metrics need to consider the goals of key stakeholders in the organization.

    Our Advice

    Critical Insight

    • The top metrics for CIOs don’t have anything to do with IT.
    • CIOs should measure and monitor metrics that have a direct impact on the business.
    • Be intentional with the metric and number of metrics that you monitor on a regular basis.
    • Be transparent with your stakeholders on what and why you are measuring those specific metrics.

    Impact and Result

    • Measure fewer metrics, but measure those that will have a significant impact on how your deliver value to your organization.
    • Focus on the metrics that you can take action against, rather than simply monitor.
    • Ensure your metrics tie to your top priorities as a CIO.

    Key Metrics for Every CIO Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Key Metrics for Every CIO deck – The top metrics every CIO should measure and act on

    Leverage the top metrics for every CIO to help focus your attention and provide insight into actionable steps.

    • Key Metrics for Every CIO Storyboard
    [infographic]

    Further reading

    Key Metrics for Every CIO

    The top six metrics for CIOs – and they have very little to do with IT

    Analyst Perspective

    Measure with intention

    Be the strategic CIO who monitors the right metrics relevant to their priorities – regardless of industry or organization. When CIOs provide a laundry list of metrics they are consistently measuring and monitoring, it demonstrates a few things.

    First, they are probably measuring more metrics than they truly care about or could action. These “standardized” metrics become something measured out of expectation, not intention; therefore, they lose their meaning and value to you as a CIO. Stop spending time on these metrics you will be unable or unwilling to address.

    Secondly, it indicates a lack of trust in the IT leadership team, who can and should be monitoring these commonplace operational measures. An empowered IT leader will understand the responsibility they have to inform the CIO should a metric be derailing from the desired outcome.

    Photo of Brittany Lutes, Senior Research Analyst, Organizational Transformation Practice, Info-Tech Research Group. Brittany Lutes
    Senior Research Analyst
    Organizational Transformation Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    CIOs need to measure a set of specific metrics that:

    • Will support the organization’s vision, their career, and the IT function all in one.
    • Can be used as a tool to make informed decisions and take appropriate actions that will improve the IT function’s ability to deliver value.
    • Consider the influence of critical stakeholders, especially the end customer.
    • Are easily measured at any point in time.
    Common Obstacles

    CIOs often cannot define these metrics because:

    • We confuse the operational metrics IT leaders need to monitor with strategic metrics CIOs need to monitor.
    • Previously monitored metrics did not deliver value.
    • It is hard to decide on a metric that will prove both insightful and easily measurable.
    • We measure metrics without any method or insight on how to take actionable steps forward.
    Info-Tech’s Approach

    For every CIO, there are six areas that should be a focus, no matter your organization or industry. These six priorities will inform the metrics worth measuring:

    • Risk management
    • Delivering on business objectives
    • Customer satisfaction
    • Employee engagement
    • Business leadership relations
    • Managing to a budget

    Info-Tech Insight

    The top metrics for a CIO to measure and monitor have very little to do with IT and everything to do with ensuring the success of the business.

    Your challenge

    CIOs are not using metrics as a personal tool to advance the organization:
    • Metrics should be used as a tool by the CIO to help inform the future actions that will be taken to reach the organization’s strategic vision.
    • As a CIO, you need to have a defined set of metrics that will support your career, the organization, and the IT function you are accountable for.
    • CIO metrics must consider the most important stakeholders across the entire ecosystem of the organization – especially the end customer.
    • The metrics for a CIO are distinctly different from the metrics you use to measure the operational effectiveness of the different IT functions.
    “CIOs are businesspeople first and technology people second.” (Myles Suer, Source: CIO, 2019.)

    Common obstacles

    These barriers make this challenge difficult to address for many CIOs:
    • CIOs often do not measure metrics because they are not aware of what should or needs to be measured.
    • As a result of not wanting to measure the wrong thing, CIOs can often choose to measure nothing at all.
    • Or they get too focused on the operational metrics of their IT organization, leaving the strategic business metrics forgotten.
    • Moreover, narrowing the number of metrics that are being measured down to an actionable number is very difficult.
    • We rely only on physical data sets to help inform the measurements, not considering the qualitative feedback received.
    CIO priorities are business priorities

    46% of CIOs are transforming operations, focused on customer experiences and employee productivity. (Source: Foundry, 2022.)

    Finances (41.3%) and customers (28.1%) remain the top two focuses for CIOs when measuring IT effectiveness. All other focuses combine for the remaining 30.6%. (Source: Journal of Informational Technology Management, 2018.)

    Info-Tech’s approach

    Organizational goals inform CIO metrics

    Diagram with 'CIO Metrics' at the center surrounded by 'Directive Goals', 'Product/Service Goals', 'IT Goals', and 'Operations Goals', each of which are connected to eachother by 'Customers'.

    The Info-Tech difference:
    1. Every CIO has the same set of priorities regardless of their organization or industry given that these metrics are influenced by similar goals of organizations.
    2. CIO metrics are a tool to help inform the actions that will support each core area in reaching their desired goals.
    3. Be mindful of the goals different business units are using to reach the organization’s strategic vision – this includes your own IT goals.
    4. Directly or indirectly, you will always influence the ability to acquire and retain customers for the organization.

    CIO priorities

    MANAGING TO A BUDGET
    Reducing operational costs and increasing strategic IT spend.
    Table centerpiece for CIO Priorities. DELIVERING ON BUSINESS OBJECTIVES
    Aligning IT initiatives to the vision of the organization.
    CUSTOMER SATISFACTION
    Directly and indirectly impacting customer experience.
    EMPLOYEE ENGAGEMENT
    Creating an IT workforce of engaged and purpose-driven people.
    RISK MANAGEMENT
    Actively knowing and mitigating threats to the organization.
    BUSINESS LEADERSHIP RELATONS
    Establishing a network of influential business leaders.

    High-level process flow

    How do we use the CIO metrics?
    Process flow that starts at 'Consider - Identify and analyze CIO priorities', and is followed by 'Select priorities - Identify the top priorities for CIOs (see previous slide)', 'Create a measure - Determine a measure that aligns to each priority', 'Make changes & improvements - Take action to improve the measure and reach the goal you are trying to achieve', 'Demonstrate progress - Use the metrics to demonstrate progress against priorities'. Using priority-based metrics allows you to make incremental improvements that can be measured and reported on, which makes program maturation a natural process.

    Example CIO dashboard

    Example CIO dashboard.
    * Arrow indicates month-over-month trend

    Harness the value of metric data

    Metrics are rarely used accurately as a tool
    • When you have good metrics, you can:
      • Ensure employees are focused on the priorities of the organization
      • Have insight to make better decisions
      • Communicate with the business using language that resonates with each stakeholder
      • Increase the performance of your IT function
      • Continually adapt to meet changing business demands
    • Metrics are tools that quantifiably indicate whether a goal is on track to being achieved (proactive) or if the goal was successfully achieved (retroactive)
    • This is often reflected through two metric types:
      • Leading Metrics: The metric indicates if there are actions that should be taken in the process of achieving a desired outcome.
      • Lagging Metrics: Based on the desired outcome, the metric can indicate where there were successes or failures that supported or prevented the outcome from being achieved.
    • Use the data from the metrics to inform your actions. Do not collect this data if your intent is simply to know the data point. You must be willing to act.
    "The way to make a metric successful is by understanding why you are measuring it." (Jeff Neyland CIO)

    CIOs measure strategic business metrics

    Keep the IT leadership accountable for operational metrics
    • Leveraging the IT leadership team, empower and hold each leader accountable for the operational metrics specific to their functional area
    • As a CIO, focus on the metrics that are going to impact the business. These are often tied to people or stakeholders:
      • The customers who will purchase the product or service
      • The decision makers who will fund IT initiatives
      • The champions of IT value
      • The IT employees who will be driven to succeed
      • The owner of an IT risk event
    • By focusing on these priority areas, you can regularly monitor aspects that will have major business impacts – and be able to address those impacts.
    As a CIO, avoid spending time on operational metrics such as:
    • Time to deliver
    • Time to resolve
    • Project delivery (scope, time, money)
    • Application usage
    • User experiences
    • SLAs
    • Uptime/downtime
    • Resource costs
    • Ticket resolution
    • Number of phishing attempts
    Info-Tech Insight

    While operational metrics are important to your organization, IT leaders should be empowered and responsible for their management.

    SECTION 1

    Actively Managing IT Risks

    Actively manage IT risks

    The impact of IT risks to your organization cannot be ignored any further
    • Few individuals in an organization understand IT risks and can proactively plan for the prevention of those threats, making the CIO the responsible and accountable individual when it comes to IT risks – especially the components that tie into cybersecurity.
    • When the negative impacts of an IT threat event are translated into terms that can be understood and actioned by all in the organization, it increases the likelihood of receiving the sponsorship and funding support necessary.
    • Moreover, risk management can be used as a tool to drive the organization toward its vision state, enabling informed risk decisions.

    Risk management metric:

    Number of critical IT threats that were detected and prevented before impact to the organization.

    Beyond risk prevention
    Organizations that have a clear risk tolerance can use their risk assessments to better inform their decisions.
    Specifically, taking risks that could lead to a high return on investment or other key organizational drivers.

    Protect the organization from more than just cyber threats

    Other risk-related metrics:
    • Percentage of IT risks integrated into the organization’s risk management approach.
    • Number of risk management incidents that were not identified by your organization (and the potential financial impact of those risks).
    • Business satisfaction with IT actions to reduce impact of negative IT risk events.
    • Number of redundant systems removed from the organizations portfolio.
    Action steps to take:
    • Create a risk-aware culture, not just with IT folks. The entire organization needs to understand how IT risks are preventable.
    • Clearly demonstrate the financial and reputational impact of potential IT risks and ensure that this is communicated with decision-makers in the organization.
    • Have a single source of truth to document possible risk events and report prevention tactics to minimize the impact of risks.
    • Use this information to recommend budget changes and help make risk-informed decisions.

    49%

    Investing in Risk

    Heads of IT “cited increasing cybersecurity protections as the top business initiative driving IT investments this year” (Source: Foundry, 2022.)

    SECTION 2

    Delivering on Business Objectives

    Delivering on business objectives

    Deliver on initiatives that bring value to your organization and stop benchmarking
    • CIOs often want to know how they are performing in comparison to their competitors (aka where do you compare in the benchmarking?)
    • While this is a nice to know, it adds zero value in demonstrating that you understand your business, let alone the goals of your business
    • Every organization will have a different set of goals it is striving toward, despite being in the same industry, sector, or market.
    • Measuring your performance against the objectives of the organization prevents CIOs from being more technical than it would do them good.

    Business Objective Alignment Metric:

    Percentage of IT metrics have a direct line of impact to the business goals

    Stop using benchmarks to validate yourself against other organizations. Benchmarking does not provide:
    • Insight into how well that organization performed against their goals.
    • That other organizations goals are likely very different from your own organization's goals.
    • It often aggregates the scores so much; good and bad performers stop being clearly identified.

    Provide a clear line of sight from IT metrics to business goals

    Other business alignment metrics:
    • Number of IT initiatives that have a significant impact on the success of the organization's goals.
    • Number of IT initiatives that exceed the expected value.
    • Positive impact ($) of IT initiatives on driving business innovation.
    Action steps to take:
    • Establish a library or dashboard of all the metrics you are currently measuring as an IT organization, and align each of them to one or more of the business objectives your organization has.
    • Leverage the members of the organization’s executive team to validate they understand how your metric ties to the business objective.
    • Any metric that does not have a clear line of sight should be reconsidered.
    • IT metrics should continue to speak in business terms, not IT terms.

    50%

    CIOs drive the business

    The percentage of CEOs that recognize the CIO as the main driver of the business strategy in the next 2-3 years. (Source: Deloitte, 2020.)

    SECTION 3

    Impact on Customer Satisfaction

    Influencing end-customer satisfaction

    Directly or indirectly, IT influences how satisfied the customer is with their product or service
    • Now more than ever before, IT can positively influence the end-customer’s satisfaction with the product or service they purchase.
    • From operational redundancies to the customer’s interaction with the organization, IT can and should be positively impacting the customer experience.
    • IT leaders who take an interest in the customer demonstrate that they are business-focused individuals and understand the intention of what the organization is seeking to achieve.
    • With the CIO role becoming a strategic one, understanding why a customer would or would not purchase your organization’s product or service stops being a “nice to have.”

    Customer satisfaction metric:

    What is the positive impact ($ or %) of IT initiatives on customer satisfaction?

    Info-Tech Insight

    Be the one to suggest new IT initiatives that will impact the customer experience – stop waiting for other business leaders to make the recommendation.

    Enhance the end-customer experience with I&T

    Other customer satisfaction metrics:
    • Amount of time CIO spends interacting directly with customers.
    • Customer retention rate.
    • Customer attraction rate.
    Action steps to take:
    • Identify the core IT capabilities that support customer experience. Automation? Mobile application? Personal information secured?
    • Suggest an IT-supported or-led initiative that will enhance the customer experience and meet the business goals. Retention? Acquisition? Growth in spend?
    • This is where operational metrics or dashboards can have a real influence on the customer experience. Be mindful of how IT impacts the customer journey.

    41%

    Direct CX interaction

    In 2022, 41% of IT heads were directly interacting with the end customer. (Source: Foundry, 2022.)

    SECTION 4

    Keeping Employees Engaged

    Keeping employees engaged

    This is about more than just an annual engagement survey
    • As a leader, you should always have a finger on the pulse of how engaged your employees are
    • Employee engagement is high when:
      • Employees have a positive disposition to their place of work
      • Employees are committed and willing to contribute to the organization's success
    • Employee engagement comprises three types of drivers: organizational, job, and retention. As CIO, you have a direct impact on all three drivers.
    • Providing employees with a positive work environment where they are empowered to complete activities in line with their desired skillset and tied to a clear purpose can significantly increase employee engagement.

    Employee engagement metric:

    Number of employees who feel empowered to complete purposeful activities related to their job each day

    Engagement leads to increases in:
    • Innovation
    • Productivity
    • Performance
    • Teamwork
    While reducing costs associated with high turnover.

    Employees daily tasks need to have purpose

    Other employee engagement metrics:
    • Tenure of IT employees at the organization.
    • Number of employees who seek out or use a training budget to enhance their knowledge/skills.
    • Degree of autonomy employees feel they have in their work on a daily basis.
    • Number of collaboration tools provided to enable cross-organizational work.
    Action steps to take:
    • If you are not willing to take actionable steps to address engagement, don’t bother asking employees about it.
    • Identify the blockers to empowerment. Common blockers include insufficient team collaboration, bureaucracy, inflexibility, and feeling unsupported and judged.
    • Ensure there is a consistent understanding of what “purposeful” means. Are you talking about “purposeful” to the organization or the individual?
    • Provide more clarity on what the organization’s purpose is and the vision it is driving toward. Just because you understand does not mean the employees do.

    26%

    Act on engagement

    Only 26% of leaders actually think about and act on engagement every single day. (Source: SHRM, 2022.)

    SECTION 5

    Establishing Trusted Business Relationships

    Establishing trusted business partnerships

    Leverage your relationships with other C-suite executives to demonstrate IT’s value
    • Your relationship with other business peers is critical – and, funny enough, it is impacted by the use of good metrics and data.
    • The performance of your IT team will be recognized by other members of the executive leadership team (ELT) and is a direct reflection of you as a leader.
    • A good relationship with the ELT can alleviate issues if concerns about IT staff surface.
      • Of the 85% of IT leaders working on transformational initiatives, only 30% are trying to cultivate an IT/business partnership (Foundry, 2022).
    • Don’t let other members of the organizations ELT overlook you or the value IT has. Build the key relationships that will drive trust and partnerships.

    Business leadership relationship metric:

    Ability to influence business decisions with trusted partners.

    Some key relationships that are worth forming with other C-suite executives right now include:
    • Chief Sustainability Officer
    • Chief Revenue Officer
    • Chief Marketing Officer
    • Chief Data Officer

    Influence business decisions with trusted partners

    Other business relations metrics:
    • The frequency with which peers on the ELT complain about the IT organization to other ELT peers.
    • Percentage of business leaders who trust IT to make the right choices for their accountable areas.
    • Number of projects that are initiated with a desired solution versus problems with no desired solution.
    Action steps to take:
    • From lunch to the boardroom, it is important you make an effort to cultivate relationships with the other members of the ELT.
    • Identify who the most influential members of the ELT are and what their primary goals or objectives are.
    • Follow through on what you promise you will deliver – if you do not know, do not promise it!
    • What will work for one member of the ELT will not work for another – personalize your approach.

    60%

    Enterprise-wide collaboration

    “By 2023, 60% of CIOs will be primarily measured for their ability to co-create new business models and outcomes through extensive enterprise and ecosystem-wide collaboration.” (Source: IDC, 2021.)

    SECTION 6

    Managing to a Budget

    Managing to a budget

    Every CIO needs to be able to spend within budget while increasing their strategic impact
    • From security, to cloud, to innovating the organization's products and services, IT has a lot of initiatives that demand funds and improve the organization.
    • Continuing to demonstrate good use of the budget and driving value for the organization will ensure ongoing recognition in the form of increased money.
    • 29% of CIOs indicated that controlling costs and expense management was a key duty of a functional CIO (Foundry, 2022).
    • Demonstrating the ability to spend within a defined budget is a key way to ensure the business trusts you.
    • Demonstrating an ability to spend within a defined budget and reducing the cost of operational expenses while increasing spend on strategic initiatives ensures the business sees the value in IT.

    Budget management metric:

    Proportion of IT budget that is strategic versus operational.

    Info-Tech Insight

    CIOs need to see their IT function as its own business – budget and spend like a CEO.

    Demonstrate IT’s ability to spend strategically

    Other budget management metrics:
    • Cost required to lead the organization through a digital transformation.
    • Reduction in operational spend due to retiring legacy solutions.
    • Percentage of budget in the run, grow, and transform categories.
    • Amount of money spent keeping the lights on versus investing in new capabilities.

    Action steps to take:

    • Consider opportunities to automate processes and reduce the time/talent required to spend.
    • Identify opportunities and create the time for resources to modernize or even digitize the organization to enable a better delivery of the products or services to the end customer.
    • Review the previous metrics and tie it back to running the business. If customer satisfaction will increase or risk-related threats decrease through an initiative IT is suggesting, you can make the case for increased strategic spend.

    90%

    Direct CX interaction

    Ninety percent of CIOs expect their budget to increase or remain the same in their next fiscal year. (Source: Foundry, 2022.)

    Research contributors and experts

    Photo of Jeff Neyland. Jeff Neyland
    Chief Information Officer – University of Texas at Arlington
    Photo of Brett Trelfa. Brett Trelfa
    SVP and CIO – Arkansas Blue Cross Blue Shield
    Blank photo template. Lynn Fyhrlund
    Chief Information Officer – Milwaukee County Department of Administrative Services

    Info-Tech Research Group

    Vicki Van Alphen Executive Counselor Ibrahim Abdel-Kader Research Analyst
    Mary Van Leer Executive Counselor Graham Price Executive Counselor
    Jack Hakimian Vice President Research Valence Howden Principal Research Director
    Mike Tweedie CIO Practice Lead Tony Denford Organization Transformation Practice Lead

    Related Info-Tech Research

    Sample of the 'IT Metrics Library'. IT Metrics Library
    • Use this tool to review commonly used KPIs for each practice area
    • Identify KPI owners, data sources, baselines, and targets. It also suggests action and research for low-performing KPIs.
    • Use the "Action Plan" tab to keep track of progress on actions that were identified as part of your KPI review.
    Sample of 'Define Service Desk Metrics That Matter'. Define Service Desk Metrics That Matter
    • Consolidate your metrics and assign context and actions to those currently tracked.
    • Establish tension metrics to see and tell the whole story.
    • Split your metrics for each stakeholder group. Assign proper cadences for measurements as a first step to building an effective dashboard.
    Sample of 'CIO Priorities 2022'. CIO Priorities 2022
    • Understand how to respond to trends affecting your organization.
    • Determine your priorities based on current state and relevant internal factors.
    • Assign the right resources to accomplish your vision.
    • Consider what new challenges outside of your control will demand a response.

    Bibliography

    “Developing and Sustaining Employee Engagement.” SHRM, 2022.

    Dopson, Elise. “KPIs Vs. Metrics: What’s the Difference & How Do You Measure Both?” Databox, 23 Jun. 2021.

    Shirer, Michael, and Sarah Murray. “IDC Unveils Worldwide CIO Agenda 2022 Predictions.” IDC, 27 Oct. 2021.

    Suer, Myles. “The Most Important Metrics to Drive IT as a Business.” CIO, 19 Mar. 2019.

    “The new CIO: Business Savvy.” Deloitte Insights. Deloitte, 2020.

    “2022 State of the CIO: Rebalancing Act: CIO’s Operational Pandemic-Era Innovation.” Foundry, 2022.

    “Why Employee Engagement Matters for Leadership at all Levels.” Walden University, 20 Dec. 2019.

    Zhang, Xihui, et al. “How to Measure IT Effectiveness: The CIO’s Perspective.” Journal of Informational Technology Management, 29(4). 2018.

    Change Management

    • Buy Link or Shortcode: {j2store}3|cart{/j2store}
    • Related Products: {j2store}3|crosssells{/j2store}
    • Up-Sell: {j2store}3|upsells{/j2store}
    • Download01-Title: Change Management Executive Brief
    • Download-01: Visit Link
    • member rating overall impact: 9.6/10
    • member rating average dollars saved: $35,031
    • member rating average days saved: 34
    • Parent Category Name: Infra and Operations
    • Parent Category Link: /infra-and-operations
    Every company needs some change management. Both business and IT teams benefit from knowing what changes when.

    incident, problem, problemchange

    Tactics to Retain IT Talent

    • Buy Link or Shortcode: {j2store}549|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Engage
    • Parent Category Link: /engage
    • Regrettable turnover is impacting organizational productivity and leading to significant costs associated with employee departures and the recruitment required to replace them.
    • Many organizations focus on increasing engagement to improve retention, but this approach doesn’t address the entire problem.

    Our Advice

    Critical Insight

    • Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    Impact and Result

    • Build the case for creating retention plans by leveraging employee data and feedback to identify the key reasons for turnover that need to be addressed.
    • Target employee segments and work with management to develop solutions to retain top talent.

    Tactics to Retain IT Talent Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Tactics to Retain IT Talent Storyboard – Use this storyboard to develop a targeted talent retention plan to retain top and core talent in the organization.

    Integrate data from exit surveys and interviews, engagement surveys, and stay interviews to understand the most commonly cited reasons for employee departure in order to select and prioritize tactics that improve retention. This blueprint will help you identify reasons for regrettable turnover, select solutions, and create an action plan.

    • Tactics to Retain IT Talent Storyboard

    2. Retention Plan Workbook – Capture key information in one place as you work through the process to assess and prioritize solutions.

    Use this tool to document and analyze turnover data to find suitable retention solutions.

    • Retention Plan Workbook

    3. Stay Interview Guide – Managers will use this guide to conduct regular stay interviews with employees to anticipate and address turnover triggers.

    The Stay Interview Guide helps managers conduct interviews with current employees, enabling the manager to understand the employee's current engagement level, satisfaction with current role and responsibilities, suggestions for potential improvements, and intent to stay with the organization.

    • Stay Interview Guide

    4. IT Retention Solutions Catalog – Use this catalog to select and prioritize retention solutions across the employee lifecycle.

    Review best-practice solutions to identify those that are most suitable to your organizational culture and employee needs. Use the IT Retention Solutions Catalog to explore a variety of methods to improve retention, understand their use cases, and determine stakeholder responsibilities.

    • IT Retention Solutions Catalog
    [infographic]

    Workshop: Tactics to Retain IT Talent

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Reasons for Regrettable Turnover

    The Purpose

    Identify the main drivers of turnover at the organization.

    Key Benefits Achieved

    Find out what to explore during focus groups.

    Activities

    1.1 Review data to determine why employees join, stay, and leave.

    1.2 Identify common themes.

    1.3 Prepare for focus groups.

    Outputs

    List of common themes/pain points recorded in the Retention Plan Workbook.

    2 Conduct Focus Groups

    The Purpose

    Conduct focus groups to explore retention drivers.

    Key Benefits Achieved

    Explore identified themes.

    Activities

    2.1 Conduct four 1-hour focus groups with the employee segment(s) identified in the pre-workshop activities.

    2.2 Info-Tech facilitators independently analyze results of focus groups and group results by theme.

    Outputs

    Focus group feedback.

    Focus group feedback analyzed and organized by themes.

    3 Identify Needs and Retention Initiatives

    The Purpose

    Home in on employee needs that are a priority.

    Key Benefits Achieved

    A list of initiatives to address the identified needs

    Activities

    3.1 Create an empathy map to identify needs.

    3.2 Shortlist retention initiatives.

    Outputs

    Employee needs and shortlist of initiatives to address them.

    4 Prepare to Communicate and Launch

    The Purpose

    Prepare to launch your retention initiatives.

    Key Benefits Achieved

    A clear action plan for implementing your retention initiatives.

    Activities

    4.1 Select retention initiatives.

    4.2 Determine goals and metrics.

    4.3 Plan stakeholder communication.

    4.4 Build a high-level action plan.

    Outputs

    Finalized list of retention initiatives.

    Goals and associated metrics recorded in the Retention Plan Workbook.

    Further reading

    Tactics to Retain IT Talent

    Keep talent from walking out the door by discovering and addressing moments that matter and turnover triggers.

    Executive Summary

    Your Challenge

    Many organizations are facing an increase in voluntary turnover as low unemployment, a lack of skilled labor, and a rise in the number of vacant roles have given employees more employment choices.

    Common Obstacles

    Regrettable turnover is impacting organizational productivity and leading to significant costs associated with employee departures and the recruitment required to replace them.

    Many organizations tackle retention from an engagement perspective: Increase engagement to improve retention. This approach doesn't consider the whole problem.

    Info-Tech's Approach

    Build the case for creating retention plans by leveraging employee data and feedback to identify the key reasons for turnover that need to be addressed.

    Target employee segments and work with management to develop solutions to retain top talent.

    Info-Tech Insight

    Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    This research addresses regrettable turnover

    This is an image of a flow chart with three levels. The top level has only one box, labeled Turnover.  the Second level has 2 boxes, labeled Voluntary, and Involuntary.  The third level has two boxes under Voluntary, labeled Non-regrettable: The loss of employees that the organization did not wish to keep, e.g. low performers, and Regrettable:  The loss of employees that the organization wishes it could have kept.

    Low unemployment and rising voluntary turnover makes it critical to focus on retention

    As the economy continues to recover from the pandemic, unemployment continues to trend downward even with a looming recession. This leaves more job openings vacant, making it easier for employees to job hop.

    This image contains a graph of the US Employment rate between 2020 - 2022 from the US Bureau of Economic Analysis and Bureau of Labor Statistics (BLS), 2022, the percentage of individuals who change jobs every one to five years from 2022 Job Seeker Nation Study, Jobvite, 2022, and voluntary turnover rates from BLS, 2022

    With more employees voluntarily choosing to leave jobs, it is more important than ever for organizations to identify key employees they want to retain and put plans in place to keep them.

    Retention is a challenge for many organizations

    The number of HR professionals citing retention/turnover as a top workforce management challenge is increasing, and it is now the second highest recruiting priority ("2020 Recruiter Nation Survey," Jobvite, 2020).

    65% of employees believe they can find a better position elsewhere (Legaljobs, 2021). This is a challenge for organizations in that they need to find ways to ensure employees want to stay at the organization or they will lose them, which results in high turnover costs.

    Executives and IT are making retention and turnover – two sides of the same coin – a priority because they cost organizations money.

    • 87% of HR professionals cited retention/turnover as a critical and high priority for the next few years (TINYpulse, 2020).
    • $630B The cost of voluntary turnover in the US (Work Institute, 2020).
    • 66% of organizations consider employee retention to be important or very important to an organization (PayScale, 2019).

    Improving retention leads to broad-reaching organizational benefits

    Cost savings: the price of turnover as a percentage of salary

    • 33% Improving retention can result in significant cost savings. A recent study found turnover costs, on average, to be around a third of an employee's annual salary (SHRM, 2019).
    • 37.9% of employees leave their organization within the first year. Employees who leave within the first 90 days of being hired offer very little or no return on the investment made to hire them (Work Institute, 2020).

    Improved performance

    Employees with longer tenure have an increased understanding of an organization's policies and processes, which leads to increased productivity (Indeed, 2021).

    Prevents a ripple effect

    Turnover often ripples across a team or department, with employees following each other out of the organization (Mereo). Retaining even one individual can often have an impact across the organization.

    Transfer of knowledge

    Retaining key individuals allows them to pass it on to other employees through communities of practice, mentoring, or other knowledge-sharing activities.

    Info-Tech Insight

    Improving retention goes beyond cost savings: Employees who agree with the statement "I expect to be at this organization a year from now" are 71% more likely to put in extra hours and 32% more likely to accomplish more than what is expected of their role (McLean & Company Engagement Survey, 2021; N=77,170 and 97,326 respectively).

    However, the traditional engagement-focused approach to retention is not enough

    Employee engagement is a strong driver of retention, with only 25% of disengaged employees expecting to be at their organization a year from now compared to 92% of engaged employees (McLean & Company Engagement Survey, 2018-2021; N=117,307).

    Average employee Net Promoter Score (eNPS)

    This image contains a graph of the Average employee Net Promoter Score (eNPS)

    Individual employee Net Promoter Scores (eNPS)

    This image contains a graph of the Individual employee Net Promoter Scores (eNPS)

    However, engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave.

    This analysis of McLean & Company's engagement survey results shows that while an organization's average employee net promoter score (eNPS) stays relatively static, at an individual level there is a huge amount of volatility.

    This demonstrates the need for an approach that is more capable of responding to or identifying employees' in-the-moment needs, which an annual engagement survey doesn't support.

    Turnover triggers and moments that matter also have an impact on retention

    Retention needs to be monitored throughout the employee lifecycle. To address the variety of issues that can appear, consider three main paths to turnover:

    1. Employee engagement – areas of low engagement.
    2. Turnover triggers that can quickly lead to departures.
    3. Moments that matter in the employee experience (EX).

    Employee engagement

    Engagement drivers are strong predictors of turnover.

    Employees who are highly engaged are 3.6x more likely to believe they will be with the organization 12 months from now than disengaged employees (McLean & Company Engagement Survey, 2018-2021; N=117,307).

    Turnover triggers

    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Turnover triggers are a cause for voluntary turnover more often than accumulated issues (Lee et al.).

    Moments that matter

    Employee experience is the employee's perception of the accumulation of moments that matter within their employee lifecycle.

    Retention rates increase from 21% to 44% when employees have positive experiences in the following categories: belonging, purpose, achievement, happiness, and vigor at work. (Workhuman, 2020).

    While managers do not directly impact turnover, they do influence the three main paths to turnover

    Research shows managers do not appear as one of the common reasons for employee turnover.

    Top five most common reasons employees leave an organization (McLean & Company, Exit Survey, 2018-2021; N=107 to 141 companies,14,870 to 19,431 responses).

    Turnover factorsRank
    Opportunities for career advancement1
    Satisfaction with my role and responsibilities2
    Base pay3
    Opportunities for career-related skill development4
    The degree to which my skills were used in my job5

    However, managers can still have a huge impact on the turnover of their team through each of the three main paths to turnover:

    Employee engagement

    Employees who believe their managers care about them as a person are 3.3x more likely to be engaged than those who do not (McLean & Company, 2021; N=105,186).

    Turnover triggers

    Managers who are involved with and aware of their staff can serve as an early warning system for triggers that lead to turnover too quickly to detect with data.

    Moments that matter

    Managers have a direct connection with each individual and can tailor the employee experience to meet the needs of the individuals who report to them.

    Gallup has found that 52% of exiting employees say their manager could have done something to prevent them from leaving (Gallup, 2019). Do not discount the power of managers in anticipating and preventing regrettable turnover.

    Addressing engagement, turnover triggers, and moments that matter is the key to retention

    This is an image of a flow chart with four levels. The top level has only one box, labeled Turnover.  the Second level has 2 boxes, labeled Voluntary, and Involuntary.  The third level has two boxes under Voluntary, labeled Non-regrettable, and Regrettable.  The fourth level has three boxes under Regrettable, labeled Employee Engagement, Turnover triggers, and Moments that matter

    Info-Tech Insight

    HR traditionally seeks to examine engagement levels when faced with retention challenges, but engagement is only a part of the full picture. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    Follow Info-Tech's two-step process to create a retention plan

    1. Identify Reasons for Regrettable Turnover

    2. Select Solutions and Create an Action Plan

    Step 1

    Identify Reasons for Regrettable Turnover

    After completing this step you will have:

    • Analyzed and documented why employees join, stay, and leave your organization.
    • Identified common themes and employee needs.
    • Conducted employee focus groups and prioritized employee needs.

    Step 1 focuses on analyzing existing data and validating it through focus groups

    Employee engagement

    Employee engagement and moments that matter are easily tracked by data. Validating employee feedback data by speaking and empathizing with employees helps to uncover moments that matter. This step focuses on analyzing existing data and validating it through focus groups.

    Engagement drivers such as compensation or working environment are strong predictors of turnover.
    Moments that matter
    Employee experience (EX) is the employee's perception of the accumulation of moments that matter with the organization.
    Turnover triggers
    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Turnover triggers

    This step will not touch on turnover triggers. Instead, they will be discussed in step 2 in the context of the role of the manager in improving retention.

    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Info-Tech Insight

    IT managers often have insights into where and why retention is an issue through their day-to-day work. Gathering detailed quantitative and qualitative data provides credibility to these insights and is key to building a business case for action. Keep an open mind and allow the data to inform your gut feeling, not the other way around.

    Gather data to better understand why employees join, stay, and leave

    Start to gather and examine additional data to accurately identify the reason(s) for high turnover. Begin to uncover the story behind why these employees join, stay, and leave your organization through themes and trends that emerge.

    Look for these icons throughout step 2.

    Join

    Why do candidates join your organization?

    Stay

    Why do employees stay with your organization?

    Leave

    Why do employees leave your organization?

    For more information on analysis, visualization, and storytelling with data, see Info-Tech's Start Making Data-Driven People Decisions blueprint.

    Employee feedback data to look at includes:

    Gather insights through:

    • Focus groups
    • Verbatim comments
    • Exit interviews
    • Using the employee value proposition (EVP) as a filter (does it resonate with the lived experience of employees?)

    Prepare to draw themes and trends from employee data throughout step 1.

    Uncover employee needs and reasons for turnover by analyzing employee feedback data.

    • Look for trends (e.g. new hires join for career opportunities and leave for the same reason, or most departments have strong work-life balance scores in engagement data).
    • Review if there are recurring issues being raised that may impact turnover.
    • Group feedback to highlight themes (e.g. lack of understanding of EVP).
    • Identify which key employee needs merit further investigation or information.

    This is an image showing how you can draw out themes and trends using employee data throughout step 1.

    Classify where key employee needs fall within the employee lifecycle diagram in tab 2 of the Retention Plan Workbook. This will be used in step 2 to pinpoint and prioritize solutions.

    Info-Tech Insight

    The employee lifecycle is a valuable way to analyze and organize engagement pain points, moments that matter, and turnover triggers. It ensures that you consider the entirety of an employee's tenure and the different factors that lead to turnover.

    Examine new hire data and begin to document emerging themes

    Join

    While conducting a high-level analysis of new hire data, look for these three key themes impacting retention:

    Issues or pain points that occurred during the hiring process.

    Reasons why employees joined your organization.

    The experience of their first 90 days. This can include their satisfaction with the onboarding process and their overall experience with the organization.

    Themes will help to identify areas of strength and weakness organization-wide and within key segments. Document in tab 3 of the Retention Plan Workbook.

    1. Start by isolating the top reasons employees joined your organization. Ask:
      • Do the reasons align with the benefits you associate with working at your organization?
      • How might this impact your EVP?
      • If you use a new hire survey, look at the results for the following questions:
      • For which of the following reasons did you apply to this organization?
      • For what reasons did you accept the job offer with this organization?
    2. then, examine other potential problem areas that may not be covered by your new hire survey, such as onboarding or the candidate experience during the hiring process.
      • If you conduct a new hire survey, look at the results in the following sections:
        • Candidate Experience
        • Acclimatization
        • Training and Development
        • Defining Performance Expectations

      Analyze engagement data to identify areas of strength that drive retention

      Employees who are engaged are 3.6x more likely to believe they will be with the organization 12 months from now (McLean & Company Engagement Survey, 2018-2021; N=117,307). Given the strength of this relationship, it is essential to identify areas of strength to maintain and leverage.

      1. Look at the highest-performing drivers in your organization's employee engagement survey and drivers that fall into the "leverage" and "maintain" quadrants of the priority matrix.
        • These drivers provide insight into what prompts broader groups of employees to stay.

      This is an image of a quadrant analysis, with the following quadrants in order from left to right, top to bottom.  Improve; Leverage; Evaluate; Maintain.

      1. Look into what efforts have been made to maintain programs, policies, and practices related to these drivers and ensure they are consistent across the entire organization.
      2. Document trends and themes related to engagement strengths in tab 2 of the Retention Plan Workbook.

      If you use Info-Tech's Engagement Survey, look in detail at what are classified as "Retention Drivers": total compensation, working environment, and work-life balance.

      Identify areas of weakness that drive turnover in your engagement data

      1. Look at the lowest-performing drivers in your organization's employee engagement survey and drivers that fall into the "improve" and "evaluate" quadrants of the priority matrix.
        • These drivers provide insight into what pushes employees to leave the organization.
      2. Delve into organizational efforts that have been made to address issues with the programs, policies, and practices related to these drivers. Are there any projects underway to improve them? What are the barriers preventing improvements?
      3. Document trends and themes related to engagement weaknesses in tab 2 of the Retention Plan Workbook.

      If you use a product other than Info-Tech's Engagement Survey, your results will look different. The key is to look at areas of weakness that emerge from the data.

      This is an image of a quadrant analysis, with the following quadrants in order from left to right, top to bottom.  Improve; Leverage; Evaluate; Maintain.

      If you use Info-Tech's Engagement Survey, look in detail at what are classified as "Retention Drivers": total compensation, working environment, and work-life balance.

      Mine exit surveys to develop an integrated, holistic understanding of why employees leave

      Conduct a high-level analysis of the data from your employee exit diagnostic. While analyzing this data, consider the following:

      • What are the trends and quantitative data about why employees leave your organization that may illuminate employee needs or issues at specific points throughout the employee lifecycle?
      • What are insights around your key segments? Data on key segments is easily sliced from exit survey results and can be used as a starting point for digging deeper into retention issues for specific groups.
      • Exit surveys are an excellent starting point. However, it is valuable to validate the data gathered from an exit survey using exit interviews.
      1. Isolate results for key segments of employees to target with retention initiatives (e.g. by age group or by department).
      2. Identify data trends or patterns over time; for example, that compensation factors have been increasing in importance.
      3. Document trends and themes taken from the exit survey results in tab 2 of the Retention Plan Workbook.

      If your organization conducts exit interviews, analyze the results alongside or in lieu of exit survey data.

      Compare new hire data with exit data to identify patterns and insights

      Determine if new hire expectations weren't met, prompting employees to leave your organization, to help identify where in the employee lifecycle issues driving turnover may be occurring.

      1. Look at your new hire data for the top reasons employees joined your organization.
        • McLean & Company's New Hire Survey database shows that the top three reasons candidates accept job offers on average are:
          1. Career opportunities
          2. Nature of the job
          3. Development opportunities
      2. Next, look at your exit data and the top reasons employees left your organization.
        1. McLean & Company's Exit Survey database shows that the top three reasons employees leave on average are:
          1. Opportunities for career advancement
          2. Base pay
          3. Satisfaction with my role and responsibilities
      3. Examine the results and ask:
        • Is there a link between why employees join and leave the organization?
        • Did they cite the same reasons for joining and for leaving?
        • What do the results say about what your employees do and do not value about working at your organization?
      4. Document the resulting insights in tab 2 of the Retention Plan Workbook.

      Example:

      A result where employees are leaving for the same reason they're joining the organization could signal a disconnect between your organization's employee value proposition and the lived experience.

      Revisit your employee value proposition to uncover misalignment

      Your employee value proposition (EVP), formal or informal, communicates the value your organization can offer to prospective employees.

      If your EVP is mismatched with the lived experience of your employees, new hires will be in for a surprise when they start their new job and find out it isn't what they were expecting.

      Forty-six percent of respondents who left a job within 90 days of starting cited a mismatch of expectations about their role ("Job Seeker Nation Study 2020," Jobvite, 2020).

      1. Use the EVP as a filter through which you look at all your employee feedback data. It will help identify misalignment between the promised and the lived experience.
      2. If you have EVP documentation, start there. If not, go to your careers page and put yourself in the shoes of a candidate. Ask what the four elements of an EVP look like for candidates:
        • Compensation and benefits
        • Day-to-day job elements
        • Working conditions
        • Organizational elements
      3. Next, compare this to your own day-to-day experiences. Does it differ drastically? Are there any contradictions with the lived experience at your organization? Are there misleading statements or promises?
      4. Document any insights or patterns you uncover in tab 2 of the Retention Plan Workbook.

      Conduct focus groups to examine themes

      Through focus groups, explore the themes you have uncovered with employees to discover employee needs that are not being met. Addressing these employee needs will be a key aspect of your retention plan.

      Identify employee groups who will participate in focus groups:

      • Incorporate diverse perspectives (e.g. employees, managers, supervisors).
      • Include employees from departments and demographics with strong and weak engagement for a full picture of how engagement impacts your employees.
      • Invite boomerang employees to learn why an individual might return to your organization after leaving.

      image contains two screenshots Mclean & Company's Standard Focus Group Guide.

      Customize Info-Tech's Standard Focus Group Guide based on the themes you have identified in tab 3 of the Retention Plan Workbook.

      The goal of the focus group is to learn from employees and use this information to design or modify a process, system, or other solution that impacts retention.

      Focus questions on the employees' personal experience from their perspective.

      Key things to remember:

      • It is vital for facilitators to be objective.
      • Keep an open mind; no feelings are wrong.
      • Beware of your own biases.
      • Be open and share the reason for conducting the focus groups.

      Info-Tech Insight

      Maintaining an open dialogue with employees will help flesh out the context behind the data you've gathered and allow you to keep in mind that retention is about people first and foremost.

      Empathize with employees to identify moments that matter

      Look for discrepancies between what employees are saying and doing.

      1. Say

      "What words or quotes did the employee use?"

      3.Think

      "What might the employee be thinking?"

      Record feelings and thoughts discussed, body language observed, tone of voice, and words used.

      Look for areas of negative emotion to determine the moments that matter that drive retention.

      2. Do

      "What actions or behavior did the employee demonstrate?"

      4. Feel

      "What might the employee be feeling?"

      Record them in tab 3 of the Retention Plan Workbook.

      5. Identify Needs

      "Needs are verbs (activities or desires), not nouns (solutions)"

      Synthesize focus group findings using Info-Tech's Empathy Map Template.

      6. Identify Insights

      "Ask yourself, why?"

      (Based on Stanford d.school Empathy Map Method)

      Distill employee needs into priority issues to address first

      Take employee needs revealed by your data and focus groups and prioritize three to five needs.

      Select a limited number of employee needs to develop solutions to ensure that the scope of the project is feasible and that the resources dedicated to this project are not stretched too thin. The remaining needs should not be ignored – act on them later.

      Share the needs you identify with stakeholders so they can support prioritization and so you can confirm their buy-in and approval where necessary.

      Ask yourself the following questions to determine your priority employee needs:

      • Which needs will have the greatest impact on turnover?
      • Which needs have the potential to be an easy fix or quick win?
      • Which themes or trends came up repeatedly in different data sources?
      • Which needs evoked particularly strong or negative emotions in the focus groups?

      This image contains screenshots of two table templates found in tab 5 of the Retention Plan Workbook

      In the Retention Plan Workbook, distill employee needs on tab 2 into three to five priorities on tab 5.

      Step 2

      Select Solutions and Create an Action Plan

      After completing this step, you will have:

      • Selected and prioritized solutions to address employee needs.
      • Created a plan to launch stay interviews.
      • Built an action plan to implement solutions.

      Select IT-owned solutions and implement people leader–driven initiatives

      Solutions

      First, select and prioritize solutions to address employee needs identified in the previous step. These solutions will address reasons for turnover that influence employee engagement and moments that matter.

      • Brainstorm solutions using the Retention Solutions Catalog as a starting point. Select a longlist of solutions to address your priority needs.
      • Prioritize the longlist of solutions into a manageable number to act on.

      People leaders

      Next, create a plan to launch stay interviews to increase managers' accountability in improving retention. Managers will be critical to solving issues stemming from turnover triggers.

      • Clarify the importance of harnessing the influence of people leaders in improving retention.
      • Discover what might cause individual employees to leave through stay interviews.
      • Increase trust in managers through training.

      Action plan

      Finally, create an action plan and present to senior leadership for approval.

      Look for these icons in the top right of slides in this step.

      Select solutions to employee needs, starting with the Retention Solutions Catalog

      Based on the priority needs you have identified, use the Retention Solutions Catalog to review best-practice solutions for pain points associated with each stage of the lifecycle.

      Use this tool as a starting point, adding to it and iterating based on your own experience and organizational culture and goals.

      This image contains three screenshots from Info-Tech's Retention Solutions Catalog.

      Use Info-Tech's Retention Solutions Catalog to start the brainstorming process and produce a shortlist of potential solutions that will be prioritized on the next slide.

      Info-Tech Insight

      Unless you have the good fortune of having only a few pain points, no single initiative will completely solve your retention issues. Combine one or two of these broad solutions with people-leader initiatives to ensure employee needs are addressed on an individual and an aggregate level.

      Prioritize solutions to be implemented

      Target efforts accordingly

      Quick wins are high-impact, low-effort initiatives that will build traction and credibility within the organization.

      Long-term initiatives require more time and need to be planned for accordingly but will still deliver a large impact. Review the planning horizon to determine how early these need to begin.

      Re-evaluate low-impact and low-effort initiatives and identify ones that either support other higher impact initiatives or have the highest impact to gain traction and credibility. Look for low-hanging fruit.

      Deprioritize initiatives that will take a high degree of effort to deliver lower-value results.

      When assessing the impact of potential solutions, consider:

      • How many critical segments or employees will this solution affect?
      • Is the employee need it addresses critical, or did the solution encompass several themes in the data you analyzed?
      • Will the success of this solution help build a case for further action?
      • Will the solution address multiple employee needs?

      Info-Tech Insight

      It's better to master a few initiatives than under-deliver on many. Start with a few solutions that will have a measurable impact to build the case for further action in the future.

      Solutions

      Low ImpactMedium ImpactLarge Impact
      Large EffortThis is an image of the used to help you prioritize solutions to be implemented.
      Medium Effort
      Low Effort

      Use tab 3 of the Retention Plan Workbook to prioritize your shortlist of solutions.

      Harness the influence of people leaders to improve employee retention

      Leaders at all levels have a huge impact on employees.

      Effective people leaders:

      • Manage work distribution.
      • Create a motivating work environment.
      • Provide development opportunities.
      • Ensure work is stimulating and challenging, but not overwhelming.
      • Provide clear, actionable feedback.
      • Recognize team member contributions.
      • Develop positive relationships with their teams.
      • Create a line of sight between what the employee is doing and what the organization's objectives are.

      Support leaders in recommitting to their role as people managers through Learning & Development initiatives with particular emphasis on coaching and building trust.

      For coaching training, see Info-Tech's Build a Better Manager: Team Essentials – Feedback and Coaching training deck.

      For more information on supporting managers to become better people leaders, see Info-Tech's Build a Better Manager: Manage Your People blueprint.

      "HR can't fix turnover. But leaders on the front line can."
      – Richard P. Finnegan, CEO, C-Suite Analytics

      Equip managers to conduct regular stay interviews to address turnover triggers

      Managers often have the most visibility into their employees' personal and work lives and have a key opportunity to anticipate and address turnover triggers.

      Stay interviews are an effective way of uncovering potential retention issues and allowing managers to act as an early warning system for turnover triggers.

      Examples of common turnover triggers and potential manager responses:

      • Moving, creating a long commute to the office.
        • Through stay interviews, a manager can learn that a long commute is an issue and can help find workarounds such as flexible/remote work options.
      • Not receiving an expected promotion.
        • A trusted manager can anticipate issues stemming from this, discuss why the decision was made, and plan development opportunities for future openings.

      Stay interview best practices

      1. Conducted by an employee's direct manager.
      2. Happen regularly as a part of an ongoing process.
      3. Based on the stay interview, managers produce a turnover forecast for each direct report.
        1. The method used by stay interview expert Richard P. Finnegan is simple: red for high risk, yellow for medium, and green for low.
      4. Provide managers with training and a rough script or list of questions to follow.
        1. Use and customize Info-Tech's Stay Interview Guide to provide a guide for managers on how to conduct a stay interview.
      5. Managers use the results to create an individualized retention action plan made up of concrete actions the manager and employee will take.

      Sources: Richard P. Finnegan, CEO, C-Suite Analytics; SHRM

      Build an action plan to implement the retention plan

      For each initiative identified, map out timelines and actions that need to be taken.

      When building actions and timelines:

      • Refer to the priority needs you identified in tab 4 of the Retention Plan Workbook and ensure they are addressed first.
      • Engage internal stakeholders who will be key to the development of the initiatives to ensure they have sufficient time to complete their deliverables.
        • For example, if you conduct manager training, Learning & Development needs to be involved in the development and launch of the program.
      • Include a date to revisit your baseline retention and engagement data in your project milestones.
      • Designate process owners for new processes such as stay interviews.

      Plan for stay interviews by determining:

      • Whether stay interviews will be a requirement for all employees.
      • How much flexibility managers will have with the process.
      • How you will communicate the stay interview approach to managers.
      • If manager training is required.
      • How managers should record stay interview data and how you will collect this data from them as a way to monitor retention issues.
        • For example, managers can share their turnover forecasts and action plans for each employee.

      Be clear about manager accountabilities for initiatives they will own, such as stay interviews. Plan to communicate the goals and timelines managers will be asked to meet, such as when they must conduct interviews or their responsibility to follow up on action items that come from interviews.

      Track project success to iterate and improve your solutions

      Analyze measurements

      • Regularly remeasure your engagement and retention levels to identify themes and trends that provide insights into program improvements.
      • For example, look at the difference in manager relationship score to see if training has had an impact, or look at changes in critical segment turnover to calculate cost savings.

      Revisit employee and manager feedback

      • After three to six months, conduct additional surveys or focus groups to determine the success of your initiatives and opportunities for improvement. Tweak the program, including stay interviews, based on manager and employee feedback.

      Iterate frequently

      • Revisit your initiatives every two or three years to determine if a refresh is necessary to meet changing organizational and employee needs and to update your goals and targets.

      Key insights

      Insight 1Insight 2Insight 3

      Retention and turnover are two sides of the same coin. You can't fix retention without first understanding turnover.

      Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

      Improving retention isn't just about lowering turnover, it's about discovering what healthy retention looks like for your organization.

      Insight 4Insight 5Insight 6

      HR professionals often have insights into where and why retention is an issue. Gathering detailed employee feedback data through surveys and focus groups provides credibility to these insights and is key to building a case for action. Keep an open mind and allow the data to inform your gut feeling, not the other way around.

      Successful retention plans must be owned by both IT leaders and HR.

      IT leaders often have the most visibility into their employees' personal and work lives and have a key opportunity to anticipate and address turnover triggers.

      Stay interviews help managers anticipate potential retention issues on their teams.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Info-Tech AnalystsPre-workPost-work
      Client Data Gathering and PlanningImplementation Supported Through Analyst Calls

      1.1 Discuss participants, logistics, overview of workshop activities

      1.2 Provide support to client for below activities through calls.

      2.1 Schedule follow-up calls to work through implementation of retention solutions based on identified needs.
      Client

      1.Gather results of engagement survey, new hire survey, exit survey, and any exit and stay interview feedback.

      2.Gather and analyze turnover data.

      3.Identify key employee segment(s) and identify and organize participants for focus groups.

      4.Complete cost of turnover analysis.

      5.Review turnover data and prioritize list of employee segments.

      1.Obtain senior leader approval to proceed with retention plan.

      2.Finalize and implement retention solutions.

      3.Prepare managers to conduct stay interviews.

      4.Communicate next steps to stakeholders.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      ActivitiesDay 1Day 2Day 3Day 4
      Assess Current StateConduct Focus GroupsIdentify Needs and Retention InitiativesPrepare to Communicate and Launch

      1.1 Review data to determine why employees join, stay, and leave.

      1.2 Identify common themes.

      1.3 Prepare for focus groups.

      2.1 Conduct four 1-hour focus groups with the employee segment(s) identified in the pre-workshop activities..

      2.2 Info-Tech facilitators independently analyze results of focus groups and group results by theme.

      3.1 Create an empathy map to identify needs

      3.2 Shortlist retention initiatives

      4.1 Select retention initiatives

      4.2 Determine goals and metrics

      4.3 Plan stakeholder communication4.4 Build a high-level action plan

      Deliverables

      1.List of common themes/pain points recorded in the Retention Plan Workbook

      2.Plan for focus groups documented in the Focus Group Guide

      1.Focus group feedback

      2.Focus group feedback analyzed and organized by themes

      1.Employee needs and shortlist of initiatives to address them1.Finalized list of retention initiatives

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Research Contributors and Experts

      Jeff Bonnell
      VP HR
      Info-Tech Research Group

      Phillip Kotanidis
      CHRO
      Michael Garron Hospital

      Michael McGuire
      Director, Organizational Development
      William Osler Health System

      Dr. Iris Ware
      Chief Learning Officer
      City of Detroit

      Richard P. Finnegan
      CEO
      C-Suite Analytics

      Dr. Thomas Lee
      Professor of Management
      University of Washington

      Jane Moughon
      Specialist in increasing profits, reducing turnover, and maximizing human potential in manufacturing companies

      Lisa Kaste
      Former HR Director
      Citco

      Piyush Mathur
      Head of Workforce Analytics
      Johnson & Johnson

      Gregory P. Smith
      CEO
      Chart Your Course

      Works Cited

      "17 Surprising Statistics about Employee Retention." TINYpulse, 8 Sept. 2020. Web.
      "2020 Job Seeker Nation Study." Jobvite, April 2020. Web.
      "2020 Recruiter Nation Survey." Jobvite, 2020. Web.
      "2020 Retention Report: Insights on 2019 Turnover Trends, Reasons, Costs, & Recommendations." Work Institute, 2020. Web.
      "25 Essential Productivity Statistics for 2021." TeamStage, 2021. Accessed 22 Jun. 2021.
      Agovino, Theresa. "To Have and to Hold." SHRM, 23 Feb. 2019. Web.
      "Civilian Unemployment Rate." Bureau of Labor Statistics, June 2020. Web.
      Foreman, Paul. "The domino effect of chief sales officer turnover on salespeople." Mereo, 19 July 2018. Web.
      "Gross Domestic Product." U.S. Bureau of Economic Analysis, 27 May 2021. Accessed 22 Jun. 2020.
      Kinne, Aaron. "Back to Basics: What is Employee Experience?" Workhuman, 27August 2020. Accessed 21 Jun. 2021.
      Lee, Thomas W, et al. "Managing employee retention and turnover with 21st century ideas." Organizational Dynamics, vol 47, no. 2, 2017, pp. 88-98. Web.
      Lee, Thomas W. and Terence R. Mitchell. "Control Turnover by Understanding its Causes." The Blackwell Handbook of Principles of Organizational Behaviour. 2017. Print.
      McFeely, Shane, and Ben Wigert. "This Fixable Problem Costs U.S. Businesses $1 Trillion." Gallup. 13 March 2019. Web.
      "Table 18. Annual Quit rates by Industry and Region Not Seasonally Adjusted." Bureau of Labor Statistics. June 2021. Web.
      "The 2019 Compensation Best Practices Report: Will They Stay or Will They Go? Employee Retention and Acquisition in an Uncertain Economy." PayScale. 2019. Web.
      Vuleta, Branka. "30 Troubling Employee Retention Statistics." Legaljobs. 1 Feb. 2021. Web.
      "What is a Tenured Employee? Top Benefits of Tenure and How to Stay Engaged as One." Indeed. 22 Feb. 2021. Accessed 22 Jun. 2021.

      Create a Holistic IT Dashboard

      • Buy Link or Shortcode: {j2store}117|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: $8,049 Average $ Saved
      • member rating average days saved: 8 Average Days Saved
      • Parent Category Name: Performance Measurement
      • Parent Category Link: /performance-measurement
      • IT leaders do not have a single holistic view of how their 45 IT processes are operating.
      • Expecting any single individual to understand the details of all 45 IT processes is unrealistic.
      • Problems in performance only become evident when the process has already failed.

      Our Advice

      Critical Insight

      • Mature your IT department by measuring what matters.
      • Don’t measure things just because you can; change what you measure as your organization matures.

      Impact and Result

      • Use Info-Tech’s IT Metrics Library to review typical KPIs for each of the 45 process areas and select those that apply to your organization.
      • Configure your IT Management Dashboard to record your selected KPIs and start to measure performance.
      • Set up the cadence for review of the KPIs and develop action plans to improve low-performing indicators.

      Create a Holistic IT Dashboard Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how to develop your KPI program that leads to improved performance.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Choose the KPIs

      Identify the KPIs that matter to your organization’s goals.

      • Create a Holistic IT Dashboard – Phase 1: Choose the KPIs
      • IT Metrics Library

      2. Build the Dashboard

      Use the IT Management Dashboard on the Info-Tech website to display your chosen KPIs.

      • Create a Holistic IT Dashboard – Phase 2: Build the Dashboard

      3. Create the Action Plan

      Use the review of your KPIs to build an action plan to drive performance.

      • Create a Holistic IT Dashboard – Phase 3: Build the Action Plan
      [infographic]

      Workshop: Create a Holistic IT Dashboard

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify What to Measure (Offsite)

      The Purpose

      Determine the KPIs that matter to your organization.

      Key Benefits Achieved

      Identify organizational goals

      Identify IT goals and their organizational goal alignment

      Identify business pain points

      Activities

      1.1 Identify organizational goals.

      1.2 Identify IT goals and organizational alignment.

      1.3 Identify business pain points.

      Outputs

      List of goals and pain points to create KPIs for

      2 Configure the Dashboard Tool (Onsite)

      The Purpose

      Learn how to configure and use the IT Management Dashboard.

      Key Benefits Achieved

      Configured IT dashboard

      Initial IT scorecard report

      Activities

      2.1 Review metrics and KPI best practices.

      2.2 Use the IT Metrics Library.

      2.3 Select the KPIs for your organization.

      2.4 Use the IT Management Dashboard.

      Outputs

      Definition of KPIs to be used, data sources, and ownership

      Configured IT dashboard

      3 Review and Develop the Action Plan

      The Purpose

      Learn how to review and plan actions based on the KPIs.

      Key Benefits Achieved

      Lead KPI review to actions to improve performance

      Activities

      3.1 Create the scorecard report.

      3.2 Interpret the results of the dashboard.

      3.3 Use the IT Metrics Library to review suggested actions.

      Outputs

      Initial IT scorecard report

      Action plan with initial actions

      4 Improve Your KPIs (Onsite)

      The Purpose

      Use your KPIs to drive performance.

      Key Benefits Achieved

      Improve your metrics program to drive effectiveness

      Activities

      4.1 Develop your action plan.

      4.2 Execute the plan and tracking progress.

      4.3 Develop new KPIs as your practice matures.

      Outputs

      Understanding of how to develop new KPIs using the IT Metrics Library

      5 Next Steps and Wrap-Up (Offsite)

      The Purpose

      Ensure all documentation and plans are complete.

      Key Benefits Achieved

      Documented next steps

      Activities

      5.1 Complete IT Metrics Library documentation.

      5.2 Document decisions and next steps.

      Outputs

      IT Metrics Library

      Action plan

      Further reading

      Create a Holistic IT Dashboard

      Mature your IT department by measuring what matters.

      Executive Brief

      Analyst Perspective

      Measurement alone provides only minimal improvements

      It’s difficult for CIOs and other top-level leaders of IT to know if everything within their mandate is being managed effectively. Gaining visibility into what’s happening on the front lines without micromanaging is a challenge most top leaders face.

      Understanding Info-Tech’s Management and Governance Framework of processes that need to be managed and being able to measure what’s important to their organization's success can give leaders the ability to focus on their key responsibilities of ensuring service effectiveness, enabling increased productivity, and creating the ability for their teams to innovate.

      Even if you know what to measure, the measurement alone will lead to minimal improvements. Having the right methods in place to systematically collect, review, and act on those measurements is the differentiator to driving up the maturity of your IT organization.

      The tools in this blueprint can help you identify what to measure, how to review it, and how to create effective plans to improve performance.

      Tony Denford

      Research Director, Info-Tech Research Group

      Executive Summary

      Your Challenge

      • IT leaders do not have a single holistic view of how their IT processes are operating.
      • Expecting any single individual to understand the details of all IT processes is unrealistic.
      • Problems in performance only become evident when the process has already failed.

      Common Obstacles

      • Business changes quickly, and what should be measured changes as a result.
      • Most measures are trailing indicators showing past performance.
      • Measuring alone does not result in improved performance.
      • There are thousands of operational metrics that could be measured, but what are the right ones for an overall dashboard?

      Info-Tech's Approach

      • Use Info-Tech’s IT Metrics Library to review typical KPIs for each of the process areas and select those that apply to your organization.
      • Configure your IT Management Dashboard to record your selected KPIs and start to measure performance.
      • Set up the cadence for review of the KPIs and develop action plans to improve low-performing indicators.

      Info-Tech Insight

      Mature your IT department by aligning your measures with your organizational goals. Acting early when your KPIs deviate from the goals leads to improved performance.

      Your challenge

      This research is designed to help organizations quickly choose holistic measures, review the results, and devise action plans.

      • The sheer number of possible metrics can be overwhelming. Choose metrics from our IT Metrics Library or choose your own, but always ensure they are in alignment with your organizational goals.
      • Ensure your dashboard is balanced across all 45 process areas that a modern CIO is responsible for.
      • Finding leading indicators to allow your team to be proactive can be difficult if your team is focused on the day-to-day operational tasks.
      • It can be time consuming to figure out what to do if an indicator is underperforming.

      Build your dashboard quickly using the toolset in this research and move to improvement actions as soon as possible.

      The image is a bar graph, titled KPI-based improvements. On the X-axis are four categories, each with one bar for Before KPIs and another for After KPIs. The categories are: Productivity; Fire Incidents; Request Response Time; and Savings.

      Productivity increased by 30%

      Fire/smoke incidents decreased by 25% (high priority)

      Average work request response time reduced by 64%

      Savings of $1.6 million in the first year

      (CFI, 2013)

      Common obstacles

      These barriers make this challenge difficult to address for many organizations:

      • What should be measured can change over time as your organization matures and the business environment changes. Understanding what creates business value for your organization is critical.
      • Organizations almost always focus on past result metrics. While this is important, it will not indicate when you need to adjust something until it has already failed.
      • It’s not just about measuring. You also need to review the measures often and act on the biggest risks to your organization to drive performance.

      Don’t get overwhelmed by the number of things you can measure. It can take some trial and error to find the measures that best indicate the health of the process.

      The importance of frequent review

      35% - Only 35% of governing bodies review data at each meeting. (Committee of University Chairs, 2008)

      Common obstacles

      Analysis paralysis

      Poor data can lead to incorrect conclusions, limit analysis, and undermine confidence in the value of your dashboard.

      Achieving perfect data is extremely time consuming and may not add much value. It can also be an excuse to avoid getting started with metrics and analytics.

      Data quality is a struggle for many organizations. Consider how much uncertainty you can tolerate in your analysis and what would be required to improve your data quality to an acceptable level. Consider cost, technological resources, people resources, and time required.

      Info-Tech Insight

      Analytics are only as good as the data that informs it. Aim for just enough data quality to make informed decisions without getting into analysis paralysis.

      Common obstacles

      The problem of surrogation

      Tying KPIs and metrics to performance often leads to undesired behavior. An example of this is the now infamous Wells Fargo cross-selling scandal, in which 3.5 million credit card and savings accounts were opened without customers’ consent when the company incented sales staff to meet cross-selling targets.

      Although this is an extreme example, it’s an all-too-common phenomenon.

      A focus on the speed of closure of tickets often leads to shortcuts and lower-quality solutions.

      Tying customer value to the measures can align the team on understanding the objective rather than focusing on the measure itself, and the team will no longer be able to ignore the impact of their actions.

      Surrogation is a phenomenon in which a measure of a behavior replaces the intent of the measure itself. People focus on achieving the measure instead of the behavior the measure was intended to drive.

      Info-Tech’s thought model

      The Threefold Role of the IT Executive Core CIO Objectives
      IT Organization - Manager A - Optimize the Effectiveness of the IT Organization
      Enterprise - Partner B - Boost the Productivity of the Enterprise
      Market - Innovator C - Enable Business Growth Through Technology

      Low-Maturity Metrics Program

      Trailing indicators measure the outcomes of the activities of your organization. Hopefully, the initiatives and activities are aligned with the organizational goals.

      High-Maturity Metrics Program

      The core CIO objectives align with the organizational goals, and teams define leading indicators that show progress toward those goals. KPIs are reviewed often and adjustments are made to improve performance based on the leading indicators. The results are improved outcomes, greater transparency, and increased predictability.

      The image is a horizontal graphic with multiple text boxes. The first (on the left) is a box that reads Organizational Goals, second a second box nested within it that reads Core CIO Objectives. There is an arrow pointing from this box to the right. The arrow connects to a text box that reads Define leading indicators that show progress toward objectives. To the right of that, there is a title Initiatives & activities, with two boxes beneath it: Processes and Projects. Below this middle section, there is an arrow pointing left, with the text: Adjust behaviours. After this, there is an arrow pointing right, to a box with the title Outcomes, and the image of an unlabelled bar graph.

      Info-Tech’s approach

      Adopt an iterative approach to develop the right KPIs for your dashboard

      Periodically: As appropriate, review the effectiveness of the KPIs and adjust as needed.

      Frequently: At least once per month, but the more frequent, the more agility your organization will have.

      The image shows a series of steps in a process, each connected by an arrow. The process is iterative, so the steps circle back on themselves, and repeat. The process begins with IT Metrics Library, then Choose or build KPIs, then Build Dashboard, then Review KPIs and Create action plan. Review KPIs and Create action plan are steps that the graphic indicates should be repeated, so the arrows are arranged in a circle around these two items. Following that, there is an additional step: Are KPIs and action plans leading to improved results? After this step, we return to the Choose or build KPIs step.

      The Info-Tech difference:

      1. Quickly identify the KPIs that matter to your organization using the IT Metrics Library.
      2. Build a presentable dashboard using the IT Management Dashboard available on the Info-Tech website.
      3. When indicators show underperformance, quickly get them back on track using the suggested research in the IT Metrics Library.
      4. If your organization’s needs are different, define your own custom metrics using the same format as the IT Metrics Library.
      5. Use the action plan tool to keep track of progress

      Info-Tech’s methodology for creating a holistic IT dashboard

      1. Choose the KPIs 2. Build the Dashboard 3. Create the Action Plan
      Phase Steps
      1. Review available KPIs
      2. Select KPIs for your organization
      3. Identify data sources and owners
      1. Understand how to use the IT Management Dashboard
      2. Build and review the KPIs
      1. Prioritize low-performing indicators
      2. Review suggested actions
      3. Develop your action plan
      Phase Outcomes A defined and documented list of the KPIs that will be used to monitor each of the practice areas in your IT mandate A configured dashboard covering all the practice areas and the ability to report performance in a consistent and visible way An action plan for addressing low-performing indicators

      Insight summary

      Mature your IT department by aligning your measures with your organizational goals. Acting early when your KPIs deviate from the goals leads to improved performance.

      Don’t just measure things because you can. Change what you measure as your organization becomes more mature.

      Select what matters to your organization

      Measure things that will resolve pain points or drive you toward your goals.

      Look for indicators that show the health of the practice, not just the results.

      Review KPIs often

      Ease of use will determine the success of your metrics program, so keep it simple to create and review the indicators.

      Take action to improve performance

      If indicators are showing suboptimal performance, develop an action plan to drive the indicator in the right direction.

      Act early and often.

      Measure what your customers value

      Ensure you understand what’s valued and measure whether the value is being produced. Let front-line managers focus on tactical measures and understand how they are linked to value.

      Look for predictive measures

      Determine what action will lead to the desired result and measure if the action is being performed. It’s better to predict outcomes than react to them.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      IT Metrics Library

      Customize the KPIs for your organization using the IT Metrics Library

      IT Metrics Library Action Plan

      Keep track of the actions that are generated from your KPI review

      Key deliverable:

      IT Management Dashboard and Scorecard

      The IT Overall Scorecard gives a holistic view of the performance of each IT function

      Blueprint benefits

      IT Benefits

      • An IT dashboard can help IT departments understand how well they are performing against key indicators.
      • It can allow IT teams to demonstrate to their business partners the areas they are focusing on.
      • Regular review and action planning based on the results will lead to improved performance, efficiency, and effectiveness.
      • Create alignment of IT teams by focusing on common areas of performance.

      Business Benefits

      • Ensure alignment and transparency between the business and IT.
      • Understand the value that IT brings to the operation and strategic initiatives of your organization.
      • Understand the contribution of the IT team to achieving business outcomes.
      • Focus IT on the areas that are important to you by requesting new measures as business needs change.

      Measure the value of this blueprint

      Utilize the existing IT Metrics Library and IT Dashboard tools to quickly kick off your KPI program

      • Developing the metrics your organization should track can be very time consuming. Save approximately 120 hours of effort by choosing from the IT Metrics Library.
      • The need for a simple method to display your KPIs means either developing your own tool or buying one off the shelf. Use the IT Management Dashboard to quickly get your KPI program up and running. Using these tools will save approximately 480 hours.
      • The true value of this initiative comes from using the KPIs to drive performance.

      Keeping track of the number of actions identified and completed is a low overhead measure. Tracking time or money saved is higher overhead but also higher value.

      The image is a screen capture of the document titled Establish Baseline Metrics. It shows a table with the headings: Metric, Current, Goal.

      The image is a chart titled KPI benefits. It includes a legend indicating that blue bars are for Actions identified, purple bars are for Actions completed, and the yellow line is for Time/money saved. The graph shows Q1-Q4, indicating an increase in all areas across the quarters.

      Executive Brief Case Study

      Using data-driven decision making to drive stability and increase value

      Industry: Government Services

      Source: Info-Tech analyst experience

      Challenge

      A newly formed application support team with service desk responsibilities was becoming burned out due to the sheer volume of work landing on their desks. The team was very reactive and was providing poor service due to multiple conflicting priorities.

      To make matters worse, there was a plan to add a major new application to the team’s portfolio.

      Solution

      The team began to measure the types of work they were busy doing and then assessed the value of each type of work.

      The team then problem solved how they could reduce or eliminate their low-value workload.

      This led to tracking how many problems were being resolved and improved capabilities to problem solve effectively.

      Results

      Upon initial data collection, the team was performing 100% reactive workload. Eighteen months later slightly more than 80% of workload was proactive high-value activities.

      The team not only was able to absorb the additional workload of the new application but also identified efficiencies in their interactions with other teams that led to a 100% success rate in the change process and a 92% decrease in resource needs for major incidents.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting

      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostic and consistent frameworks are used throughout all four options.

      Guided Implementation

      What does a typical GI on this topic look like?

      Phase 1 - Choose the KPIs

      Call #1: Scope dashboard and reporting needs.

      Call #2: Learn how to use the IT Metrics Library to select your metrics.

      Phase 2 – Build the Dashboard

      Call #3: Set up the dashboard.

      Call #4: Capture data and produce the report.

      Phase 3 – Create the Action Plan

      Call #5: Review the data and use the metrics library to determine actions.

      Call #6: Improve the KPIs you measure.

      A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 5 and 8 calls over the course of 2 to 3 months.

      Workshop Overview

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4 Day 5
      Identify What to Measure Configure the Dashboard Tool Review and Develop the Action Plan Improve Your KPIs Compile Workshop Output
      Activities

      1.1 Identify organizational goals.

      1.2 Identify IT goals and organizational alignment.

      1.3 Identify business pain points.

      2.1 Determine metrics and KPI best practices.

      2.2 Learn how to use the IT Metrics Library.

      2.3 Select the KPIs for your organization.

      2.4 Configure the IT Management Dashboard.

      3.1 Create the scorecard report.

      3.2 Interpret the results of the dashboard.

      3.3 Use the IT Metrics Library to review suggested actions.

      4.1 Develop your action plan.

      4.2 Execute the plan and track progress.

      4.3 Develop new KPIs as your practice matures.

      5.1 Complete the IT Metrics Library documentation.

      5.2 Document decisions and next steps.

      Outcomes 1. List of goals and pain points that KPIs will measure

      1. Definition of KPIs to be used, data sources, and ownership

      2. Configured IT dashboard

      1. Initial IT scorecard report

      2. Action plan with initial actions

      1. Understanding of how to develop new KPIs using the IT Metrics Library

      1. IT Metrics Library documentation

      2. Action plan

      Phase 1

      Choose the KPIs

      Phase 1

      1.1 Review Available KPIs

      1.2 Select KPIs for Your Org.

      1.3 Identify Data Sources and Owners

      Phase 2

      2.1 Understand the IT Management Dashboard

      2.2 Build and Review the KPIs

      Phase 3

      3.1 Prioritize Low-Performing Indicators

      3.2 Review Suggested Actions

      3.3 Develop the Action Plan

      This phase will walk you through the following activities:

      Reviewing and selecting the KPIs suggested in the IT Metrics Library.

      Identifying the data source for the selected KPI and the owner responsible for data collection.

      This phase involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Step 1.1

      Review Available KPIs

      Activities

      1.1.1 Download the IT Metrics Library and review the KPIs for each practice area.

      Choose the KPIs

      Step 1.1 – Review Available KPIs

      Step 1.2 – Select KPIs for Your Org.

      Step 1.3 – Identify Data Sources and owners

      This step will walk you through the following activities:

      Downloading the IT Metrics Library

      Understanding the content of the tool

      Reviewing the intended goals for each practice area

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      Downloaded tool ready to select the KPIs for your organization

      Using the IT Metrics Library

      Match the suggested KPIs to the Management and Governance Framework

      The “Practice” and “Process” columns relate to each of the boxes on the Info-Tech Management and Governance Framework. This ensures you are measuring each area that needs to be managed by a typical IT department.

      The image shows a table on the left, and on the right, the Info-Tech Management and Governance Structure. Sections from the Practice and Process columns of the table have arrows emerging from them, pointing to matching sections in the framework.

      Using the IT Metrics Library

      Content for each entry

      KPI - The key performance indicator to review

      CSF - What needs to happen to achieve success for each goal

      Goal - The goal your organization is trying to achieve

      Owner - Who will be accountable to collect and report the data

      Data Source (typical) - Where you plan to get the data that will be used to calculate the KPI

      Baseline/Target - The baseline and target for the KPI

      Rank - Criticality of this goal to the organization's success

      Action - Suggested action if KPI is underperforming

      Blueprint - Available research to address typical underperformance of the KPI

      Practice/Process - Which practice and process the KPI represents

      1.1.1 Download the IT Metrics Library

      Input

      • IT Metrics Library

      Output

      • Ideas for which KPIs would be useful to track for each of the practice areas

      Materials

      • Whiteboard/flip charts

      Participants

      • IT senior leadership
      • Process area owners
      • Metrics program owners and administrators

      4 hours

      1. Click the link below to download the IT Metrics Library spreadsheet.
      2. Open the file and select the “Data Entry” tab.
      3. The sheet has suggested KPIs for each of the 9 practice areas and 45 processes listed in the Info-Tech Management and Governance Framework. You can identify this grouping in the “Practice” and “Process” columns.
      4. For each practice area, review the suggested KPIs and their associated goals and discuss as a team which of the KPIs would be useful to track in your organization.

      Download the IT Metrics Library

      Step 1.2

      Select KPIs for Your Organization

      Activities

      1.2.1 Select the KPIs that will drive your organization forward

      1.2.2 Remove unwanted KPIs from the IT Metrics Library

      Choose the KPIs

      Step 1.1 – Review Available KPIs

      Step 1.2 – Select KPIs for Your Org.

      Step 1.3 – Identify Data Sources and Owners

      This step will walk you through the following activities:

      • Selecting the KPIs for your organization and removing unwanted KPIs from IT Metrics Library

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      A shortlist of selected KPIs

      1.2.1 Select the KPIs that will drive your organization forward

      Input

      • IT Metrics Library

      Output

      • KPIs would be useful to track for each of the practice areas

      Materials

      • IT Metrics Library

      Participants

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      4 hours

      1. Review the suggested KPIs for each practice area and review the goal.
      2. Some suggested KPIs are similar, so make sure the goal is appropriate for your organization.
      3. Pick up to three KPIs per practice.

      1.2.2 Remove unwanted KPIs

      Input

      • IT Metrics Library

      Output

      • KPIs would be useful to track for each of the practice areas

      Materials

      • IT Metrics Library

      Participants

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      0.5 hours

      1. To remove unwanted KPIs from the IT Metric Library Tool, select the unwanted row, right-click on the row, and delete it.
      2. The result should be up to three KPIs per practice area left on the spreadsheet.

      Step 1.3

      Identify data sources and owners

      Activities

      1.3.1 Document the data source

      1.3.2 Document the owner

      1.3.3 Document baseline and target

      Choose the KPIs

      Step 1.1 – Review Available KPIs

      Step 1.2 – Select KPIs for Your Org.

      Step 1.3 – Identify Data Sources and Owners

      This step will walk you through the following activities:

      Documenting for each KPI where you plan to get the data, who is accountable to collect and report the data, what the current baseline is (if available), and what the target is

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      A list of KPIs for your organization with appropriate attributes documented

      1.3 Identify data sources, owners, baseline, and target

      Input

      • IT Metrics Library

      Output

      • Completed IT Metrics Library

      Materials

      • IT Metrics Library

      Participants

      • Process area owners
      • Metrics program owners and administrators

      2 hours

      1. For each selected KPI, complete the owner, data source, baseline, and target if the information is available.
      2. If the information is not available, document the owner and assign them to complete the other columns.

      Phase 2

      Build the Dashboard

      Phase 1

      1.1 Review Available KPIs

      1.2 Select KPIs for Your Org.

      1.3 Identify Data Sources and Owners

      Phase 2

      2.1 Understand the IT Management Dashboard

      2.2 Build and Review the KPIs

      Phase 3

      3.1 Prioritize Low-Performing Indicators

      3.2 Review Suggested Actions

      3.3 Develop the Action Plan

      This phase will walk you through the following activities:

      Understanding the IT Management Dashboard

      Configuring the IT Management Dashboard and entering initial measures

      Produce thing IT Scorecard from the IT Management Dashboard

      Interpreting the results

      This phase involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Step 2.1

      Understand the IT Management Dashboard

      Activities

      2.1.1 Logging into the IT Management Dashboard

      2.1.2 Understanding the “Overall Scorecard” tab

      2.1.3 Understanding the “My Metrics” tab

      Build the Dashboard

      Step 2.1 – Understand the IT Management Dashboard

      Step 2.2 – Build and review the KPIs

      This step will walk you through the following activities:

      Accessing the IT Management Dashboard

      Basic functionality of the tool

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      Understanding of how to administer the IT Management Dashboard

      2.1.1 Logging into the IT Management Dashboard

      Input

      • Info-Tech membership

      Output

      • Access to the IT Management Dashboard

      Materials

      • Web browser

      Participants

      • Metrics program owners and administrators

      0.5 hours

      1. Using your web browser, access your membership at infotech.com.
      2. Log into your Info-Tech membership account.
      3. Select the “My IT Dashboard” option from the menu (circled in red).
      4. If you cannot gain access to the tool, contact your membership rep.

      The image is a screen capture of the Info-Tech website, with the Login button at the top right of the window circled in red.

      2.1.2 Understanding the “Overall Scorecard” tab

      0.5 hours

      1. Once you select “My IT Dashboard,” you will be in the “Overall Scorecard” tab view.
      2. Scrolling down reveals the data entry form for each of the nine practice areas in the Info-Tech Management and Governance Framework, with each section color-coded for easy identification.
      3. Each of the section headers, KPI names, data sources, and data values can be updated to fit the needs of your organization.
      4. This view is designed to show a holistic view of all areas in IT that are being managed.

      2.1.3 Understanding the “My Metrics” tab

      0.5 hours

      1. On the “My Metrics” tab you can access individual scorecards for each of the nine practice areas.
      2. Below the “My Metrics” tab is each of the nine practice areas for you to select from. Each shows a different subset of KPIs specific to the practice.
      3. The functionality of this view is the same as the overall scorecard. Each title, KPI, description, and actuals are editable to fit your organization’s needs.
      4. This blueprint does not go into detail on this tab, but it is available to be used by practice area leaders in the same way as the overall scorecard.

      Step 2.2

      Build and review the KPIs

      Activities

      2.2.1 Entering the KPI descriptions

      2.2.2 Entering the KPI actuals

      2.2.3 Producing the IT Overall Scorecard

      Build the Dashboard

      Step 2.1 – Understand the IT Management Dashboard

      Step 2.2 – Build and review the KPIs

      This step will walk you through the following activities:

      Entering the KPI descriptions

      Entering the actuals for each KPI

      Producing the IT Overall Scorecard

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      An overall scorecard indicating the selected KPI performance

      2.2.1 Entering the KPI descriptions

      Input

      • Access to the IT Management Dashboard
      • IT Metrics Library with your organization’s KPIs selected

      Output

      • KPI descriptions entered into tool

      Materials

      • Web browser

      Participants

      • Metrics program owners and administrators

      1 hour

      1. Navigate to the IT Management Dashboard as described in section 2.1.1 and scroll down to the practice area you wish to complete.
      2. If needed, modify the section name to match your organization’s needs.
      3. Select “Add another score.”

      2.2.1 Entering the KPI descriptions

      1 hour

      1. Select if your metric is a custom metric or a standard metric available from one of the Info-Tech diagnostic tools.
      2. Enter the metric name you selected from the IT Metrics Library.
      3. Select the value type.
      4. Select the “Add Metric” button.
      5. The descriptions only need to be entered when they change.

      Example of a custom metric

      The image is a screen capture of the Add New Metric function. The metric type selected is Custom metric, and the metric name is Employee Engagement. There is a green Add Metric button, which is circled in red.

      Example of a standard metric

      The image is a screen capture of the Add New Metric function. The metric type selected is Standard Metric. The green Add Metric button at the bottom is circled in red.

      2.2.2 Entering the KPI actuals

      Input

      • Actual data from each data source identified

      Output

      • Actuals recorded in tool

      Materials

      • Web browser

      Participants

      • Metrics program owners and administrators

      1 hour

      1. Select the period you wish to create a scorecard for by selecting “Add New Period” or choosing one from the drop-down list.
      2. For each KPI on your dashboard, collect the data from the data source and enter the actuals.
      3. Select the check mark (circled) to save the data for the period.

      The image is a screen capture of the My Overall Scorecard Metrics section, with a button at the bottom that reads Add New Period circled in red

      The image has the text People and Resources at the top. It shows data for the KPI, and there is a check mark circled in red.

      2.2.3 Producing the IT Overall Scorecard

      Input

      • Completed IT Overall Scorecard data collection

      Output

      • IT Overall Scorecard

      Materials

      • Web browser

      Participants

      • Metrics program owners and administrators

      0.5 hours

      1. Select the period you wish to create a scorecard for by selecting from the drop-down list.
      2. Click the “Download as PDF” button to produce the scorecard.
      3. Once the PDF is produced it is ready for review or distribution.

      Phase 3

      Create the Action Plan

      Phase 1

      1.1 Review Available KPIs

      1.2 Select KPIs for Your Org.

      1.3 Identify Data Sources and Owners

      Phase 2

      2.1 Understand the IT Management Dashboard

      2.2 Build and Review the KPIs

      Phase 3

      3.1 Prioritize Low-Performing Indicators

      3.2 Review Suggested Actions

      3.3 Develop the Action Plan

      This phase will walk you through the following activities:

      Prioritizing low-performing indicators

      Using the IT Metrics Library to review suggested actions

      Developing your team’s action plan to improve performance

      This phase involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Step 3.1

      Prioritize low-performing indicators

      Activities

      3.1.1 Determine criteria for prioritization

      3.1.2 Identify low-performing indicators

      3.1.3 Prioritize low-performing indicators

      Create the action plan

      Step 3.1 – Prioritize low-performing indicators

      Step 3.2 – Review suggested actions

      Step 3.3 – Develop the action plan

      This step will walk you through the following activities:

      Determining the criteria for prioritization of low-performing indicators

      Identifying low-performing indicators

      Prioritizing the low-performing indicators

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      A prioritized list of low-performing indicators that need remediation

      3.1.1 Determine criteria for prioritization

      Often when metrics programs are established, there are multiple KPIs that are not performing at the desired level. It’s easy to expect the team to fix all the low-performing indicators, but often teams are stretched and have conflicting priorities.

      Therefore it’s important to spend some time to prioritize which of your indicators are most critical to the success of your business.

      Also consider, if one area is performing well and others have multiple poor indicators, how do you give the right support to optimize the results?

      Lastly, is it better to score slightly lower on multiple measures or perfect on most but failing badly on one or two?

      3.1.1 Determine criteria for prioritization

      Input

      • Business goals and objectives
      • IT goals and objectives
      • IT organizational structure

      Output

      • Documented scorecard remediation prioritization criteria

      Materials

      • Whiteboard or flip charts

      Participants

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      1 hour

      1. Identify any KPIs that are critical and cannot fail without high impact to your organization.
      2. Identify any KPIs that cannot fail for an extended period and document the time period.
      3. Rank the KPIs from most critical to least critical in the IT Metrics Library.
      4. Look at the owner accountable for the performance of each KPI. If there are any large groups, reassess the ownership or rank.
      5. Periodically review the criteria to see if they’re aligned with meeting current business goals.

      3.1.2 Identify low-performing indicators

      Input

      • Overall scorecard
      • Overall scorecard (previous period)
      • IT Metrics Library

      Output

      • List of low-performing indicators that need remediation
      • Planned actions to improve performance

      Materials

      • Whiteboard or flip charts

      Participants

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      1 hour

      1. Review the overall scorecard for the current period. List any KPIs that are not meeting the target for the current month in the “Action Plan” tab of the IT Metrics Library.
      2. Compare current month to previous month. List any KPIs that are moving away from the long-term target documented in the tool IT Metrics Library.
      3. Revise the target in the IT Metrics Library as business needs change.

      3.1.3 Prioritize low-performing indicators

      Input

      • IT Metrics Library

      Output

      • Prioritized list of planned actions for low-performing indicators

      Materials

      • IT Metrics Library

      Participants

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators
      • Task owners

      1 hour

      1. Look through the list of new and outstanding planned actions in the “Action Plan” tab of the IT Metrics Library, review progress, and prioritize outstanding items.
      2. Compare the list that needs remediation with the rank in the data entry tab.
      3. Adjust the priority of the outstanding and new actions to reflect the business needs.

      Step 3.2

      Review suggested actions

      Activities

      3.2.1 Review suggested actions in the IT Metrics Library

      Create the Action Plan

      Step 3.1 – Prioritize low-performing indicators

      Step 3.2 – Review suggested actions

      Step 3.3 – Develop the action plan

      This step will walk you through the following activities:

      Reviewing the suggested actions in the IT Metrics Library

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      An idea of possible suggested actions

      Take Action

      Knowing where you are underperforming is only half the battle. You need to act!

      • So far you have identified which indicators will tell you whether or not your team is performing and which indicators are most critical to your business success.
      • Knowing is the first step, but things will not improve without some kind of action.
      • Sometimes the action needed to course-correct is small and simple, but sometimes it is complicated and may take a long time.
      • Utilize the diverse ideas of your team to find solutions to underperforming indicators.
      • If you don’t have a viable simple solution, leverage the IT Metrics Library, which suggests high-level action needed to improve each indicator. If you need additional information, use your Info-Tech membership to review the recommended research.

      3.2.1 Review suggested actions in the IT Metrics Library

      Input

      • IT Metrics Library

      Output

      • Suggested actions

      Materials

      • IT Metrics Library

      Participants

      • Process area owners
      • Metrics program owners and administrators
      • Task owners

      0.5 hours

      1. For each of your low-performing indicators, review the suggested action and related research in the IT Metrics Library.

      Step 3.3

      Develop the action plan

      Activities

      3.3.1 Document planned actions

      3.3.2 Assign ownership of actions

      3.3.3 Determine timeline of actions

      3.3.4 Review past action status

      Create the action plan

      Step 3.1 – Prioritize low- performing indicators

      Step 3.2 – Review suggested actions

      Step 3.3 – Develop the action plan

      This step will walk you through the following activities:

      Using the action plan tool to document the expected actions for low-performing indicators

      Assigning an owner and expected due date for the action

      Reviewing past action status for accountability

      This step involves the following participants:

      • Senior IT leadership
      • Process area owners
      • Metrics program owners and administrators

      Outcomes of this step

      An action plan to invoke improved performance

      3.3.1 Document planned actions

      Input

      • IT Metrics Library

      Output

      • Planned actions

      Materials

      • IT Metrics Library

      Participants

      • Process area owners
      • Metrics program owners and administrators
      • Task owners

      1 hour

      1. Decide on the action you plan to take to bring the indicator in line with expected performance and document the planned action in the “Action Plan” tab of the IT Metrics Library.

      Info-Tech Insight

      For larger initiatives try to break the task down to what is likely manageable before the next review. Seeing progress can motivate continued action.

      3.3.2 Assign ownership of actions

      Input

      • IT Metrics Library

      Output

      • Identified owners for each action

      Materials

      • IT Metrics Library

      Participants

      • Process area owners
      • Metrics program owners and administrators
      • Task owners

      0.5 hours

      1. For each unassigned task, assign clear ownership for completion of the task.
      2. The task owner should be the person accountable for the task.

      Info-Tech Insight

      Assigning clear ownership can promote accountability for progress.

      3.3.3 Determine timeline of actions

      Input

      • IT Metrics Library

      Output

      • Expected timeline for each action

      Materials

      • IT Metrics Library

      Participants

      • Process area owners
      • Metrics program owners and administrators
      • Task owners

      0.5 hours

      1. For each task, agree on an estimated target date for completion.

      Info-Tech Insight

      If the target completion date is too far in the future, break the task into manageable chunks.

      3.3.4 Review past action status

      Input

      • IT Metrics Library

      Output

      • Complete action plan for increased performance

      Materials

      • IT Metrics Library

      Participants

      • Process area owners
      • Metrics program owners and administrators
      • Task owners

      0.5 hours

      1. For each task, review the progress since last review.
      2. If desired progress is not being made, adjust your plan based on your organizational constraints.

      Info-Tech Insight

      Seek to understand the reasons that tasks are not being completed and problem solve for creative solutions to improve performance.

      Measure the value of your KPI program

      KPIs only produce value if they lead to action

      • Tracking the performance of key indicators is the first step, but value only comes from taking action based on this information.
      • Keep track of the number of action items that come out of your KPI review and how many are completed.
      • If possible, keep track of the time or money saved through completing the action items.

      Keeping track of the number of actions identified and completed is a low overhead measure.

      Tracking time or money saved is higher overhead but also higher value.

      The image is a chart titled KPI benefits. It includes a legend indicating that blue bars are for Actions identified, purple bars are for Actions completed, and the yellow line is for Time/money saved. The graph shows Q1-Q4, indicating an increase in all areas across the quarters.

      Establish Baseline Metrics

      Baseline metrics will be improved through:

      1. Identifying actions needed to remediate poor-performing KPIs
      2. Associating time and/or money savings as a result of actions taken
      Metric Current Goal
      Number of actions identified per month as a result of KPI review 0 TBD
      $ saved through actions taken due to KPI review 0 TBD
      Time saved through actions taken due to KPI review 0 TBD

      Summary of Accomplishment

      Problem Solved

      Through this project we have identified typical key performance indicators that are important to your organization’s effective management of IT.

      You’ve populated the IT Management Dashboard as a simple method to display the results of your selected KPIs.

      You’ve also established a regular review process for your KPIs and have a method to track the actions that are needed to improve performance as a result of the KPI review. This should allow you to hold individuals accountable for improvement efforts.

      You can also measure the effectiveness of your KPI program by tracking how many actions are identified as a result of the review. Ideally you can also track the money and time savings.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com

      1-888-670-8889

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech Workshop with an Info-Tech analyst team.

      Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      Select the KPIs for your organization

      Examine the benefits of the KPIs suggested in the IT Metrics Library and help selecting those that will drive performance for your maturity level.

      Build an action plan

      Discuss options for identifying and executing actions that result from your KPI review. Determine how to set up the discipline needed to make the most of your KPI review program.

      Research Contributors and Experts

      Valence Howden

      Principal Research Director, CIO – Service Management Info-Tech Research Group

      • Valence has extensive experience in helping organizations be successful through optimizing how they govern themselves, how they design and execute strategies, and how they drive service excellence in all work.

      Tracy-Lynn Reid

      Practice Lead, CIO – People & Leadership Info-Tech Research Group

      • Tracy-Lynn covers key topics related to People & Leadership within an information technology context.

      Fred Chagnon

      Practice Lead, Infrastructure & Operations Info-Tech Research Group

      • Fred brings extensive practical experience in all aspects of enterprise IT Infrastructure, including IP networks, server hardware, operating systems, storage, databases, middleware, virtualization and security.

      Aaron Shum

      Practice Lead, Security, Risk & Compliance Info-Tech Research Group

      • With 20+ years of experience across IT, InfoSec, and Data Privacy, Aaron currently specializes in helping organizations implement comprehensive information security and cybersecurity programs as well as comply with data privacy regulations.

      Cole Cioran

      Practice Lead, Applications and Agile Development Info-Tech Research Group

      • Over the past twenty-five years, Cole has developed software; designed data, infrastructure, and software solutions; defined systems and enterprise architectures; delivered enterprise-wide programs; and managed software development, infrastructure, and business systems analysis practices.

      Barry Cousins

      Practice Lead, Applications – Project and Portfolio Mgmt. Info-Tech Research Group

      • Barry specializes in Project Portfolio Management, Help/Service Desk, and Telephony/Unified Communications. He brings an extensive background in technology, IT management, and business leadership.

      Jack Hakimian

      Vice President, Applications Info-Tech Research Group

      • Jack has close to 25 years of Technology and Management Consulting experience. He has served multi-billion-dollar organizations in multiple industries, including Financial Services and Telecommunications. Jack also served several large public sector institutions.

      Vivek Mehta

      Research Director, CIO Info-Tech Research Group

      • Vivek publishes on topics related to digital transformation and innovation. He is the author of research on Design a Customer-Centric Digital Operating Model and Create Your Digital Strategy as well as numerous keynotes and articles on digital transformation.

      Carlos Sanchez

      Practice Lead, Enterprise Applications Info-Tech Research Group

      • Carlos has a breadth of knowledge in enterprise applications strategy, planning, and execution.

      Andy Neill

      Practice Lead, Enterprise Architecture, Data & BI Info-Tech Research Group

      • Andy has extensive experience in managing technical teams, information architecture, data modeling, and enterprise data strategy.

      Michael Fahey

      Executive Counselor Info-Tech Research Group

      • As an Executive Counselor, Mike applies his decades of business experience and leadership, along with Info-Tech Research Group’s resources, to assist CIOs in delivering outstanding business results.

      Related Info-Tech Research

      Develop Meaningful Service Metrics to Ensure Business and User Satisfaction

      • Reinforce service orientation in your IT organization by ensuring your IT metrics generate value-driven resource behavior.

      Use Applications Metrics That Matter

      • It all starts with quality and customer satisfaction.

      Take Control of Infrastructure Metrics

      • Master the metrics maze to help make decisions, manage costs, and plan for change.

      Bibliography

      Bach, Nancy. “How Often Should You Measure Your Organization's KPIs?” EON, 26 June 2018. Accessed Jan. 2020.

      “The Benefits of Tracking KPIs – Both Individually and for a Team.” Hoopla, 30 Jan. 2017. Accessed Jan. 2020.

      Chepul, Tiffany. “Top 22 KPI Examples for Technology Companies.” Rhythm Systems, Jan. 2020. Accessed Jan. 2020.

      Cooper, Larry. “CSF's, KPI's, Metrics, Outcomes and Benefits” itSM Solutions. 5 Feb. 2010. Accessed Jan 2020.

      “CUC Report on the implementation of Key Performance Indicators: case study experience.” Committee of University Chairs, June 2008. Accessed Jan 2020.

      Harris, Michael, and Bill Tayler. “Don’t Let Metrics Undermine Your Business.” HBR, Sep.–Oct 2019. Accessed Jan. 2020.

      Hatari, Tim. “The Importance of a Strong KPI Dashboard.” TMD Coaching. 27 Dec. 2018. Accessed Jan. 2020.

      Roy, Mayu, and Marian Carter. “The Right KPIs, Metrics for High-performing, Cost-saving Space Management.” CFI, 2013. Accessed Jan 2020.

      Schrage, Michael, and David Kiron. “Leading With Next-Generation Key Performance Indicators.” MIT Sloan Management Review, 26 June 2018. Accessed Jan. 2020.

      Setijono, Djoko, and Jens J. Dahlgaard. “Customer value as a key performance indicator (KPI) and a key improvement indicator (KII)” Emerald Insight, 5 June 2007. Accessed Jan 2020.

      Skinner, Ted. “Balanced Scorecard KPI Examples: Comprehensive List of 183 KPI Examples for a Balanced Scorecard KPI Dashboard (Updated for 2020).” Rhythm Systems, Jan. 2020. Accessed Jan 2020.

      Wishart, Jessica. “5 Reasons Why You Need The Right KPIs in 2020” Rhythm Systems, 1 Feb. 2020. Accessed Jan. 2020.

      Implement Crisis Management Best Practices

      • Buy Link or Shortcode: {j2store}415|cart{/j2store}
      • member rating overall impact: 9.7/10 Overall Impact
      • member rating average dollars saved: $50,532 Average $ Saved
      • member rating average days saved: 42 Average Days Saved
      • Parent Category Name: DR and Business Continuity
      • Parent Category Link: /business-continuity
      • There’s a belief that you can’t know what crisis will hit you next, so you can’t prepare for it. As a result, resilience planning stops at more-specific planning such as business continuity planning or IT disaster recovery planning.
      • Business contingency and IT disaster recovery plans focus on how to resume normal operations following an incident. The missing piece is the crisis management plan – the overarching plan that guides the organization’s initial response, assessment, and action.
      • Organizations without a crisis management plan are far less able to minimize the impact of other crises such as a security breach, health & safety incident, or attacks on their reputation.

      Our Advice

      Critical Insight

      • Effective crisis management has a long-term demonstrable impact on your organization, long after the crisis is resolved. While all organizations can expect a short-term negative impact when a crisis hits, if the crisis is managed well, the research shows that your market capitalization can actually increase long term.
      • Crisis communication is more science than art and should follow a structured approach. Crisis communication is about more than being a good writer or having a social media presence. There are specific messages that must be included, and specific audiences to target, to get the results you need.
      • IT has a critical role in non-IT crises (as well as IT crises). Many crises are IT events (e.g. security breach). For non-IT events, IT is critical in supporting crisis communication and the operational response (e.g. COVID-19 and quickly ramping up working-from-home).

      Impact and Result

      • You can anticipate the types of crisis your organization may face in the future and build flexible plans that can be adapted in a crisis to meet the needs of the moment.
      • Identify potential crises that present a high risk to your organization.
      • Document emergency response and crisis response plans that provide a framework for addressing a range of crises.
      • Establish crisis communication guidelines to avoid embarrassing and damaging communications missteps.

      Implement Crisis Management Best Practices Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should implement crisis management best practices, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify potential crises and your crisis management team

      Identify, analyze, and prioritized potential crises based on risk to the organization. Set crisis management team roles and responsibilities. Adopt a crisis management framework.

      • Example Crisis Management Process Flowcharts (Visio)
      • Example Crisis Management Process Flowcharts (PDF)
      • Business Continuity Teams and Roles Tool

      2. Document your emergency and crisis response plans

      Document workflows for notification, situational assessment, emergency response, and crisis response.

      • Emergency Response Plan Checklist
      • Emergency Response Plan Summary
      • Emergency Response Plan Staff Instructions
      • Pandemic Response Plan Example
      • Pandemic Policy

      3. Document crisis communication guidelines

      Develop and document guidelines that support the creation and distribution of crisis communications.

      • Crisis Communication Guidelines and Templates

      4. Complete and maintain your crisis management plan

      Summarize your crisis management and response plans, create a roadmap to implement potential improvement projects, develop training and awareness initiatives, and schedule maintenance to keep the plan evergreen.

      • Crisis Management Plan Summary Example
      • BCP Project Roadmap Tool
      • Organizational Learning Guide
      [infographic]

      Workshop: Implement Crisis Management Best Practices

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Potential Crises and Your Crisis Management Team

      The Purpose

      Identify and prioritize relevant potential crises.

      Key Benefits Achieved

      Enable crisis management pre-planning and identify gaps in current crisis management plans.

      Activities

      1.1 Identify high-risk crises.

      1.2 Assign roles and responsibilities on the crisis management team.

      1.3 Review Info-Tech’s crisis management framework.

      Outputs

      List of high-risk crises.

      CMT membership and responsibilities.

      Adopt the crisis management framework and identify current strengths and gaps.

      2 Document Emergency Response and Crisis Management Plans

      The Purpose

      Outline emergency response and crisis response plans.

      Key Benefits Achieved

      Develop and document procedures that enable rapid, effective, and reliable crisis and emergency response.

      Activities

      2.1 Develop crisis notification and assessment procedures.

      2.2 Document your emergency response plans.

      2.3 Document crisis response plans for potential high-risk crises.

      Outputs

      Documented notification and assessment workflows.

      Emergency response plans and checklists.

      Documented crisis response workflows.

      3 Document Crisis Communication Guidelines

      The Purpose

      Define crisis communication guidelines aligned with an actionable crisis communications framework.

      Key Benefits Achieved

      Document workflows and guidelines support crisis communications.

      Activities

      3.1 Establish the elements of baseline crisis communications.

      3.2 Identify audiences for the crisis message.

      3.3 Modify baseline communication guidelines based on audience and organizational responsibility.

      3.4 Create a vetting process.

      3.5 Identify communications channels.

      Outputs

      Baseline communications guidelines.

      Situational modifications to crisis communications guidelines.

      Documented vetting process.

      Documented communications channels

      4 Complete and Maintain Your Crisis Management Plan

      The Purpose

      Summarize the crisis management plan, establish an organizational learning process, and identify potential training and awareness activities.

      Key Benefits Achieved

      Plan ahead to keep your crisis management practice evergreen.

      Activities

      4.1 Review the CMP Summary Template.

      4.2 Create a project roadmap to close gaps in the crisis management plan.

      4.3 Outline an organizational learning process.

      4.4 Schedule plan reviews, testing, and updates.

      Outputs

      Long-term roadmap to improve crisis management capabilities.

      Crisis management plan maintenance process and awareness program.

      Document and Maintain Your Disaster Recovery Plan

      • Buy Link or Shortcode: {j2store}417|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $52,224 Average $ Saved
      • member rating average days saved: 38 Average Days Saved
      • Parent Category Name: DR and Business Continuity
      • Parent Category Link: /business-continuity
      • Disaster recovery plan (DRP) documentation is often driven by audit or compliance requirements rather than aimed at the team that would need to execute recovery.
      • Between day-to-day IT projects and the difficulty of maintaining 300+ page manuals, DRP documentation is not updated and quickly becomes unreliable.
      • Inefficient publishing strategies result in your DRP not being accessible during disaster or key staff not knowing where to find the latest version.

      Our Advice

      Critical Insight

      • DR documentation fails when organizations try to boil the ocean with an all-in-one plan aimed at auditors, business leaders, and IT. It’s too long, too hard to maintain, and ends up being little more than shelf-ware.
      • Using flowcharts, checklists, and diagrams aimed at an IT audience is more concise and effective in a disaster, quicker to create, and easier to maintain.
      • Create your DRP in layers to keep the work manageable. Start with a recovery workflow to ensure a coordinated response, and build out supporting documentation over time.

      Impact and Result

      • Create visual and concise DR documentation that strips out unnecessary content and is written for an IT audience – the team that would actually be executing the recovery. Your business leaders can take the same approach to create separate business response plans. Don’t mix the two in an all-in-one plan that is not effective for either audience.
      • Determine a documentation distribution strategy that supports ease of maintenance and accessibility during a disaster.
      • Incorporate DRP maintenance into change management procedures to systematically update and refine the DR documentation. Don’t save up changes for a year-end blitz, which turns document maintenance into an onerous project.

      Document and Maintain Your Disaster Recovery Plan Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should adopt a visual-based DRP, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Streamline DRP documentation

      Start by documenting your recovery workflow. Create supporting documentation in the form of checklists, flowcharts, topology diagrams, and contact lists. Finally, summarize your DR capabilities in a DRP Summary Document for stakeholders and auditors.

      • Document and Maintain Your Disaster Recovery Plan – Phase 1: Streamline DRP Documentation

      2. Select the optimal DRP publishing strategy

      Select criteria for assessing DRP tools, and evaluate whether a business continuity management tool, document management solution, wiki site, or manually distributing documentation is best for your DR team.

      • Document and Maintain Your Disaster Recovery Plan – Phase 2: Select the Optimal DRP Publishing Strategy
      • DRP Publishing and Document Management Solution Evaluation Tool
      • BCM Tool – RFP Selection Criteria

      3. Keep your DRP relevant through maintenance best practices

      Learn how to integrate DRP maintenance into core IT processes, and learn what to look for during testing and during annual reviews of your DRP.

      • Document and Maintain Your Disaster Recovery Plan – Phase 3: Keep Your DRP Relevant Through Maintenance Best Practices
      • Sample Project Intake Form Addendum for Disaster Recovery
      • Sample Change Management Checklist for Disaster Recovery
      • DRP Review Checklist
      • DRP-BCP Review Workflow (Visio)
      • DRP-BCP Review Workflow (PDF)

      4. Appendix: XMPL Case Study

      Model your DRP after the XMPL case study disaster recovery plan documentation.

      • Document and Maintain Your Disaster Recovery Plan – Appendix: XMPL Case Study
      • XMPL DRP Summary Document
      • XMPL Notification, Assessment, and Declaration Plan
      • XMPL Systems Recovery Playbook
      • XMPL Recovery Workflows (Visio)
      • XMPL Recovery Workflows (PDF)
      • XMPL Data Center and Network Diagrams (Visio)
      • XMPL Data Center and Network Diagrams (PDF)
      • XMPL DRP Business Impact Analysis Tool
      • XMPL DRP Workbook
      [infographic]

      Workshop: Document and Maintain Your Disaster Recovery Plan

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Streamline DRP Documentation

      The Purpose

      Teach your team how to create visual-based documentation.

      Key Benefits Achieved

      Learn how to create visual-based DR documentation.

      Activities

      1.1 Conduct a table-top planning exercise.

      1.2 Document your high-level incident response plan.

      1.3 Identify documentation to include in your playbook.

      1.4 Create an initial collection of supplementary documentation.

      1.5 Discuss what further documentation is necessary for recovering from a disaster.

      1.6 Summarize your DR capabilities for stakeholders.

      Outputs

      Documented high-level incident response plan

      List of documentation action items

      Collection of 1-3 draft checklists, flowcharts, topology diagrams, and contact lists

      Action items for ensuring that the DRP is executable for both primary and backup DR personnel

      DRP Summary Document

      2 Select the Optimal DRP Publishing Strategy

      The Purpose

      Learn the considerations for publishing your DRP.

      Key Benefits Achieved

      Identify the best strategy for publishing your DRP.

      Activities

      2.1 Select criteria for assessing DRP tools.

      2.2 Evaluate categories for DRP tools.

      Outputs

      Strategy for publishing DRP

      3 Learn How to Keep Your DRP Relevant Through Maintenance Best Practices

      The Purpose

      Address the common pain point of unmaintained DRPs.

      Key Benefits Achieved

      Create an approach for maintaining your DRP.

      Activities

      3.1 Alter your project intake considerations.

      3.2 Integrate DR considerations into change management.

      3.3 Integrate documentation into performance measurement and performance management.

      3.4 Learn best practices for maintaining your DRP.

      Outputs

      Project Intake Form Addendum Template

      Change Management DRP Checklist Template

      Further reading

      Document and Maintain Your Disaster Recovery Plan

      Put your DRP on a diet – keep it fit, trim, and ready for action.

      ANALYST PERSPECTIVE

      The traditional disaster recovery plan (DRP) “red binder” is dead. It takes too long to create, it’s too hard to maintain, and it’s not usable in a crisis.

      “This blueprint outlines the following key tactics to streamline your documentation effort and produce a better result:

      • Write for an IT audience and focus on how to recover. You don’t need 30 pages of fluff describing the purpose of the document.
      • Use flowcharts, checklists, and diagrams over traditional manuals. This drives documentation that is more concise, easier to maintain, and effective in a crisis.
      • Create your DRP in layers to get tangible results faster, starting with a recovery workflow that outlines your DR strategy, and then build out the specific documentation needed to support recovery.”
      (Frank Trovato, Research Director, Infrastructure, Info-Tech Research Group)

      This project is about DRP documentation after you have clarified your DR strategy; create these necessary inputs first

      These artifacts are the cornerstone for any disaster recovery plan.

      • Business Impact Analysis
      • DR Roles and Responsibilities
      • Recovery Workflow

      Missing a component? Start here. ➔ Create a Right-Sized Disaster Recovery Plan

      This blueprint walks you through building these inputs.
      Our approach saves clients on average US$16,825.22. (Clients self-reported an average saving of US$16,869.21 while completing the Create a Right-Sized Disaster Recovery Plan blueprint through advisory calls, guided implementations, or workshops (Info-Tech Research Group, 2017, N=129).)

      How this blueprint will help you document your DRP

      This Research is Designed For:

      • IT managers in charge of disaster recovery planning (DRP) and execution.
      • Organizations seeking to optimize their DRP using best-practice methodology.
      • Business continuity professionals that are involved with disaster recovery.

      This Research Will Help You:

      • Divide the process of creating DR documentation into manageable chunks, providing a defined scope for you to work in.
      • Identify an appropriate DRP document management and distribution strategy.
      • Ensure that DR documentation is up to date and accessible.

      This Research Will Also Assist:

      • IT managers preparing for a DR audit.
      • IT managers looking to incorporate components of DR into an IT operations document.

      This Research Will Help Them:

      • Follow a structured approach in building DR documentation using best practices.
      • Integrate DR into day-to-day IT operations.

      Executive summary

      Situation

      • DR documentation is often driven by audit or compliance requirements, rather than aimed at the team that would need to execute recovery.
      • Traditional DRPs are text-heavy, 300+ page manuals that are simply not usable in a crisis.
      • Compounding the problem, DR documentation is rarely updated, so it’s just shelf-ware.

      Complication

      • DRP is often given lower priority as day-to-day IT projects displace DR documentation efforts.
      • Inefficient publishing strategies result in your DRP not being accessible during disasters or key staff not knowing where to find the latest version.
      • Organizations that create traditional DRPs end up with massive manuals that are difficult to maintain, so they quickly become unreliable.

      Resolution

      • Create visual and concise DR documentation that strips out unnecessary content and is written for an IT audience – the team that would actually be executing the recovery. Your business leaders can take the same approach to create separate business response plans – don’t mix the two into an all-in-one plan that is not effective for either audience.
      • Determine a documentation distribution strategy that supports ease of maintenance and accessibility during a disaster.
      • Incorporate DRP maintenance into change management and project intake procedures to systematically update and refine the DR documentation. Don’t save up changes for a year-end blitz, which turns document maintenance into an onerous project.

      Info-Tech Insight

      1. DR documentation fails when organizations try to boil the ocean with an all-in-one plan aimed at auditors, business leaders, and IT. It’s too long, too hard to maintain, and ends up being little more than shelf-ware.
      2. Using flowcharts, checklists, and diagrams aimed at an IT audience is more concise and effective in a disaster, quicker to create, and easier to maintain.
      3. Create your DRP in layers to keep the work manageable. Start with a recovery workflow to ensure a coordinated response, and build out supporting documentation over time.

      An effective DRP that mitigates a wide range of potential outages is critical to minimizing the impact of downtime

      The criticality of having an effective DRP is underestimated.

      Cost of Downtime for the Fortune 1000
      • Cost of unplanned apps downtime per year: $1.25B to $2.5B
      • Cost of critical apps failure per hour: $500,000 to $1M
      • Cost of infrastructure failure per hour: $100,000
      • 35% reported to have recovered within 12 hours.
      • 17% of infrastructure failures took more than 24 hours to recover.
      • 13% of application failures took more than 24 hours to recover.
      Size of Impact Increasing Across Industries
      • The cost of downtime is rising across the board and not just for organizations that traditionally depend on IT (e.g. e-commerce).
      • Downtime cost increase since 2010:
        • Hospitality: 129% increase
        • Transportation: 108% increase
        • Media organizations: 104% increase
      Potential Lost Revenue
      A line graph of Potential Lost Revenue with vertical axis 'LOSS ($)' and horizontal axis 'TIME'. The line starts with low losses near the origin where 'Incident Occurs', gradually accelerates to higher losses as time passes, then decelerates before 'All Revenue Lost'. Note: 'Delay in recovery causes exponential revenue loss'.
      (Adapted from: Rothstein, Philip Jan. Disaster Recovery Testing: Exercising Your Contingency Plan (2007 Edition).)

      The impact of downtime increases significantly over time, not just in terms of lost revenue (as illustrated here) but also goodwill/reputation and health/safety. An effective DR solution and overall resiliency that mitigate a wide range of potential outages are critical to minimizing the impact of downtime.

      Without an effective DRP, your organization is gambling on being able to define and implement a recovery strategy during a time of crisis. At the very least, this means extended downtime – potentially weeks – and substantial impact.

      Only 38% of those with a full or mostly complete DRP believe their DRPs would be effective in a real crisis

      Organizations continue to struggle with creating DRPs, let alone making them actionable.

      Why are so many living with either an incomplete or ineffective DRP? For the same reasons that IT documentation in general continues to be a pain point:

      • It is an outdated model of what documentation should be – the traditional manual with detailed (lengthy) descriptions and procedures.
      • Despite the importance of DR, low priority is placed on creating a DRP and the day-to-day SOPs required to support a recovery.
      • There is a lack of effective processes for ensuring documentation stays up to date.
      A bar graph documenting percentages of survey responses about the completeness of their DRP. 'Only 20% of survey respondents indicated they have a complete DRP'. 13% said 'No DRP'. 33% said 'Partial DRP'. 34% said 'Mostly Completed'. 20% said 'Full DRP'.
      (Source: Info-Tech Research Group, N=165)
      A bar graph documenting percentages of survey responses about the level of confidence in their DRP. 'Only 38% of those who have a mostly completed or full DRP actually feel it would be effective in a crisis'. 4% said 'Low'. 58% said 'Unsure'. 38% said 'Confident'.
      (Source: Info-Tech Research Group, N=69 (includes only those who indicated DRP is mostly completed or completed))

      Improve usability and effectiveness with visual-based and more-concise documentation

      Choose flowcharts over process guides, checklists over lengthy procedures, and diagrams over descriptions.

      If you need a three-inch binder to hold your DRP, imagine having to flip through it to determine next steps during a crisis.

      DR documentation needs to be concise, scannable, and quickly understood to be effective. Visual-based documentation meets these requirements, so it’s no surprise that it also leads to higher DR success.

      DR success scores are based on:

      • Meeting recovery time objectives (RTOs).
      • Meeting recovery point objectives (RPOs).
      • IT staff’s confidence in their ability to meet RTOs/RPOs.
      A line graph of DR documentation types and their effectiveness. The vertical axis is 'DR Success', from Low to High. The horizontal axis is Documentation Type, from 'Traditional Manual' to 'Primarily flowcharts, checklists, and diagrams'. The line trends up to higher success with visual-based and more-concise documentation.(Source: Info-Tech Research Group, N=95)

      “Without question, 300-page DRPs are not effective. I mean, auditors love them because of the detail, but give me a 10-page DRP with contact lists, process flows, diagrams, and recovery checklists that are easy to follow.” (Bernard Jones, MBCI, CBCP, CORP, Manager Disaster Recovery/BCP, ActiveHealth Management)

      Maintainability is another argument for visual-based, concise documentation

      There are two end goals for your DR documentation: effectiveness and maintainability. Without either, you will not have success during a disaster.

      Organizations using a visual-based approach were 30% more likely to find that DR documentation is easy to maintain. “Easy to maintain” leads to a 46% higher rate of DR success.
      Two bar graphs documenting survey responses regarding maintenance ease of DR documentation types. The first graph compares Traditional Manual vs Visual-based. For 'Traditional Manual' 72% responded they were Difficult to maintain while 28% responded they were Easy to maintain; for 'Visual-based' 42% responded they were Difficult to maintain while 58% responded they were Easy to maintain. Visual-based DR documentation received 30% more votes for Easy to Maintain. The second graph compares success rates of 'Difficult to Maintain' vs 'Easy to Maintain' DR documentation with Difficult being 31% and Easy being 77%, a 46% difference. 'Source: Info-Tech Research Group, N=96'.

      Not only are visual-based disaster recovery plans more effective, but they are also easier to maintain.

      Overcome documentation inertia with a tiered model that allows you to eat the elephant one bite at a time

      Start with a recovery workflow to at least ensure a coordinated response. Then use that workflow to determine required supporting documentation.

      Recovery Workflow: Starting the project with overly detailed documentation can slow down the entire process. Overcome planning inertia by starting with high-level incident response plans in a flowchart format. For examples and additional information, see XMPL Medical’s Recovery Workflows.

      Recovery Procedures (Systems Recovery Playbook): For each step in the high-level flowchart, create recovery procedures where necessary using additional flowcharts, checklists, and diagrams as appropriate. Leverage Info-Tech’s Systems Recovery Playbook example as a starting point.

      Additional Reference Documentation: Reference existing IT documentation, such as network diagrams and configuration documents, as well as more detailed step-by-step procedures where necessary (e.g. vendor documentation), particularly where needed to support alternate recovery staff who may not be as well versed as the primary system owners.

      Info-Tech Insight

      Organizations that use flowcharts, checklist, and diagrams over traditional, dense DRP manuals are far more likely to meet their RTOs/RPOs because their documentation is more usable and easier to maintain.

      Use a DRP summary document to satisfy executives, auditors, and clients

      Stakeholders don’t have time to sift through a pile of paper. Summarize your overall continuity capabilities in one, easy-to-read place.

      DRP Summary Document

      • Summarize BIA results
      • Summarize DR strategy (including DR sites)
      • Summarize backup strategy
      • Summarize testing and maintenance plans

      Follow Info-Tech’s methodology to make DRP documentation efficient and effective

      Phases

      Phase 1: Streamline DRP documentation Phase 2: Select the optimal DRP publishing strategy Phase 3: Keep your DRP relevant through maintenance best practices

      Phases

      1.1

      Start with a recovery workflow

      2.1

      Decide on a publishing strategy

      3.1

      Incorporate DRP maintenance into core IT processes

      1.2

      Create supporting DRP documentation

      3.2

      Conduct an annual focused review

      1.3

      Write the DRP Summary

      Tools and Templates

      End-to-End Sample DRP DRP Publishing Evaluation Tool Project In-take/Request Form

      Change Management Checklist

      Follow XMPL Medical’s journey through DR documentation

      CASE STUDY

      Industry Healthcare
      Source Created by amalgamating data from Info-Tech’s client base

      Streamline your documentation and maintenance process by following the approach outlined in XMPL Medical’s journey to an end-to-end DRP.

      Outline of the Disaster Recovery Plan

      XMPL’s disaster recovery plan includes its business impact analysis and a subset of tier 1 and tier 2 patient care applications.

      Its DRP includes incident response flowcharts, system recovery checklists, and a communication plan. Its DRP also references IT operations documentation (e.g. asset management documents, system specs, and system configuration docs), but this material is not published with the example documentation.

      Resulting Disaster Recovery Plan

      XMPL’s DRP includes actionable documents in the form of high-level disaster response plan flowcharts and system recovery checklists. During an incident, the DR team is able to clearly see the items for which they are responsible.

      Disaster Recovery Plan
      • Recovery Workflow
      • Business Impact Analysis
      • DRP Summary
      • System Recovery Checklists
      • Communication, Assessment, and Disaster Declaration Plan

      Info-Tech Best Practice

      XMPL Medical’s disaster recovery plan illustrates an effective DRP. Model your end-to-end disaster recovery plan after XMPL’s completed templates. The specific data points will differ from organization to organization, but the structure of each document will be similar.

      Model your disaster recovery documentation off of our example

      CASE STUDY

      Industry Healthcare
      Source Created by amalgamating data from Info-Tech’s client base

      Recovery Workflow:

      • Recovery Workflows (PDF, VSDX)

      Recovery Procedures (Systems Recovery Playbook):

      • DR Notification, Assessment, and Disaster Declaration Plan
      • Systems Recovery Playbook
      • Network Topology Diagrams

      Additional Reference Documentation:

      • DRP Workbook
      • Business Impact Analysis
      • DRP Summary Document

      Use Info-Tech’s DRP Maturity Scorecard to evaluate your progress

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Document and Maintain Your Disaster Recovery Plan – Project Overview

      1. Streamline DRP Documentation 2. Select the Optimal DRP Publishing Strategy 3. Keep Your DRP Relevant
      Supporting Tool icon
      Best-Practice Toolkit

      1.1 Start with a recovery workflow

      1.2 Create supporting DRP documentation

      1.3 Write the DRP summary

      2.1 Create Committee Profiles

      3.1 Build Governance Structure Map

      3.2 Create Committee Profiles

      Guided Implementations
      • Review Info-Tech’s approach to DRP documentation.
      • Create a high-level recovery workflow.
      • Create supporting DRP documentation.
      • Write the DRP summary.
      • Identify criteria for selecting a DRP publishing strategy.
      • Select a DRP publishing strategy.
      • Optional: Select requirements for a BCM tool and issue an RFP.
      • Optional: Review responses to RFP.
      • Learn best practices for integrating DRP maintenance into day-to-day IT processes.
      • Learn best practices for DRP-focused reviews.
      Associated Activity icon
      Onsite Workshop
      Module 1:
      Streamline DRP documentation
      Module 2:
      Select the optimal DRP publishing strategy
      Module 3:
      Learn best practices for keeping your DRP relevant
      Phase 1 Outcome:
      • A complete end-to-end DRP
      Phase 2 Outcome:
      • Selection of a publishing and management tool for your DRP documentation
      Phase 3 Outcome:
      • Strategy for maintaining your DRP documentation

      Workshop Overview Associated Activity icon

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4 Workshop Day 5
      Info-Tech Analysts Finalize Deliverables
      Activities
      Assess DRP Maturity and Review Current Capabilities

      0.1 Assess current DRP maturity through Info-Tech’s Maturity Scorecard.

      0.2 Identify the IT systems that support mission-critical business activities, and select 2 or 3 key applications to be the focus of the workshop.

      0.3 Identify current recovery strategies for selected applications.

      0.4 Identify current DR challenges for selected applications.

      Document Your Recovery Workflow

      1.1 Create a recovery workflow: review tabletop planning, walk through DR scenarios, identify DR gaps, and determine how to fill them.

      Create Supporting Documentation

      1.2 Create supporting DRP documentation.

      1.3 Write the DRP summary.

      Establish a DRP Publishing, Management, and Maintenance Strategy

      2.1 Decide on a publishing strategy.

      3.1 Incorporate DRP maintenance into core IT.

      3.2 Considerations for reviewing your DRP regularly.

      Deliverables
      1. Baseline DRP metric (based on DRP Maturity Scorecard)
      1. High-level DRP workflow
      2. DRP gaps and risks identified
      1. Recovery workflow and/or checklist for sample of IT systems
      2. Customized DRP Summary Template
      1. Strategy for selecting a DRP publishing tool
      2. DRP management and maintenance strategy
      3. Workshop summary presentation deck

      Workshop Goal: Learn how to document and maintain your DRP.

      Use these icons to help direct you as you navigate this research

      Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

      A small monochrome icon of a wrench and screwdriver creating an X.

      This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.

      A small monochrome icon depicting a person in front of a blank slide.

      This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.


      Phase 1: Streamline DRP Documentation

      Step 1.1: Start with a recovery workflow

      PHASE 1
      PHASE 2
      PHASE 3
      1.1 1.2 1.3 2.1 3.1 3.2
      Start with a Recovery Workflow Create Supporting Documentation Write the DRP Summary Select DRP Publishing Strategy Integrate into Core IT Processes Conduct an Annual Focused Review

      This step will walk you through the following activities:

      • Review a model DRP.
      • Review your recovery workflow.
      • Identify documentation required to support the recovery workflow.

      This step involves the following participants:

      • DRP Owner
      • System SMEs
      • Alternate DR Personnel

      Outcomes of this step

      • Understanding the visual-based, concise approach to DR documentation.
      • Creating a recovery workflow that provides a roadmap for coordinating incident response and identifying required supporting documentation.

      Info-Tech Insights

      A DRP is a collection of procedures and supporting documents that allow an organization to recover its IT services to minimize system downtime for the business.

      1.1 — Start with a recovery workflow to ensure a coordinated response and identify required supporting documentation

      The recovery workflow clarifies your DR strategy and ensures the DR team is on the same page.

      Recovery Workflow

      The recovery workflow maps out the incident response plan from event detection, assessment, and declaration to systems recovery and validation.

      This documentation includes:

      • Clarifying initial incident response steps.
      • Clarifying the order of systems recovery and which recovery actions can occur concurrently.
      • Estimating actual recovery timeline through each stage of recovery.
      Recovery Procedures (Playbook)
      Additional Reference Documentation

      “We use flowcharts for our declaration procedures. Flowcharts are more effective when you have to explain status and next steps to upper management.” (Assistant Director-IT Operations, Healthcare Industry)

      Review business impact analysis (BIA) results to plan your recovery workflow

      The BIA defines system criticality from the business’s perspective. Use it to guide system recovery order.

      Specifically, review the following from your BIA:

      • The list of tier 1, 2, and 3 applications. This will dictate the recovery order in your recovery workflow.
      • Application dependencies. This will outline what needs to be included as part of an application recovery workflow.
      • The recovery time objective (RTO) and recovery point objective (RPO) for each application. This will also guide the recovery, and enable you to identify gaps where the recovery workflow does not meet RTOs and RPOs.

      CASE STUDY: The XMPL DRP documentation is based on this Business Impact Analysis Tool.

      Haven’t conducted a BIA? Use Info-Tech’s streamlined approach.

      Info-Tech’s publication Create a Right-Sized Disaster Recovery Plan takes a very practical approach to BIA work. Our process gives IT leaders a mechanism to quickly get agreement on system recovery order and DR investment priorities.

      Conduct a tabletop planning exercise to determine your recovery workflow

      Associated Activity icon 1.1.1 Tabletop Planning Exercise

      1. Define a scenario to drive the tabletop planning exercise:
        • Use a scenario that forces a full failover to your DR environment, so you can capture an end-to-end recovery workflow.
        • Avoid scenarios that impact health and safety such as tornados or a fire. You want to focus on IT recovery.
        • Example scenarios: Burst water pipe that causes data-center-wide damage or a gas leak that forces evacuation and power to be shut down for at least two days.

      Note: You may have already completed this exercise as part of Create a Right-Sized Disaster Recovery Plan.

      Info-Tech Insight

      Use scenarios to provide context for DR planning, and to test your plans, but don’t create a separate plan for every possibility.

      The high-level recovery plan will be the same whether the incident is a fire, flood, or tornado. While there might be some variances and outliers, these scenarios can be addressed by adding decision points and/or separate, supplementary instructions.

      Walk through the scenario and capture the recovery workflow

      Associated Activity icon 1.1.2 Tabletop Planning Exercise
      1. Capture the following information for tier 1, tier 2, and tier 3 systems:
        1. On white cue cards, record the steps and track start and end times for each step (where 00:00 is when the incident occurred).
        2. On yellow cue cards, document gaps in people, process, and technology requirements to complete the step.
        3. On red cue cards, indicate risks (e.g. no backup person for a key staff member).

      Note:

      • Ensure the language is sufficiently genericized (e.g. refer to events, not specifically a burst water pipe).
      • Review isolated failures (e.g. hardware, software). Typically, the recovery procedure documented for individual systems covers the essence of the recovery workflow whether it’s just the one system that failed or it’s part of a site-wide recovery.

      Note: You may have already completed this exercise as part of Create a Right-Sized Disaster Recovery Plan.

      Document your current-state recovery workflow based on the results of the tabletop planning

      Supporting Tool icon 1.1.2 Incident Response Plan Flowcharts, Tabs 2 and 3

      After you finish the tabletop planning exercise, the steps on the set of cue cards define your recovery workflow. Capture this in a flowchart format.

      Use the sample DRP to guide your own flowchart. Some notes on the example are:

      • XMPL’s Incident Management to DR flowchart shows the connection between its standard Service Desk processes and DR processes.
      • XMPL’s high-level workflows outline its recovery of tier 1, 2, and 3 systems.
      • Where more detail is required, include links to supporting documentation. In this example, XMPL Medical includes links to its Systems Recovery Playbook.
      Preview of an Info-Tech Template depicting a sample flowchart.

      This sample flowchart is included in XMPL Recovery Workflows.

      Step 1.2: Create Supporting DRP Documentation

      PHASE 1
      PHASE 2
      PHASE 3
      1.11.21.32.13.13.2
      Start with a Recovery WorkflowCreate Supporting DocumentationWrite the DRP SummarySelect DRP Publishing StrategyIntegrate into Core IT ProcessesConduct an Annual Focused Review

      This step will walk you through the following activities:

      • Create checklists for your playbook.
      • Document more complex procedures with flowcharts.
      • Gather and/or write network topology diagrams.
      • Compile a contact list.
      • Ensure there is enough material for backup personnel.

      This step involves the following participants:

      • DRP Owner
      • System SMEs
      • Backup DR Personnel

      Outcomes of this step

      • Actionable supporting documentation for your disaster recovery plan.
      • Contact list for IT personnel, business personnel, and vendor support.

      1.2 — Create supporting documentation for your disaster recovery plan

      Now that you have a high-level incident response plan, collect the information you need for executing that plan.

      Recovery Workflow

      Write your recovery procedures playbook to be effective and usable. Your playbook documentation should include:

      • Supplementary flowcharts
      • Checklists
      • Topology diagrams
      • Contact lists
      • DRP summary

      Reference vendors’ technical information in your flowcharts and checklists where appropriate.

      Recovery Procedures (Playbook)

      Additional Reference Documentation

      Info-Tech Insight

      Write for your audience. The playbook is for IT; include only the information they need to execute the plan. DRP summaries are for executives and auditors; do not include information intended for IT. Similarly, your disaster recovery plan is not for business units; keep BCP content out of your DRP.

      Use checklists to streamline step-by-step procedures

      Supporting Tool icon 1.2.1 XMPL Medical’s System Recovery Checklists

      Checklists are ideal when staff just need a reminder of what to do, not how to do it.

      XMPL Medical used its high-level flowcharts as a roadmap for creating its Systems Recovery Playbook.

      • Since its Playbook is intended for experienced IT staff, the writing style in the checklists is concise. XMPL includes links to reference material to support recovery, especially for alternate staff who might need additional instruction.
      • XMPL includes key parameters (e.g. IP addresses) rather than assume those details would be memorized, especially in a stressful DR scenario.
      • Similarly, include links to other useful resources such as VM templates.
      Preview of the Info-Tech Template 'Systems Recovery Playbook'.

      Included in the XMPL Systems Recovery Playbook are checklists for recovering XMPL’s virtual desktop infrastructure, mission-critical applications, and core infrastructure components.

      Use flowcharts to document processes with concurrent tasks not easily captured in a checklist

      Supporting Tool icon 1.2.2 XMPL Medical’s Phone Services Recovery Flowchart

      Recovery procedures can consist of flowcharts, checklists, or both, as well as diagrams. The main goal is to be clear and concise.

      • XMPL Medical created a flowchart to capture its phone services recovery procedure to capture concurrent tasks.
      • Additional instructions, where required, could still be captured in a Playbook checklist or other supporting documentation.
      • The flowchart could have also included key settings or other details as appropriate, particularly if the DR team chose to maintain this recovery procedure just in a flowchart format.
      Preview of the Info-Tech Template 'Recovery Workflows'.

      Included in the XMPL DR documentation is an example flowchart for recovering phone systems. This flowchart is in Recovery Workflows.

      Reference this blueprint for more SOP flowchart examples: Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

      Use topology diagrams to capture network layout, integrations, and system information

      Supporting Tool icon 1.2.4 XMPL Medical’s Data Center and Network Diagrams

      Topology diagrams, key checklists, and configuration settings are often enough for experienced networking staff to carry out their DR tasks.

      • XMPL Medical includes these diagrams with its DRP. Instead of recreating these diagrams, the XMPL Medical DR Manager asked their network team for these diagrams:
        • Primary data center diagram
        • DR site diagram
        • High-level network diagrams
      • Often, organizations already have network topology diagrams for reference purposes.

      “Our network engineers came to me and said our standard SOP template didn't work for them. They're now using a lot of diagrams and flowcharts, and that has worked out better for them.” (Assistant Director-IT Operations, Healthcare Industry)

      Preview of the Info-Tech Template 'Systems Recovery Playbook'.

      You can download a PDF and a VSD version of these Data Center and Network Diagrams from Info-Tech’s website.

      Create a list of organizational, IT, and vendor contacts that may be required to assist with recovery

      If there is something strange happening to your IT infrastructure, who you gonna call?

      Many DR managers have their team on speed dial. However, having the contact info of alternate staff, BCP leads, and vendors can be very helpful during a disaster. XMPL Medical lists the following information in its DRP Workbook:

      • The DR Teams, SMEs critical to disaster recovery, their backups, and key contacts (e.g. BC Management team leads, vendor contacts) that would be involved in:
        • Declaring a disaster.
        • Coordinating a response at an organizational level.
        • Executing recovery.
      • The people that have authority to declare a disaster.
      • Each person’s spending authority.
      • The rules for delegating authority.
      • Primary and alternate staff for each role.
      Example list of alternate staff, BCP leads, and vendors.

      Confirm with your DR team that you have all of the documentation that you need to recover during a disaster

      Associated Activity icon 1.2.7 Group Discussion

      DISCUSS: Is there enough information in your DRP for both primary and backup DR personnel?

      • Is it clear who is responsible for each DR task, including notification steps?
      • Have alternate staff for each role been identified?
      • Does the recovery workflow capture all of the high-level steps?
      • Is there enough documentation for alternate staff (e.g. network specs)?

      Step 1.3: Write the DRP Summary

      PHASE 1
      PHASE 2
      PHASE 3
      1.11.21.32.13.13.2
      Start with a Recovery WorkflowCreate Supporting DocumentationWrite the DRP SummarySelect DRP Publishing StrategyIntegrate into Core IT ProcessesConduct an Annual Focused Review

      This step will walk you through the following activities:

      • Write a DRP summary document.

      This step involves the following participants:

      • DRP Owner

      Outcomes of this step

      • High-level outline of your DRP capabilities for stakeholders such as executives, auditors, and clients.

      Summarize your DR capabilities using a DRP summary document

      Supporting Tool icon 1.3.1 DRP Summary Document

      The sample included on Info-Tech’s website is customized for the XMPL Medical Case Study – use the download as a starting point for your own summary document.

      DRP Summary Document

      XMPL’s DRP Summary is organized into the following categories:

      • DR requirements: This includes a summary of scope, business impact analysis (BIA), risk assessment, and high-level RTOs and achievable RTOs.
      • DR strategy: This includes a summary of XMPL’s recovery procedures, DR site, and backup strategy.
      • Testing and maintenance: This includes a summary of XMPL’s DRP testing and maintenance strategy.

      Be transparent about existing business risks in your DRP summary

      The DRP summary document is business facing. Include information of which business leaders (and other stakeholders) need to be aware.

      • Discrepancies between desired and achievable RTOs? Organizational leadership needs to know this information. Only then can they assign the resources and budget that IT needs to achieve the desired DR capabilities.
      • What is the DRP’s scope? XMPL Medical lists the IT components that will be recovered during a disaster, and components which will not. For instance, XMPL’s DRP does not recover medical equipment, and XMPL has separate plans for business continuity and emergency response coordination.
      Application tier Desired RTO (hh:mm) Desired RPO (hh:mm) Achievable RTO (hh:mm) Achievable RPO (hh:mm)
      Tier 1 4:00 1:00 *90:00 1:00
      Tier 2 8:00 1:00 *40:00 1:00
      Tier 3 48:00 24:00 *96:00 24:00

      The above table to is a snippet from the XMPL DR Summary Document (section 2.1.3.2).

      In the example, the DR team is unable to recover tier 1, 2, and 3 systems within the desired RTO. As such, they clearly communicate this information in the DRP summary, and include action items to address these gaps.

      Phase 2: Select the Optimal DRP Publishing Strategy

      Step 2.1: Select a DRP Publishing Strategy

      PHASE 1
      PHASE 2
      PHASE 3
      1.11.21.32.13.13.2
      Start with a Recovery WorkflowCreate Supporting DocumentationWrite the DRP SummarySelect DRP Publishing StrategyIntegrate into Core IT ProcessesConduct an Annual Focused Review

      This step will walk you through the following activities:

      • Select criteria for assessing DRP tools.
      • Evaluate categories for DRP tools.
      • Optional: Write an RFP for a BCM tool.

      This step involves the following participants:

      • DRP Owner

      Outcomes of this step

      • Identified strategies for publishing your DRP (i.e. making it available to your DR team).

      Info-Tech Insights

      Diversify your publishing strategy to ensure you can access your DRP in a disaster. For example, if you are using a BCM tool or SharePoint Online as your primary documentation repository, also push the DRP to your DR team’s smartphones as a backup in case the disaster affects internet access.

      2.1 — Select a DR publishing and document management strategy that fits your organization

      Publishing and document management considerations:

      Portability/External Access: Assume your primary site is down and inaccessible. Can you still access your documentation? As shown in this chart, traditional strategies of either keeping a copy at another location (e.g. at the failover site) or with staff (e.g. on a USB drive) still dominate, but these aren’t necessarily the best options.
      A bar chart titled 'Portability Strategy Popularity'. 'External Website (wiki site, cloud-based DRP tool, etc.)' scored 16%. 'Failover Site (network drive or redundant SharePoint, etc.)' scored 53%. 'Distribute to Staff (use USB drive, personal email, etc.)' scored 50%. 'Not Accessible Offsite' scored 7%.
      Note: Percentages total more than 100% due to respondents using more than one portability strategy.
      (Source: Info-Tech Research Group, N=118)
      Maintainability/Usability: How easy is it to create, update, and use the documentation? Is it easy to link to other documents as shown in the flowchart and checklist examples? Is there version control? Lack of version control can create a maintenance nightmare as well as issues in a crisis if staff are questioning whether they have the right version.
      Cost/Effort: Is the cost and effort appropriate? For example, a large enterprise may need a formal solution (e.g. DRP tools or SharePoint), but the cost might be hard to justify for a smaller company.

      Pros and cons of potential strategies

      This section will review the following strategies, their pros and cons, and how they meet publishing and document management requirements:

      • DRP tools (e.g. eBRP, Recovery Planner, LDRPS)
      • In-house solutions combining SharePoint and MS Office (or equivalent)
      • Wiki site
      • “Manual” approaches such as storing documents on a USB drive

      Avoid 42 hours of downtime due to a non-diversified publishing strategy

      CASE STUDY

      Industry Municipality
      Source Interview

      Situation

      • A municipal government has recently completed an end-to-end disaster recovery plan.
      • The team is feeling good about the fact that they were able to identify:
        • Relative criticality of applications.
        • Dependencies for each application.
        • Incident response plans for the current state and desired state.
        • System recovery procedures.

      Challenge

      • While the DR plan itself was comprehensive, the team only published the DR onto the government’s network drives.
      • A power generation issue caused power to be shut down, which in turn cascaded into downtime for the network.
      • Once the network was down, their DRP was inaccessible.

      Insights

      • Each piece of documentation that was created could have contributed to recovery efforts. However, because they were inaccessible, there was a delayed response to the incident. The result was 42 hours of downtime for end users.
      • Having redundant publishing strategies is just like having redundant IT infrastructure. In the event of downtime, not only do you need to have DR documentation, but you also need to make sure that it is accessible.

      Decide on a DR publishing strategy by looking at portability, maintainability, cost, and required effort

      Supporting Tool icon 2.1.1 DRP Publishing and Management Evaluation Tool

      Use the information included in Step 2.1 to guide your analysis of DRP publishing solutions.

      The tool enables you to compare two possible solutions based on these key considerations discussed in this section:

      • Portability/external access
      • Maintainability/usability
      • Cost
      • Effort

      The right choice will depend on factors such as current in-house tools, maturity around document management, the size of your IT department, and so on.

      For example, a small shop may do very well with the USB drive strategy, whereas a multi-national company will need a more formal strategy to manage consistent DRP distribution.

      Preview of Info-Tech's 'DRP Publishing and Management Solution Evaluation Tool'.

      The DRP Publishing and Management Solution Evaluation Tool helps you to evaluate the tools included in this section.

      Don’t think of a business continuity management (BCM) tool as a silver bullet; know what you’re getting out of it

      Portability/External Access:
      • Pros: Typically a SaaS option provides built-in external access with appropriate security and user administration to vary access rights.
      • Cons: Degree of external access is often dependent on the vendor.
      Maintainability/Usability:
      • Pros: Built-in templates encourage consistency and guide initial content development by indicating what details need to be captured.
      • Pros: Built-in document management (e.g. version control, metadata support), centralized access/navigation to required documents, and some automation (e.g. update contacts throughout the system).
      • Cons: Not a silver bullet. You still have to do the work to define and capture your processes.
      • Cons: Requires end-user and administrator training.
      Cost/Effort:
      • Pros: For large enterprises, the convenience of built-in document management and templates can outweigh the cost.
      • Cons: Expect leading DRP tools to cost $20K or more per year.

      About this approach:
      BCM tools are solutions that provide templates, tools, and document management to create BC and DR documentation.

      Info-Tech Insight

      The business case for a BCM tool is built by answering the following questions:

      • Will the BCM tool solve an unmet need?
      • Will the tool be more effective and efficient than an in-house solution?
      • Will the solution provide enhanced capabilities that an in-house solution cannot provide?

      If you cannot get a satisfactory answer to each of these questions, then opt for an in-house solution.

      “We explored a DRP tool, and it was something we might have used, but it was tens of thousands of pounds per year, so it didn’t stack up financially for us at all.” (Rik Toms, Head of Strategy – IP and IT, Cable and Wireless Communications)

      For in-house solutions, leverage tools such as SharePoint to provide document management capabilities

      Portability/External Access:
      • Pros: SharePoint is commonly web-enabled and supports external access with appropriate security and user administration.
      • Cons: Must be installed at redundant sites or be cloud-based to be effective in a crisis that takes down your primary data center.
      Maintainability/Usability:
      • Pros: Built-in document management (e.g. version control, metadata support) as well as centralized access/navigation to required documents.
      • Pros: No tool learning curve – SharePoint and MS Office would be existing solutions already used on a daily basis.
      • Cons: No built-in automation (e.g. automated updates to contacts throughout the system).
      • Cons: Consistency depends on creating templates and implementing processes for document updates, review, and approval.
      Cost/Effort:
      • Pros: Using existing tools, so this is a sunk cost in terms of capex.
      • Cons: Additional effort required to create templates and manage the documentation library.

      About this approach:
      DRPs and SOPs most often start as MS Office documents, even if there is a DRP tool available. For organizations that elect to bypass a formal DRP tool, and most do, the biggest gap they have to overcome is document management.

      Many organizations are turning to SharePoint to meet this need. For those that already have SharePoint in place, it makes sense to further leverage SharePoint for DR documentation and day-to-day SOPs.

      For SharePoint to be a practical solution, the documentation must still be accessible if the primary data center is down, e.g. by having redundant SharePoint instances at multiple in-house locations, or using a cloud-based SharePoint solution.

      “Just about everything that a DR planning tool does, you can do yourself using homegrown solutions or tools that you're already familiar with such as Word, Excel, and SharePoint.” (Allen Zuk, President and CEO, Sierra Management Consulting)

      A healthcare company uses SharePoint as its DRP and SOP documentation management solution

      CASE STUDY Healthcare

      • This organization is responsible for 50 medical facilities across three states.
      • It explored DRP tools, but didn’t find the right fit, so it has developed an in-house solution based in SharePoint. While DRP tools have improved, the organization no longer needs that type of solution. Its in-house solution is meeting its needs.
      • It has SharePoint instances at multiple locations to ensure availability if one site is down.

      Documentation Strategy

      • Created an IT operations library in SharePoint for DR and SOPs, from basic support to bare-metal restore procedures.
      • SOPs are linked from SharePoint to the virtual help desk for greater accessibility.
      • Where practical, diagrams and flowcharts are used, e.g. DR process flowcharts and network services SOPs dominated by diagrams and flowcharts.

      Management Strategy

      • Directors and the CIO have made finishing off SOPs their performance improvement objective for the year. The result is staff have made time to get this work done.
      • Status updates are posted monthly, and documentation is a regular agenda item in leadership meetings.
      • Regular tabletop testing validates documentation and ensures familiarity with procedures, including where to find required information.

      Results

      • Dependency on a few key individuals has been reduced. All relevant staff know what they need to do and where to access required documentation.
      • SOPs are enabling DR training as well as day-to-day operations training for new staff.
      • The organization has a high confidence in its ability to recovery from a disaster within established timelines.

      Explore using a wiki site as an inexpensive alternative to SharePoint and other content management solutions

      Portability/External Access:
      • Pros: Wiki sites can support external access as with any web solution.
      • Cons: Must be installed at redundant sites, hosted, or cloud-based to be effective in a crisis that takes down your primary data center.
      Maintainability/Usability:
      • Pros: Built-in document management (version control, metadata support, etc.) as well as centralized access/navigation to required information.
      • Pros: Authorized users can make updates dynamically, depending on how much restriction you have on the site.
      • Cons: No built-in automation (e.g. automated updates to contacts throughout the system).
      • Cons: Consistency depends on creating templates and implementing processes for document updates, review, and approval.
      Cost/Effort:
      • Pros: An inexpensive option compared to traditional content management solutions such as SharePoint.
      • Cons: Learning curve if wikis are new to your organization.

      About this approach:
      Wiki sites are websites where users collaborate to create and edit the content. Wikipedia is an example.

      While wiki sites are typically used for collaboration and dynamic content development, the traditional collaborative authoring model can be restricted to provide structure and an approval process.

      Several tools are available to create and manage wiki sites (and other collaboration solutions), as outlined in the following research:

      Info-Tech Insight

      If your organization is not already using wiki sites, this technology can introduce a culture shock. Start slow by using a wiki site within a specific department or for a particular project. Then evaluate how well your staff adapt to this technology as well as its potential effectiveness in your organization. Refer to our collaboration strategy research for additional guidance.

      For small IT shops, distributing documentation to key staff (e.g. via a USB drive) can still be effective

      Portability/External Access:
      • Pros: Appropriate staff have the documentation with them; there is no need to log into a remote site or access a tool to get at the information.
      • Cons: Relies on staff to be diligent about ensuring they have the latest documentation and keep it with them (not leave it in their desk drawer).
      Maintainability/Usability:
      • Pros: With this strategy, MS Office (or equivalent) is used to create and maintain the documentation, so there is no learning curve.
      • Pros: Simple, straightforward methodology – keep the master on a network drive, and download a copy to your USB drive.
      • Cons: No built-in automation (e.g. automated updates to contact information) or document management (e.g. version control).
      • Cons: Consistency depends on creating templates and implementing rigid processes for document updates, review, and approval.
      Cost/Effort:
      • Pros: Little to no cost and no tool management required.
      • Cons: “Manual” document management requires strict attention to process for version control, updates, approvals, and distribution.

      About this approach:
      With this strategy, your ERT and key IT staff keep a copy of your DRP and relevant documentation with them (e.g. on a USB drive). If the primary site experiences a major event, they have ready access to the documentation.

      Fifty percent of respondents in our recent survey use this strategy. A common scenario is to use a shared network drive or a solution such as SharePoint as the master centralized repository, but distribute a copy to key staff.

      Info-Tech Insight

      This approach can have similar disadvantages as using hard copies. Ensuring the USB drives are up to date, and that all staff who might need access have a copy, can become a burdensome process. More often, USB drives are updated periodically, so there is the risk that the information will be out of date or incomplete.

      Avoid extensive use of paper copies of DR documentation

      DR documents need to be easy to update, accessible from anywhere, and searchable. Paper doesn’t meet these needs.

      Portability/External Access:
      • Pros: Does not rely on technology or power.
      • Cons: Requires all staff who might be involved in a DR to have a copy, and to have it with them at all times, to truly have access at any time from anywhere.
      Maintainability/Usability:
      • Pros: In terms of usability, again there is no dependence on technology.
      • Cons: Updates need to be printed and distributed to all relevant staff every time there is a change to ensure staff have access to the latest, most accurate documentation if a disaster occurred. You can’t schedule disasters, so information needs to be current all the time.
      • Cons: Navigation to other information is manual – flipping through pages, etc. No searching or hyperlinks.
      Cost/Effort:
      • Pros: No technology system to maintain, aside from what you use for printing.
      • Cons: Printing expenses are actually among the highest incurred by organizations, and this adds to it.
      • Cons: Labor intensive due to need to print and physically distribute documentation updates.

      About this approach:
      Traditionally DRPs are printed and distributed to managers and/or kept in a central location at both the primary site and a secondary site. In addition, wallet cards are distributed that contain key information such as contact numbers.

      A wallet card or even a few printed copies of your high-level DRP for general reference can be helpful, but paper is not a practical solution for your overall DR documentation library, particularly when you include SOPs for recovery procedures.

      One argument in favor of paper is there is no dependency on power during a crisis. However, in a power outage, staff can use smartphones and potentially laptops (with battery power) to access electronically stored documentation to get through first response steps. In addition, your DR site should have backup power to be an appropriate recovery site.

      Optional: Partial list of BCM tool vendors

      A partial list of BCM tool vendors, including: Business Protector, catalyst, clearview, ContinuityLogic. Fusion, Logic Manager, Quantivate, RecoveryPlanner.com, MetricStream, SimpleRisk, riskonnect, Strategic BCP - ResilienceONE, RSA, and Sungard Availability Services.

      The list is only a partial list of BCM tool vendors. The order in which vendors are presented, and inclusion in this list, does not represent an endorsement.

      Optional: Use our list of requirements as a foundation for selecting and reviewing BCM tools

      Supporting Tool icon 2.1.2 BCM Tool – RFP Selection Criteria

      If a BCM tool is the best option for your environment, expedite the evaluation process with our BCM Tool – RFP Selection Criteria.

      Through advisory services, workshops, and consulting engagements, we have created this BCM Tool Requirements List. The featured requirements includes the following categories:

      1. Integrations
      2. Planning and Monitoring
      3. Administration
      4. Architecture
      5. Security
      6. Support and Training
      Preview of the Info-Tech template 'BCM Tool – RFP Selection Criteria'.

      This BCM Tool – RFP Selection Criteria can be appended to an RFP. You can leverage Info-Tech’s RFP Template if your organization does not have one.

      Info-Tech can write full RFPs

      As part of a consulting engagement, Info-Tech can write RFPs for BCM tools and provide a customized scoring tool based on your environment’s unique requirements.

      Phase 3: Keep Your DRP Relevant Through Maintenance Best Practices

      Step 3.1: Integrate DRP maintenance into core IT processes

      PHASE 1
      PHASE 2
      PHASE 3
      1.11.21.32.13.13.2
      Start with a Recovery WorkflowCreate Supporting DocumentationWrite the DRP SummarySelect DRP Publishing StrategyIntegrate into Core IT ProcessesConduct an Annual Focused Review

      This step will walk you through the following activities:

      • Integrate DRP maintenance with Project Management.
      • Integrate DRP considerations into Change Management.
      • Integrate with Performance Management.

      This step involves the following participants:

      • DRP Owner
      • Head of Project Management Office
      • Head of Change Advisory Board
      • CIO

      Outcomes of this step

      • Updated project intake form.
      • Updated change management practice.
      • Updated performance appraisals.

      3.1 — Incorporate DRP maintenance into core IT processes

      Focusing on these three processes will help ensure that your plan stays current, accurate, and usable.

      The Info-Tech / COBIT5 'IT Management and Governance Framework' with three processes highlighted: 'MEA01 Performance Measurement', 'BAI06 Change Management', and 'BAI01 Project Management'.

      Info-Tech Best Practice

      Prioritize quick wins that will have large benefits. The advice presented in this section offers easy ways to help keep your DRP up to date. These simple solutions can save a lot of time and effort for your DRP team as opposed to more intricate changes to the processes above.

      Assess how new projects impact service criticality and DR requirements upfront during project intake

      Icon for process 'BAI01 Project Management'.
      Supporting Tool icon 3.1.1 Sample Project Intake Form Addendum

      Understand the RTO/RPO requirements and IT impacts for new or enhanced services to ensure appropriate provisioning and overall DRP updates.

      • Have submitters include service continuity requirements. This information can be inserted into your business impact analysis. Use similar language that you use in your own BIA.
        • The submitter should know how critical the resulting project will be. Any items that the submitter doesn’t know, the Project Steering Committee should investigate.
      • Have IT assess the impact on the DRP. The submitter will not know how the DRP will be impacted directly. Ask the project committee to consider how DRP documentation and the DR environment will need to be changed due to the project under consideration.

      Note: The goal is not to make DR a roadblock, but rather to ensure project requirements will be met – including availability and DR requirements.

      Preview of the Info-Tech template 'Project Intake Form'.

      This Project Intake Form asks the submitter to fill out the availability and criticality requirements for the project.

      Leverage your change management process to identify required DRP updates as they occur

      Icon for process 'BAI06 Change Management'.

      Avoid the year-end rush to update your DRP. Keeping it up to date as changes occur saves time in the long run and ensures your plan is accurate when you need it.

      • As part of your change management process, identify potential updates to:
        • System documentation (e.g. configuration settings).
        • Recovery procedures (e.g. if a system has been virtualized, that changes the recovery procedure).
        • Your DR environment (e.g. system configuration updates for standby systems).
      • Keep track of how often a system has changed. Relevant DRP documentation might be due for a deeper review:
        • After a system has been changed ten times (even from routine changes), notify your DRP Manager to flag the relevant DRP documentation for review.
        • As part of formal DRP reviews, pay closer attention to DRP documentation for the flagged systems.
      Preview of the Info-Tech template 'Disaster Recovery Change Management'.

      This template asks the submitter to fill out the availability and criticality requirements for the project.

      For change management best practices beyond DRP considerations, please see Optimize Change Management.

      Integrate documentation into performance measurement and performance management

      Icon for process 'MEA01 Performance Measurement'.

      Documentation is a necessary evil – few like to create it and more immediate tasks take priority. If it isn’t scheduled and prioritized, it won’t happen.

      Why documentation is such a challenge

      How management can address these challenges

      We all know that IT staff typically do not like to write documentation. That’s not why they were hired, and good documentation is not what gets them promoted. Include documentation deliverables in your IT staff’s performance appraisal to stress the importance of ensuring documentation is up to date, especially where it might impact DR success.
      Similarly, documentation is secondary to more urgent tasks. Time to write documentation is often not allocated by project managers. Schedule time for developing documentation, just like any other project, or it won’t happen.
      Writing manuals is typically a time-intensive task. Focus on what is necessary for another experienced IT professional to execute the recovery. As discussed earlier, often a diagram or checklist is good enough and actually far more usable in a crisis.

      “Our directors and our CIO have tied SOP work to performance evaluations, and SOP status is reviewed during management meetings. People have now found time to get this work done.” (Assistant Director – IT Operations, Healthcare Industry)

      Step 3.2: Conduct an Annual Focused Review

      PHASE 1
      PHASE 2
      PHASE 3
      1.11.21.32.13.13.2
      Start with a Recovery WorkflowCreate Supporting DocumentationWrite the DRP SummarySelect DRP Publishing StrategyIntegrate into Core IT ProcessesConduct an Annual Focused Review

      This step will walk you through the following activities:

      1. Identify components of your DRP to refresh.
      2. Identify organizational changes requiring further focus.
      3. Test your DRP and identify problems.
      4. Correct problems identified with DRP.

      This step involves the following participants:

      • DRP Owner
      • System SMEs
      • Backup DR Personnel

      Outcomes of this step

      • An actionable, up-to-date DRP.

      Info-Tech Insight

      Testing is a waste of time and resources if you do not fix what’s broken. Tabletop testing is effective at uncovering gaps in your DR processes, but if you don’t address those gaps, then your DRP will still be unusable in a disaster.

      Set up a safety net to capture changes that slipped through the cracks with a focused review process

      Evaluate documentation supporting high-priority systems, as well as documentation supporting IT systems that have been significantly changed.

      • Ideally you’re maintaining documentation as you go along. But you need to have an annual review to catch items that may have slipped through.
      • Don’t review everything. Instead, review:
        • IT systems that have had 10+ changes: small changes and updates can add up over time. Ensure:
          • The plans for these systems are updated for changes (e.g. configuration changes).
          • SMEs and backup personnel are familiar with the changes.
        • Tier 1 / Gold Systems: Ensure that you can still recover tier 1 systems with your existing DRP documentation.
      • Track documentation issues that you discovered with your ticketing system or service desk tool to ensure necessary documentation changes are made.
      1. Annual Focused Review
      2. Tier 1 Systems
      3. Significantly Changed Systems
      4. Organizational Changes

      Identify larger changes, both organizational and within IT, that necessitate DRP updates

      During your focused review, consider how organizational changes have impacted your DRP.

      The COBIT 5 Enablers provide a foundation for this analysis. Consider:

      • Changes in regulatory requirements: Are there new requirements for IT that are not reflected in your DRP? Is the organization required to comply with any additional regulations?
      • Changes to organizational structures, business processes, and how employees work: Can employees still be productive once tier 1 services are restored or have RTOs changed? Has organizational turnover impacted your DRP?
      • SMEs leaving or changing roles: Can IT still execute your DRP? Are there still people for all the key roles?
      • Changes to IT infrastructure and applications: Can the business still access the information they need during a disaster? Is your BIA still accurate? Do new services need to be considered tier 1?

      Info-Tech Best Practice

      COBIT 5 Enablers
      What changes need to be reflected in your DRP?

      A cycle visualization titled 'Disaster Recovery Plan'. Starting at 'Changes in Regulatory Requirements', it proceeds clockwise to 'Organizational Structure', 'Changes in Business Processes', and 'How Employees Work', before it returns to DRP. Then 'Changes to Applications', 'Changes to Infrastructure', 'SMEs Leaving or Changing Roles', and then back to the DRP.

      Create a plan during your annual focused review to test your DRP throughout the year

      Regardless of your documentation approach, training and familiarity with relevant procedures is critical.

      • Start with tabletop exercises and progress to technology-based testing (simulation, parallel, and full-scale testing).
      • Ask staff to reference documentation while testing, even if they do not need to. This practice helps to confirm documentation accuracy and accessibility.
      • Incorporate cross-training in DR testing. This gives important experience to backup personnel and will further validate that documents are complete and accurate.
      • Track any discovered documentation issues with your ticketing system or project tracking tools to ensure necessary documentation changes are made.

      Example Test Schedule:

      1. Q1: Tabletop testing shadowed by backup personnel
      2. Q2: Tabletop testing led by backup personnel
      3. Q3: Technology-based testing
      4. Annual Focused Review: Review Results

      Reference this blueprint for guidance on DRP testing plans: Reduce Costly Downtime Through DR Testing

      Appendix A: XMPL Case Study

      Follow XMPL Medical’s journey through DR documentation

      CASE STUDY

      Industry Healthcare
      Source Created by amalgamating data from Info-Tech’s client base

      Streamline your documentation and maintenance process by following the approach outlined in XMPL Medical’s journey to an end-to-end DRP.

      Outline of the Disaster Recovery Plan

      XMPL’s disaster recovery plan includes its business impact analysis and a subset of tier 1 and tier 2 patient care applications.

      Its DRP includes incident response flowcharts, system recovery checklists, and a communication plan. Its DRP also references IT operations documentation (e.g. asset management documents, system specs, and system configuration docs), but this material is not published with the example documentation.

      Resulting Disaster Recovery Plan

      XMPL’s DRP includes actionable documents in the form of high-level disaster response plan flowcharts and system recovery checklists. During an incident, the DR team is able to clearly see the items for which they are responsible.

      Disaster Recovery Plan
      • Recovery Workflow
      • Business Impact Analysis
      • DRP Summary
      • System Recovery Checklists
      • Communication, Assessment, and Disaster Declaration Plan

      Info-Tech Best Practice

      XMPL Medical’s disaster recovery plan illustrates an effective DRP. Model your end-to-end disaster recovery plan after XMPL’s completed templates. The specific data points will differ from organization to organization, but the structure of each document will be similar.

      Model your disaster recovery documentation off of our example

      CASE STUDY

      Industry Healthcare
      Source Created by amalgamating data from Info-Tech’s client base

      Recovery Workflow:

      • Recovery Workflows (PDF, VSDX)

      Recovery Procedures (Systems Recovery Playbook):

      • DR Notification, Assessment, and Disaster Declaration Plan
      • Systems Recovery Playbook
      • Network Topology Diagrams

      Additional Reference Documentation:

      • DRP Workbook
      • Business Impact Analysis
      • DRP Summary Document

      Use our structure to create your practical disaster recovery plan.

      Appendix B: Summary, Next Steps, and Bibliography

      Insight breakdown

      Use visual-based documentation instead of a traditional DRP manual.

      • Flowcharts, checklists, and diagrams are more concise, easier to maintain, and more effective in a crisis.
      • Write for an IT audience and focus on how to recover. You don’t need 30 pages of fluff describing the purpose of the document.

      Create your DRP in layers to keep the work manageable.

      • Start with a recovery workflow to ensure a coordinated response, and build out supporting documentation over time.

      Prioritize quick wins to make DRP maintenance easier and more likely to happen.

      • Incorporate DRP maintenance into change management and project intake procedures to systematically update and refine the DR documentation. Don’t save up changes for a year-end blitz, which turns document maintenance into an onerous project.

      Summary of accomplishment

      Knowledge Gained

      • How to create visual-based DRP documentation
      • How to integrate DRP maintenance into core IT processes

      Processes Optimized

      • DRP documentation creation
      • DRP publishing tool selection
      • DRP documentation maintenance

      Deliverables Completed

      • DRP documentation
      • Strategy for publishing your DRP
      • Modified project-intake form
      • Change management checklist for DR considerations

      Project step summary

      Client Project: Document and Maintain Your Disaster Recovery Plan

      • Create a recovery workflow.
      • Create supporting DRP documentation.
      • Write a summary for your DRP.
      • Decide on a publishing strategy.
      • Incorporate DRP maintenance into core IT processes.
      • Conduct an annual focused review.

      Info-Tech Insight

      This project has the ability to fit the following formats:

      • Onsite workshop by Info-Tech Research Group consulting analysts.
      • Do-it-yourself with your team.
      • Remote delivery (Info-Tech Guided Implementation).

      Related Info-Tech research

      Create a Right-Sized Disaster Recovery Plan
      Close the gap between your DR capabilities and service continuity requirements.

      Reduce Costly Downtime Through DR Testing
      Improve the accuracy of your DRP and your team’s ability to efficiently execute recovery procedures through regular DR testing.

      Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind
      Go beyond satisfying auditors to drive process improvement, consistent IT operations, and effective knowledge transfer.

      Prepare for a DRP Audit
      Assess your current DRP maturity, identify required improvements, and complete an audit-ready DRP summary document.

      Bibliography

      A Structured Approach to Enterprise Risk Management (ERM) and the Requirements of ISO 31000. The Association of Insurance and Risk Managers, Alarm: The Public Risk Management Association, and The Institute of Risk Management, 2010.

      “APO012: Manage Risk.” COBIT 5: Enabling Processes. ISACA, 2012.

      Bird, Lyndon, Ian Charters, Mel Gosling, Tim Janes, James McAlister, and Charlie Maclean-Bristol. Good Practice Guidelines: A Guide to Global Good Practice in Business Continuity. Global ed. Business Continuity Institute, 2013.

      COBIT 5: A Business Framework for the Governance and Management of Enterprise IT. ISACA, 2012.

      “EDM03: Ensure Risk Optimisation.” COBIT 5: Enabling Processes. ISACA, 2012.

      Risk Management. ISO 31000:2009.

      Rothstein, Philip Jan. Disaster Recovery Testing: Exercising Your Contingency Plan. Rothstein Associates: 1 Oct. 2007.

      Societal Security – Business continuity management systems – Guidance. ISO 22313:2012.

      Societal Security – Business continuity management systems – Requirements. ISO 22301:2012.

      Understanding and Articulating Risk Appetite. KPMG, 2008.

      pricing

      • TymansGroupVideosExcerpt: BasicFor freelancers$19/ month 10 presentations/monthSupport at $25/hour1 campaign/month Choose plan StandardFor medium sized teams$29/ month 50 presentations/month5 hours of free support10 campaigns/month Choose plan EnterpriseFor large companies$79/ month Unlimited presentationsUnlimited supportUnlimited campaigns Choose plan

      Pricing

      Our pricing options will be available soon for simple download,

      In the meantime, please book a free discovery call. No cost, no sales pitch.

      Continue reading

      Measure and Manage Customer Satisfaction Metrics That Matter the Most

      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Marketing Solutions
      • Parent Category Link: /marketing-solutions
      • Lack of understanding of what is truly driving customer satisfaction or dissatisfaction.
      • Lack of insight into who our satisfied and dissatisfied customers are.
      • Lack of a system for early detection of declines in satisfaction.
      • Lack of clarity on what to improve and how resources should be allocated.

      Our Advice

      Critical Insight

      • All software companies measure satisfaction in some way, but many lack understanding of what’s truly driving customers to stay or leave. By understanding the true drivers of satisfaction, solution providers can measure and monitor satisfaction more effectively, pull actionable insights and feedback, and make changes to products and services that customers really care about and will keep them coming back to you to have their needs met.
      • Obstacles:
        • Use of metrics that don’t provide the insight needed to make impactful changes that will boost satisfaction and ultimately, retention and profit.
        • Lack of a clear definition of what satisfaction means to customers, metric definitions and/or standard methods of measurement, and a consistent monitoring cadence.

      Impact and Result

      • Understanding of who your satisfied and dissatisfied customers are.
      • Understanding of the true drivers of satisfaction and dissatisfaction among your customer segments.
      • Establishment of a repeatable process and cadence for effective satisfaction measurement and monitoring.
      • Development of an executable customer satisfaction improvement plan that identifies customer journey pain points and areas of dissatisfaction, and outlines how to improve them.
      • Knowledge of where money, time, and other resources are needed most to improve satisfaction levels and ultimately increase retention.

      Measure and Manage Customer Satisfaction Metrics That Matter the Most Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Measure and Manage the Customer Satisfaction Metrics that Matter the Most Deck – An overview of how to understand what drives customer satisfaction and how to measure and manage it for improved business outcomes.

      Understand the true drivers of customer satisfaction and build a process for managing and improving customer satisfaction.

      [infographic]

      Further reading

      Measure and Manage the Customer Satisfaction Metrics that Matter the Most

      Understand what truly keeps your customer satisfied. Start to measure what matters to improve customer experience and increase satisfaction and advocacy. 

      EXECUTIVE BRIEF

      Analyst perspective

      Understanding and measuring the true drivers of satisfaction enable the delivery of real customer value

      The image contains a picture of Emily Wright.

      “Healthy customer relationships are the paramount to long-term growth. When customers are satisfied, they remain loyal, spend more, and promote your company to others in their network. The key to high satisfaction is understanding and measuring the true drivers of satisfaction to enable the delivery of real customer value.

      Most companies believe they know who their satisfied customers are and what keeps them satisfied, and 76% of B2B buyers expect that providers understand their unique needs (Salesforce Research, 2020). However, on average B2B companies have customer experience scores of less than 50% (McKinsey, 2016). This disconnect between customer expectations and provider experience indicates that businesses are not effectively measuring and monitoring satisfaction and therefore are not making meaningful enhancements to their service, offerings, and overall experience.

      By focusing on the underlying drivers of customer satisfaction, organizations develop a truly accurate picture of what is driving deep satisfaction and loyalty, ensuring that their company will achieve sustainable growth and stay competitive in a highly competitive market.”

      Emily Wright

      Senior Research Analyst, Advisory

      SoftwareReviews

      Executive summary

      Your Challenge

      Common Obstacles

      SoftwareReviews’ Approach

      Getting a truly accurate picture of satisfaction levels among customers, and where to focus efforts to improve satisfaction, is challenging. Providers often find themselves reacting to customer challenges and being blindsided when customers leave. More effective customer satisfaction measurement is possible when providers self-assess for the following challenges:

      • Lack of understanding of what is truly driving customer satisfaction or dissatisfaction.
      • Lack of insight into who our satisfied and dissatisfied customers are.
      • Lack of a system for early detection of declines in satisfaction.
      • Lack of clarity of what needs to be improved and how resources should be allocated.
      • Lack of reliable internal data for effective customer satisfaction monitoring.

      What separates customer success leaders from developing a full view of their customers are several nagging obstacles:

      • Use of metrics that don’t provide the insight needed to make impactful changes that will boost satisfaction and ultimately, retention and profit.
      • Friction from customers participating in customer satisfaction studies.
      • Lack of data, or integrated databases from which to track, pull, and analyze customer satisfaction data.
      • Lack a clear definition of what satisfaction means to customers, metric definitions, and/or standard methods of measurement and a consistent monitoring cadence.
      • Lack of time, resources, or technology to uncover and effectively measure and monitor satisfaction drivers.

      Through the SoftwareReviews’ approach, customer success leaders will:

      • Understand who your satisfied and dissatisfied customers are.
      • Understand the true drivers of satisfaction and dissatisfaction among your customer segments.
      • Establish a repeatable process and cadence for effective satisfaction measurement and monitoring.
      • Develop an executable customer satisfaction improvement plan that identifies customer journey pain points and areas of dissatisfaction, and outlines how to improve them.
      • Know where money, time, and resources are needed most to improve satisfaction levels and ultimately retention.

      Overarching SoftwareReviews Advisory Insight:

      All companies measure satisfaction in some way, but many lack understanding of what’s truly driving customers to stay or leave. By understanding the true drivers of satisfaction, solution providers can measure and monitor satisfaction more effectively, pull actionable insights and feedback, and make changes to products and services that customers really care about. This will keep them coming back to you to have their needs met.

      Healthy Customer Relationships are vital for long-term success and growth

      Measuring customer satisfaction is critical to understanding the overall health of your customer relationships and driving growth.

      Through effective customer satisfaction measurement, organizations can:

      Improve Customer Experience

      Increase Retention and CLV

      Increase Profitability

      Reduce Costs

      • Provide insight into where and how to improve.
      • Enhance experience, increase loyalty.
      • By providing strong CX, organizations can increase revenue by 10-15% (McKinsey, 2014).
      • Far easier to retain existing customers than to acquire new ones.
      • Ensuring high satisfaction among customers increases Customer Lifetime Value (CLV) through longer tenure and higher spending.
      • NPS Promoter score has a customer lifetime value that's 600%-1,400% higher than a Detractor (Bain & Company, 2015).
      • Highly satisfied customers spend more through expansions and add-ons, as well as through their long tenure with your company.
      • They also spread positive word of mouth, which brings in new customers.
      • “Studies demonstrate a strong correlation between customer satisfaction and increased profits — with companies with high customer satisfaction reporting 5.7 times more revenue than competitors.” (Matthew Loper, CEO and Co-Founder of WELLTH, 2022)
      • Measuring, monitoring, and maintaining high satisfaction levels reduces costs across the board.
      • “Providing a high-quality customer experience can save up to 33% of customer service costs” (Deloitte, 2018).
      • Satisfied customers are more likely to spread positive word of mouth which reduces acquisition / marketing costs for your company.

      “Measuring customer satisfaction is vital for growth in any organization; it provides insights into what works and offers opportunities for optimization. Customer satisfaction is essential for improving loyalty rate, reducing costs and retaining your customers.”

      -Ken Brisco, NICE, 2019

      Poor customer satisfaction measurement is costly

      Virtually all companies measure customer satisfaction, but few truly do it well. All too often, customer satisfaction measurement consists of a set of vanity metrics that do not result in actionable insight for product/service improvement. Improper measurement can result in numerous consequences:

      Direct and Indirect Costs

      Being unaware of true drivers of satisfaction that are never remedied costs your business directly through customer churn, service costs, etc.

      Tarnished Brand

      Tarnished brand through not resolving issues drives dissatisfaction; dissatisfied customers share their negative experiences, which can damage brand image and reputation.

      Waste Limited Resources

      Putting limited resources towards vanity programs and/or fixes that have little to no bearing on core satisfaction drivers wastes time and money.

      “When customer dissatisfaction goes unnoticed, it can slowly kill a company. Because of the intangible nature of customer dissatisfaction, managers regularly underestimate the magnitude of customer dissatisfaction and its impact on the bottom line.”

      - Lakshmiu Tatikonda, “The Hidden Costs of Customer Dissatisfaction”, 2013

      SoftwareReviews Advisory Insight:

      Most companies struggle to understand what’s truly driving customers to stay or leave. By understanding the true satisfaction drivers, tech providers can measure and monitor satisfaction more effectively, avoiding the numerous harmful consequences that result from average customer satisfaction measurement.

      Does your customer satisfaction measurement process need improvement?

      Getting an accurate picture of customer satisfaction is no easy task. Struggling with any of the following means you are ready for a detailed review of your customer satisfaction measurement efforts:

      • Not knowing who your most satisfied customers are.
      • Lacking early detection for declining satisfaction – either reactive, or unaware of dissatisfaction as it’s occurring.
      • Lacking a process for monitoring changes in satisfaction and lack ability to be proactive; you feel blindsided when customers leave.
      • Inability to fix the problem and wasting money on the wrong areas, like vanity metrics that don’t bring value to customers.
      • Spending money and other resources towards fixes based on a gut feeling, without quantifying the real root cause drivers and investing in their improvement.
      • Having metrics and data but lacking context; don’t know what contributed to the metrics/results, why people are dissatisfied or what contributes to satisfaction.
      • Lacking clear definition of what satisfaction means to customers / customer segments.
      • Difficulty tying satisfaction back to financial results.

      Customers are more satisfied with software vendors who understand the difference between surface level and short-term satisfaction, and deep or long-term satisfaction

      Surface-level satisfaction

      Surface-level satisfaction has immediate effects, but they are usually short-term or limited to certain groups of users. There are several factors that contribute to satisfaction including:

      • Novelty of new software
      • Ease of implementation
      • Financial savings
      • Breadth of features

      Software Leaders Drive Deep Satisfaction

      Deep satisfaction has long-term and meaningful impacts on the way that organizations work. Deep satisfaction has staying power and increases or maintains satisfaction over time, by reducing complexity and delivering exceptional quality for end-users and IT alike. This report found that the following capabilities provided the deepest levels of satisfaction:

      • Usability and intuitiveness
      • Quality of features
      • Ease of customization
      • Vendor-specific capabilities

      The above solve issues that are part of everyday problems, and each drives satisfaction in deep and meaningful ways. While surface-level satisfaction is important, deep and impactful capabilities can sustain satisfaction for a longer time.

      Deep Customer Satisfaction Among Software Buyers Correlates Highly to “Emotional Attributes”

      Vendor Capabilities and Product Features remain significant but are not the primary drivers

      The image contains a graph to demonstrate a correlation to Satisfaction, all Software Categories.
      Source: SoftwareReviews buyer reviews (based on 82,560 unique reviews).

      Driving deep satisfaction among software customers vs. surface-level measures is key

      Vendor capabilities and product features correlate significantly to buyer satisfaction

      Yet, it’s the emotional attributes – what we call the “Emotional Footprint”, that correlate more strongly

      Business-Value Created and Emotional Attributes are what drives software customer satisfaction the most

      The image contains a screenshot of a graph to demonstrate Software Buyer Satisfaction Drivers and Emotional Attributes are what drives software customer satisfaction.

      Software companies looking to improve customer satisfaction will focus on business value created and the Emotional Footprint attributes outlined here.

      The essential ingredient is understanding how each is defined by your customers.

      Leaders focus on driving improvements as described by customers.

      SoftwareReviews Insight:

      These true drivers of satisfaction should be considered in your customer satisfaction measurement and monitoring efforts. The experience customers have with your product and brand is what will differentiate your brand from competitors, and ultimately, power business growth. Talk to a SoftwareReviews Advisor to learn how users rate your product on these satisfaction drivers in the SoftwareReviews Emotional Footprint Report.

      Benefits of Effective Customer Satisfaction Measurement

      Our research provides Customer Success leaders with the following key benefits:

      • Ability to know who is satisfied, dissatisfied, and why.
      • Confidence in how to understand or uncover the factors behind customer satisfaction; understand and identify factors driving satisfaction, dissatisfaction.
      • Ability to develop a clear plan for improving customer satisfaction.
      • Knowledge of how to establish a repeatable process for customer satisfaction measurement and monitoring that allows for proactivity when declines in satisfaction are detected.
      • Understanding of what metrics to use, how to measure them, and where to find the right information/data.
      • Knowledge of where money, time, and other resources are needed most to drive tangible customer value.

      “81% of organizations cite CX as a competitive differentiator. The top factor driving digital transformation is improving CX […] with companies reporting benefits associated with improving CX including:

      • Increased customer loyalty (92%)
      • An uplift in revenue (84%)
      • Cost savings (79%).”

      – Dan Cote, “Advocacy Blooms and Business Booms When Customers and Employees Engage”, Influitive, 2021

      The image contains a screenshot of a thought model that focuses on Measure & Manage the Customer Satisfaction Metrics That Matter the Most.

      Who benefits from improving the measurement and monitoring of customer satisfaction?

      This Research Is Designed for:

      • Customer Success leaders and marketers who are:
        • Responsible for understanding how to benchmark, measure, and understand customer satisfaction to improve satisfaction, NPS, and ROI.
        • Looking to take a more proactive and structured approach to customer satisfaction measurement and monitoring.
        • Looking for a more effective and accurate way to measure and understand how to improve customer satisfaction around products and services.

      This Research Will Help You:

      • Understand the factors driving satisfaction and dissatisfaction.
      • Know which customers are satisfied/dissatisfied.
      • Know where time, money, and resources are needed the most in order to improve or maintain satisfaction levels.
      • Develop a formal plan to improve customer satisfaction.
      • Establish a repeatable process for customer satisfaction measurement and monitoring that allows for proactivity when declines in satisfaction are detected.

      This Research Will Also Assist:

      • Customer Success Leaders, Marketing and Sales Directors and Managers, Product Marketing Managers, and Advocacy Managers/Coordinators who are responsible for:
        • Product improvements and enhancements
        • Customer service and onboarding
        • Customer advocacy programs
        • Referral/VoC programs

      This Research Will Help Them:

      • Coordinate and align on customer experience efforts and actions.
      • Gather and make use of customer feedback to improve products, solutions, and services provided.
      • Provide an amazing customer experience throughout the entirety of the customer journey.

      SoftwareReviews’ methodology for measuring the customer satisfaction metrics that matter the most

      1. Identify true customer satisfaction drivers

      2. Develop metrics dashboard

      3. Develop customer satisfaction measurement and management plan

      Phase Steps

      1. Identify data sources, documenting any gaps in data
      2. Analyze all relevant data on customer experiences and outcomes
      3. Document top satisfaction drivers
      1. Identify business goals, problems to be solved / define business challenges and marketing/customer success goals
      2. Use SR diagnostic to assess current state of satisfaction measurement, assessing metric alignment to satisfaction drivers
      3. Define your metrics dashboard
      4. Develop common metric definitions, language for discussing, and standards for measuring customer satisfaction
      1. Determine committee structure to measure performance metrics over time
      2. Map out gaps in satisfaction along customer journey/common points in journey where customers are least dissatisfied
      3. Build plan that identifies weak areas and shows how to fix using SR’s emotional footprint, other measures
      4. Create plan and roadmap for CSat improvement
      5. Create communication deck

      Phase Outcomes

      1. Documented satisfaction drivers
      2. Documented data sources and gaps in data
      1. Current state customer satisfaction measurement analysis
      2. Common metric definitions and measurement standards
      3. Metrics dashboard
      1. Customer satisfaction measurement plan
      2. Customer satisfaction improvement plan
      3. Customer journey maps
      4. Customer satisfaction improvement communication deck
      5. Customer Satisfaction Committee created

      Insight summary

      Understanding and measuring the true drivers of satisfaction enable the delivery of real customer value

      All software companies measure satisfaction in some way, but many lack understanding of what’s truly driving customers to stay or leave. By understanding the true drivers of satisfaction, solution providers can measure and monitor satisfaction more effectively, pull actionable insights and feedback, and make changes to products and services that customers really care about and which will keep them coming back to you to have their needs met.

      Positive experiences drive satisfaction more so than features and cost

      According to our analysis of software buyer reviews data*, the biggest drivers of satisfaction and likeliness to recommend are the positive experiences customers have with vendors and their products. Customers want to feel that:

      1. Their productivity and performance is enhanced, and the vendor is helping them innovate and grow as a company.
      2. Their vendor inspires them and helps them to continually improve.
      3. They can rely on the vendor and the product they purchased.
      4. They are respected by the vendor.
      5. They can trust that the vendor will be on their side and save them time.
      *8 million data points across all software categories

      Measure Key Relationship KPIs to gauge satisfaction

      Key metrics to track include the Business Value Created score, Net Emotional Footprint, and the Love/Hate score (the strength of emotional connection).

      Orient the organization around customer experience excellence

      1. Arrange staff incentives around customer value instead of metrics that are unrelated to satisfaction.
      2. Embed customer experience as a core company value and integrate it into all functions.
      3. Make working with your organization easy and seamless for customers.

      Have a designated committee for customer satisfaction measurement

      Best in class organizations create customer satisfaction committees that meet regularly to measure and monitor customer satisfaction, resolve issues quickly, and work towards improved customer experience and profit outcomes.

      Use metrics that align to top satisfaction drivers

      This will give you a more accurate and fulsome view of customer satisfaction than standard satisfaction metrics alone will.

      Guided Implementation

      What is our GI on measuring and managing the customer satisfaction metrics that matter most?

      Identify True Customer Satisfaction Drivers

      Develop Metrics Dashboard Develop Customer Satisfaction Measurement and Management Plan

      Call #1: Discuss current pain points and barriers to successful customer satisfaction measurement, monitoring and maintenance. Plan next call – 1 week.

      Call #2: Discuss all available data, noting any gaps. Develop plan to fill gaps, discuss feasibility and timelines. Plan next call – 1 week.

      Call #3: Walk through SoftwareReviews reports to understand EF and satisfaction drivers. Plan next call – 3 days.

      Call #4: Segment customers and document key satisfaction drivers. Plan next call – 2 week.

      Call #5: Document business goals and align them to metrics. Plan next call – 1 week.

      Call #6: Complete the SoftwareReviews satisfaction measurement diagnostic. Plan next call – 3 days.

      Call #7: Score list of metrics that align to satisfaction drivers. Plan next call – 2 days.

      Call #8: Develop metrics dashboard and definitions. Plan next call – 2 weeks.

      Call #9: Finalize metrics dashboard and definitions. Plan next call – 1 week.

      Call #10: Discuss committee and determine governance. Plan next call – 2 weeks.

      Call #11: Map out gaps in satisfaction along customer journey as they relate to top satisfaction drivers. Plan next call –2 weeks.

      Call #12: Develop plan and roadmap for satisfaction improvement. Plan next call – 1 week.

      Call #13: Finalize plan and roadmap. Plan next call – 1 week.

      Call # 14: Review and coach on communication deck.

      A Guided Implementation (GI) is series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization.

      For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst.

      Your engagement managers will work with you to schedule analyst calls.

      Software Reviews offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
      Included within Advisory Membership Optional add-ons

      Bibliography

      “Are you experienced?” Bain & Company, Apr. 2015. Accessed 6 June. 2022.

      Brisco, Ken. “Measuring Customer Satisfaction and Why It’s So Important.” NICE, Feb. 2019. Accessed 6 June. 2022.

      CMO.com Team. “The Customer Experience Management Mandate.” Adobe Experience Cloud Blog, July 2019. Accessed 14 June. 2022.

      Cote, Dan. “Advocacy Blooms and Business Booms When Customers and Employees Engage.” Influitive, Dec. 2021. Accessed 15 June. 2022.

      Fanderl, Harald and Perrey, Jesko. “Best of both worlds: Customer experience for more revenues and lower costs.” McKinsey & Company, Apr. 2014. Accessed 15 June. 2022.

      Gallemard, Jeremy. “Why – And How – Should Customer Satisfaction Be Measured?” Smart Tribune, Feb. 2020. Accessed 6 June. 2022.

      Kumar, Swagata. “Customer Success Statistics in 2021.” Customer Success Box, 2021. Accessed 17 June. 2022.

      Lakshmiu Tatikonda, “The Hidden Costs of Customer Dissatisfaction”, Management Accounting Quarterly, vol. 14, no. 3, 2013, pp 38. Accessed 17 June. 2022.

      Loper, Matthew. “Why ‘Customer Satisfaction’ Misses the Mark – And What to Measure Instead.” Newsweek, Jan. 2022. Accessed 16 June. 2022.

      Maechler, Nicolas, et al. “Improving the business-to-business customer experience.” McKinsey & Company, Mar. 2016. Accessed 16 June.

      “New Research from Dimension Data Reveals Uncomfortable CX Truths.” CISION PR Newswire, Apr. 2017. Accessed 7 June. 2022.

      Sheth, Rohan. 75 Must-Know Customer Experience Statistics to move Your Business Forward in 2022.” SmartKarrot, Feb. 2022. Accessed 17 June. 2022.

      Smith, Mercer. “111 Customer Service Statistics and Facts You Shouldn’t Ignore.” HelpScout, May 2022. Accessed 17 June. 2022.

      “State of the Connected Customer.” Salesforce, 2020. Accessed 14 June. 2022

      “The true value of customer experiences.” Deloitte, 2018. Accessed 15 June. 2022.

      Establish Data Governance

      • Buy Link or Shortcode: {j2store}123|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $48,494 Average $ Saved
      • member rating average days saved: 31 Average Days Saved
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management
      • Organizations are faced with challenges associated with changing data landscapes, evolving business models, industry disruptions, regulatory and compliance obligations, as well as changing and maturing user landscapes and demands for data.
      • Although the need for a data governance program is often evident, organizations often miss the mark.
      • Your data governance efforts should be directly aligned to delivering measurable business value by supporting key strategic initiatives, value streams, and underlying business capabilities.

      Our Advice

      Critical Insight

      • Your organization’s value streams and their associated business capabilities require effectively governed data. Without this, you may experience elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.
      • Ensure your data governance program delivers measurable business value by aligning the associated data governance initiatives with the business architecture.
      • Data governance must continuously align with the organization’s enterprise governance function. It should not be perceived as a pet project of IT, but rather as an enterprise-wide, business-driven initiative.

      Impact and Result

      Info-Tech’s approach to establishing and sustaining effective data governance is anchored in the strong alignment of organizational value streams and their business capabilities with key data governance dimensions and initiatives. Info-Tech's approach will help you:

      • Align your data governance with enterprise governance, business strategy, and the organizational value streams to ensure the program delivers measurable business value.
      • Understand your current data governance capabilities and build out a future state that is right-sized and relevant.
      • Define data governance leadership, accountability, and responsibility.
      • Ensure data governance is supported by an operating model that effectively manages change and communication and fosters a culture of data excellence.

      Establish Data Governance Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Data Governance Research – A step-by-step document to ensure that the people handling the data are involved in the decisions surrounding data usage, data quality, business processes, and change implementation.

      Data governance is a strategic program that will help your organization control data by managing the people, processes, and information technology needed to ensure that accurate and consistent data policies exist across varying lines of the business, enabling data-driven insight. This research will provide an overview of data governance and its importance to your organization, assist in making the case and securing buy-in for data governance, identify data governance best practices and the challenges associated with them, and provide guidance on how to implement data governance best practices for a successful launch.

      • Establish Data Governance – Phases 1-3

      2. Data Governance Planning and Roadmapping Workbook – A structured tool to assist with establishing effective data governance practices.

      This workbook will help your organization understand the business and user context by leveraging your business capability map and value streams, develop data use cases using Info-Tech's framework for building data use cases, and gauge the current state of your organization's data culture.

      • Data Governance Planning and Roadmapping Workbook

      3. Data Use Case Framework Template – An exemplar template to highlight and create relevant use cases around the organization’s data-related problems and opportunities.

      This business needs gathering activity will highlight and create relevant use cases around data-related problems or opportunities that are clear and contained and, if addressed, will deliver value to the organization. This template provides a framework for data requirements and a mapping methodology for creating use cases.

      • Data Use Case Framework Template

      4. Data Governance Initiative Planning and Roadmap Tool – A visual roadmapping tool to assist with establishing effective data governance practices.

      This tool will help your organization plan the sequence of activities, capture start dates and expected completion dates, and create a roadmap that can be effectively communicated to the organization.

      • Data Governance Initiative Planning and Roadmap Tool

      5. Business Data Catalog – A comprehensive template to help you to document the key data assets that are to be governed based on in-depth business unit interviews, data risk/value assessments, and a data flow diagram for the organization.

      Use this template to document information about key data assets such as data definition, source system, possible values, data sensitivity, data steward, and usage of the data.

      • Business Data Catalog

      6. Data Governance Program Charter Template – A program charter template to sell the importance of data governance to senior executives.

      This template will help get the backing required to get a data governance project rolling. The program charter will help communicate the project purpose, define the scope, and identify the project team, roles, and responsibilities.

      • Data Governance Program Charter Template

      7. Data Governance Policy

      This policy establishes uniform data governance standards and identifies the shared responsibilities for assuring the integrity of the data and that it efficiently and effectively serves the needs of your organization.

      • Data Governance Policy

      8. Data Governance Exemplar – An exemplar showing how you can plan and document your data governance outputs.

      Use this exemplar to understand how to establish data governance in your organization. Follow along with the sections of the blueprint Establish Data Governance and complete the document as you progress.

      • Data Governance Exemplar
      [infographic]

      Workshop: Establish Data Governance

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Business Context and Value

      The Purpose

      Identify key business data assets that need to be governed.

      Create a unifying vision for the data governance program.

      Key Benefits Achieved

      Understand the value of data governance and how it can help the organization better leverage its data.

      Gain knowledge of how data governance can benefit both IT and the business.

      Activities

      1.1 Establish business context, value, and scope of data governance at the organization

      1.2 Introduction to Info-Tech’s data governance framework

      1.3 Discuss vision and mission for data governance

      1.4 Understand your business architecture, including your business capability map and value streams

      1.5 Build use cases aligned to core business capabilities

      Outputs

      Sample use cases (tied to the business capability map) and a repeatable use case framework

      Vision and mission for data governance

      2 Understand Current Data Governance Capabilities and Plot Target-State Levels

      The Purpose

      Assess which data contains value and/or risk and determine metrics that will determine how valuable the data is to the organization.

      Assess where the organization currently stands in data governance initiatives.

      Determine gaps between the current and future states of the data governance program.

      Key Benefits Achieved

      Gain a holistic understanding of organizational data and how it flows through business units and systems.

      Identify which data should fall under the governance umbrella.

      Determine a practical starting point for the program.

      Activities

      2.1 Understand your current data governance capabilities and maturity

      2.2 Set target-state data governance capabilities

      Outputs

      Current state of data governance maturity

      Definition of target state

      3 Build Data Domain to Data Governance Role Mapping

      The Purpose

      Determine strategic initiatives and create a roadmap outlining key steps required to get the organization to start enabling data-driven insights.

      Determine timing of the initiatives.

      Key Benefits Achieved

      Establish clear direction for the data governance program.

      Step-by-step outline of how to create effective data governance, with true business-IT collaboration.

      Activities

      3.1 Evaluate and prioritize performance gaps

      3.2 Develop and consolidate data governance target-state initiatives

      3.3 Define the role of data governance: data domain to data governance role mapping

      Outputs

      Target-state data governance initiatives

      Data domain to data governance role mapping

      4 Formulate a Plan to Get to Your Target State

      The Purpose

      Consolidate the roadmap and other strategies to determine the plan of action from Day One.

      Create the required policies, procedures, and positions for data governance to be sustainable and effective.

      Key Benefits Achieved

      Prioritized initiatives with dependencies mapped out.

      A clearly communicated plan for data governance that will have full business backing.

      Activities

      4.1 Identify and prioritize next steps

      4.2 Define roles and responsibilities and complete a high-level RACI

      4.3 Wrap-up and discuss next steps and post-workshop support

      Outputs

      Initialized roadmap

      Initialized RACI

      Further reading

      Establish Data Governance

      Deliver measurable business value.

      Executive Brief

      Analyst Perspective

      Establish a data governance program that brings value to your organization.

      Picture of analyst

      Data governance does not sit as an island on its own in the organization – it must align with and be driven by your enterprise governance. As you build out data governance in your organization, it’s important to keep in mind that this program is meant to be an enabling framework of oversight and accountabilities for managing, handling, and protecting your company’s data assets. It should never be perceived as bureaucratic or inhibiting to your data users. It should deliver agreed-upon models that are conducive to your organization’s operating culture, offering clarity on who can do what with the data and via what means. Data governance is the key enabler for bringing high-quality, trusted, secure, and discoverable data to the right users across your organization. Promote and drive the responsible and ethical use of data while helping to build and foster an organizational culture of data excellence.

      Crystal Singh

      Director, Research & Advisory, Data & Analytics Practice

      Info-Tech Research Group

      Executive Summary

      Your Challenge

      The amount of data within organizations is growing at an exponential rate, creating a need to adopt a formal approach to governing data. However, many organizations remain uninformed on how to effectively govern their data. Comprehensive data governance should define leadership, accountability, and responsibility related to data use and handling and be supported by a well-oiled operating model and relevant policies and procedures. This will help ensure the right data gets to the right people at the right time, using the right mechanisms.

      Common Obstacles

      Organizations are faced with challenges associated with changing data landscapes, evolving business models, industry disruptions, regulatory and compliance obligations, and changing and maturing user landscape and demand for data. Although the need for a data governance program is often evident, organizations miss the mark when their data governance efforts are not directly aligned to delivering measurable business value. Initiatives should support key strategic initiatives, as well as value streams and their underlying business capabilities.

      Info-Tech’s Approach

      Info-Tech’s approach to establishing and sustaining effective data governance is anchored in the strong alignment of organizational value streams and their business capabilities with key data governance dimensions and initiatives. Organizations should:

      • Align their data governance with enterprise governance, business strategy and value streams to ensure the program delivers measurable business value.
      • Understand their current data governance capabilities so as to build out a future state that is right-sized and relevant.
      • Define data leadership, accountability, and responsibility. Support these with an operating model that effectively manages change and communication and fosters a culture of data excellence.

      Info-Tech Insight

      Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face elevated operating costs, missed opportunities, eroded stakeholder satisfaction, and increased business risk.

      Your challenge

      This research is designed to help organizations build and sustain an effective data governance program.

      • Your organization has recognized the need to treat data as a corporate asset for generating business value and/or managing and mitigating risk.
      • This has brought data governance to the forefront and highlighted the need to build a performance-driven enterprise program for delivering quality, trusted, and readily consumable data to users.
      • An effective data governance program is one that defines leadership, accountability, and responsibility related to data use and handling. It’s supported by a well-oiled operating model and relevant policies and procedures, all of which help build and foster a culture of data excellence where the right users get access to the right data at the right time via the right mechanisms.

      As you embark on establishing data governance in your organization, it’s vital to ensure from the get-go that you define the drivers and business context for the program. Data governance should never be attempted without direction on how the program will yield measurable business value.

      “Data processing and cleanup can consume more than half of an analytics team’s time, including that of highly paid data scientists, which limits scalability and frustrates employees.” – Petzold, et al., 2020

      Image is a circle graph and 30% of it is coloured with the number 30% in the middle of the graph

      “The productivity of employees across the organization can suffer.” – Petzold, et al., 2020

      Respondents to McKinsey’s 2019 Global Data Transformation Survey reported that an average of 30% of their total enterprise time was spent on non-value-added tasks because of poor data quality and availability. – Petzold, et al., 2020

      Common obstacles

      Some of the barriers that make data governance difficult to address for many organizations include:

      • Gaps in communicating the strategic value of data and data governance to the organization. This is vital for securing senior leadership buy-in and support, which, in turn, is crucial for sustained success of the data governance program.
      • Misinterpretation or a lack of understanding about data governance, including what it means for the organization and the individual data user.
      • A perception that data governance is inhibiting or an added layer of bureaucracy or complication rather than an enabling and empowering framework for stakeholders in their use and handling of data.
      • Embarking on data governance without firmly substantiating and understanding the organizational drivers for doing so. How is data governance going to support the organization’s value streams and their various business capabilities?
      • Neglecting to define and measure success and performance. Just as in any other enterprise initiative, you have to be able to demonstrate an ROI for time, resources and funding. These metrics must demonstrate the measurable business value that data governance brings to the organization.
      • Failure to align data governance with enterprise governance.
      Image is a circle graph and 78% of it is coloured with the number 78% in the middle of the graph

      78% of companies (and 92% of top-tier companies) have a corporate initiative to become more data-driven. – Alation, 2020

      Image is a circle graph and 58% of it is coloured with the number 58% in the middle of the graph

      But despite these ambitions, there appears to be a “data culture disconnect” – 58% of leaders overestimate the current data culture of their enterprises, giving a grade higher than the one produced by the study. – Fregoni, 2020

      The strategic value of data

      Power intelligent and transformative organizational performance through leveraging data.

      Respond to industry disruptors

      Optimize the way you serve your stakeholders and customers

      Develop products and services to meet ever-evolving needs

      Manage operations and mitigate risk

      Harness the value of your data

      The journey to being data-driven

      The journey to declaring that you are a data-driven organization requires a pit stop at data enablement.

      The Data Economy

      Data Disengaged

      You have a low appetite for data and rarely use data for decision making.

      Data Enabled

      Technology, data architecture, and people and processes are optimized and supported by data governance.

      Data Driven

      You are differentiating and competing on data and analytics; described as a “data first” organization. You’re collaborating through data. Data is an asset.

      Data governance is essential for any organization that makes decisions about how it uses its data.

      Data governance is an enabling framework of decision rights, responsibilities, and accountabilities for data assets across the enterprise.

      Data governance is:

      • Executed according to agreed-upon models that describe who can take what actions with what information, when, and using what methods (Olavsrud, 2021).
      • True business-IT collaboration that will lead to increased consistency and confidence in data to support decision making. This, in turn, helps fuel innovation and growth.

      If done correctly, data governance is not:

      • An annoying, finger-waving roadblock in the way of getting things done.
      • Meant to solve all data-related business or IT problems in an organization.
      • An inhibitor or impediment to using and sharing data.

      Info-Tech’s Data Governance Framework

      An image of Info-Tech's Data Governance Framework

      Create impactful data governance by embedding it within enterprise governance

      A model is depicted to show the relationship between enterprise governance and data governance.

      Organizational drivers for data governance

      Data governance personas:

      Conformance: Establishing data governance to meet regulations and compliance requirements.

      Performance: Establishing data governance to fuel data-driven decision making for driving business value and managing and mitigating business risk.

      Two images are depicted that show the difference between conformance and performance.

      Data Governance is not a one-person show

      • Data governance needs a leader and a home. Define who is going to be leading, driving, and steering data governance in your organization.
      • Senior executive leaders play a crucial role in championing and bringing visibility to the value of data and data governance. This is vital for building and fostering a culture of data excellence.
      • Effective data governance comes with business and IT alignment, collaboration, and formally defined roles around data leadership, ownership, and stewardship.
      Four circles are depicted. There is one person in the circle on the left and is labelled: Data Governance Leadership. The circle beside it has two people in it and labelled: Organizational Champions. The circle beside it has three people in it and labelled: Data Owners, Stewards & Custodians. The last circle has four people in it and labelled: The Organization & Data Storytellers.

      Traditional data governance organizational structure

      A traditional structure includes committees and roles that span across strategic, tactical, and operational duties. There is no one-size-fits-all data governance structure. However, most organizations follow a similar pattern when establishing committees, councils, and cross-functional groups. Most organizations strive to identify roles and responsibilities at a strategic and operational level. Several factors will influence the structure of the program, such as the focus of the data governance project and the maturity and size of the organization.

      A triangular model is depicted and is split into three tiers to show the traditional data governance organizational structure.

      A healthy data culture is key to amplifying the power of your data.

      “Albert Einstein is said to have remarked, ‘The world cannot be changed without changing our thinking.’ What is clear is that the greatest barrier to data success today is business culture, not lagging technology. “– Randy Bean, 2020

      What does it look like?

      • Everybody knows the data.
      • Everybody trusts the data.
      • Everybody talks about the data.

      “It is not enough for companies to embrace modern data architectures, agile methodologies, and integrated business-data teams, or to establish centers of excellence to accelerate data initiatives, when only about 1 in 4 executives reported that their organization has successfully forged a data culture.”– Randy Bean, 2020

      Data literacy is an essential part of a data-driven culture

      • In a data-driven culture, decisions are made based on data evidence, not on gut instinct.
      • Data often has untapped potential. A data-driven culture builds tools and skills, builds users’ trust in the condition and sources of data, and raises the data skills and understanding among their people on the front lines.
      • Building a data culture takes an ongoing investment of time, effort, and money. This investment will not achieve the transformation you want without data literacy at the grassroots level.

      Data-driven culture = “data matters to our company”

      Despite investments in data initiative, organizations are carrying high levels of data debt

      Data debt is “the accumulated cost that is associated with the sub-optimal governance of data assets in an enterprise, like technical debt.”

      Data debt is a problem for 78% of organizations.

      40% of organizations say individuals within the business do not trust data insights.

      66% of organizations say a backlog of data debt is impacting new data management initiatives.

      33% of organizations are not able to get value from a new system or technology investment.

      30% of organizations are unable to become data-driven.

      Source: Experian, 2020

      Absent or sub-optimal data governance leads to data debt

      Only 3% of companies’ data meets basic quality standards. (Source: Nagle, et al., 2017)

      Organizations suspect 28% of their customer and prospect data is inaccurate in some way. (Source: Experian, 2020)

      Only 51% of organizations consider the current state of their CRM or ERP data to be clean, allowing them to fully leverage it. (Source: Experian, 2020)

      35% of organizations say they’re not able to see a ROI for data management initiatives. (Source: Experian, 2020)

      Embrace the technology

      Make the available data governance tools and technology work for you:

      • Data catalog
      • Business data glossary
      • Data lineage
      • Metadata management

      While data governance tools and technologies are no panacea, leverage their automated and AI-enabled capabilities to augment your data governance program.

      Logos of data governance tools and technology.

      Measure success to demonstrate tangible business value

      Put data governance into the context of the business:

      • Tie the value of data governance and its initiatives back to the business capabilities that are enabled.
      • Leverage the KPIs of those business capabilities to demonstrate tangible and measurable value. Use terms and language that will resonate with senior leadership.

      Don’t let measurement be an afterthought:

      Start substantiating early on how you are going to measure success as your data governance program evolves.

      Build a right-sized roadmap

      Formulate an actionable roadmap that is right-sized to deliver value in your organization.

      Key considerations:

      • When building your data governance roadmap, ensure you do so through an enterprise lens. Be cognizant of other initiatives that might be coming down the pipeline that may require you to align your data governance milestones accordingly.
      • Apart from doing your planning with consideration for other big projects or launches that might be in-flight and require the time and attention of your data governance partners, also be mindful of the more routine yet still demanding initiatives.
      • When doing your roadmapping, consider factors like the organization’s fiscal cycle, typical or potential year-end demands, and monthly/quarterly reporting periods and audits. Initiatives such as these are likely to monopolize the time and focus of personnel key to delivering on your data governance milestones.

      Sample milestones:

      Data Governance Leadership & Org Structure Definition

      Define the home for data governance and other key roles around ownership and stewardship, as approved by senior leadership.

      Data Governance Charter and Policies

      Create a charter for your program and build/refresh associated policies.

      Data Culture Diagnostic

      Understand the organization’s current data culture, perception of data, value of data, and knowledge gaps.

      Use Case Build and Prioritization

      Build a use case that is tied to business capabilities. Prioritize accordingly.

      Business Data Glossary

      Build and/or refresh the business’ glossary for addressing data definitions and standardization issues.

      Tools & Technology

      Explore the tools and technology offering in the data governance space that would serve as an enabler to the program. (e.g. RFI, RFP).

      Key takeaways for effective business-driven data governance

      Data governance leadership and sponsorship is key.

      Ensure strategic business alignment.

      Build and foster a culture of data excellence.

      Evolve along the data journey.

      Make data governance an enabler, not a hindrance.

      Insight summary

      Overarching insight

      Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face the impact of elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.

      Insight 1

      Data governance should not sit as an island in your organization. It must continuously align with the organization’s enterprise governance function. It shouldn’t be perceived as a pet project of IT, but rather as an enterprise-wide, business-driven initiative.

      Insight 2

      Ensure your data governance program delivers measurable business value by aligning the associated data governance initiatives with the business architecture. Leverage the measures of success or KPIs of the underlying business capabilities to demonstrate the value data governance has yielded for the organization.

      Insight 3

      Data governance remains the foundation of all forms of reporting and analytics. Advanced capabilities such as AI and machine learning require effectively governed data to fuel their success.

      Tactical insight

      Tailor your data literacy program to meet your organization’s needs, filling your range of knowledge gaps and catering to your different levels of stakeholders. When it comes to rolling out a data literacy program, there is no one-size-fits-all solution. Your data literacy program is intended to fill the knowledge gaps about data, as they exist in your organization. It should be targeted across the board – from your executive leadership and management through to the subject matter experts across different lines of the business in your organization.

      Info-Tech’s methodology for establishing data governance

      1. Build Business and User Context 2. Understand Your Current Data Governance Capabilities 3. Build a Target State Roadmap and Plan
      Phase Steps
      1. Substantiate Business Drivers
      2. Build High-Value Use Cases for Data Governance
      1. Understand the Key Components of Data Governance
      2. Gauge Your Organization’s Current Data Culture
      1. Formulate an Actionable Roadmap and Right-Sized Plan
      Phase Outcomes
      • Your organization’s business capabilities and value streams
      • A business capability map for your organization
      • Categorization of your organization’s key capabilities
      • A strategy map tied to data governance
      • High-value use cases for data governance
      • An understanding of the core components of an effective data governance program
      • An understanding your organization’s current data culture
      • A data governance roadmap and target-state plan comprising of prioritized initiatives

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Screenshot of Info-Tech's Data Governance Planning and Roadmapping Workbook data-verified=

      Data Governance Planning and Roadmapping Workbook

      Use the Data Governance Planning and Roadmapping Workbook as you plan, build, roll-out, and scale data governance in your organization.

      Screenshot of Info-Tech's Data Use Case Framework Template

      Data Use Case Framework Template

      This template takes you through a business needs gathering activity to highlight and create relevant use cases around the organization’s data-related problems and opportunities.

      Screenshot of Info-Tech's Business Data Glossary data-verified=

      Business Data Glossary

      Use this template to document the key data assets that are to be governed and create a data flow diagram for your organization.

      Screenshot of Info-Tech's Data Culture Diagnostic and Scorecard data-verified=

      Data Culture Diagnostic and Scorecard

      Leverage Info-Tech’s Data Culture Diagnostic to understand how your organization scores across 10 areas relating to data culture.

      Key deliverable:

      Data Governance Planning and Roadmapping Workbook

      Measure the value of this blueprint

      Leverage this blueprint’s approach to ensure your data governance initiatives align and support your key value streams and their business capabilities.

      • Aligning your data governance program and its initiatives to your organization’s business capabilities is vital for tracing and demonstrating measurable business value for the program.
      • This alignment of data governance with value streams and business capabilities enables you to use business-defined KPIs and demonstrate tangible value.
      Screenshot from this blueprint on the Measurable Business Value

      In phases 1 and 2 of this blueprint, we will help you establish the business context, define your business drivers and KPIs, and understand your current data governance capabilities and strengths.

      In phase 3, we will help you develop a plan and a roadmap for addressing any gaps and improving the relevant data governance capabilities so that data is well positioned to deliver on those defined business metrics.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team, has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keeps us on track."

      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting

      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Establish Data Governance project overview

      Contact your account representative for more information. workshops@infotech.com 1-888-670-8889

      1. Build Business and User context2. Understand Your Current Data Governance Capabilities3. Build a Target State Roadmap and Plan
      Best-Practice Toolkit
      1. Substantiate Business Drivers
      2. Build High-Value Use Cases for Data Governance
      1. Understand the Key Components of Data Governance
      2. Gauge Your Organization’s Current Data Culture
      1. Formulate an Actionable Roadmap and Right-Sized Plan
      Guided Implementation
      • Call 1
      • Call 2
      • Call 3
      • Call 4
      • Call 5
      • Call 6
      • Call 7
      • Call 8
      • Call 9
      Phase Outcomes
      • Your organization’s business capabilities and value streams
      • A business capability map for your organization
      • Categorization of your organization’s key capabilities
      • A strategy map tied to data governance
      • High-value use cases for data governance
      • An understanding of the core components of an effective data governance program
      • An understanding your organization’s current data culture
      • A data governance roadmap and target-state plan comprising of prioritized initiatives

      Guided Implementation

      What does a typical GI on this topic look like?

      An outline of what guided implementation looks like.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

      Workshop overview

      Contact your account representative for more information. workshops@infotech.com 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4
      Establish Business Context and Value Understand Current Data Governance Capabilities and Plot Target-State Levels Build Data Domain to Data Governance Role Mapping Formulate a Plan to Get to Your Target State
      Activities
      • Establish business context, value, and scope of data governance at the organization
      • Introduction to Info-Tech’s data governance framework
      • Discuss vision and mission for data governance
      • Understand your business architecture, including your business capability map and value streams
      • Build use cases aligned to core business capabilities
      • Understand your current data governance capabilities and maturity
      • Set target state data governance capabilities
      • Evaluate and prioritize performance gaps
      • Develop and consolidate data governance target-state initiatives
      • Define the role of data governance: data domain to data governance role mapping
      • Identify and prioritize next steps
      • Define roles and responsibilities and complete a high-level RACI
      • Wrap-up and discuss next steps and post-workshop support
      Deliverables
      1. Sample use cases (tied to the business capability map) and a repeatable use case framework
      2. Vision and mission for data governance
      1. Current state of data governance maturity
      2. Definition of target state
      1. Target-state data governance initiatives
      2. Data domain to data governance role mapping
      1. Initialized roadmap
      2. Initialized RACI

      Phase 1

      Build Business and User Context

      Three circles are in the image that list the three phases and the main steps. Phase 1 is highlighted.

      “When business users are invited to participate in the conversation around data with data users and IT, it adds a fundamental dimension — business context. Without a real understanding of how data ties back to the business, the value of analysis and insights can get lost.” – Jason Lim, Alation

      This phase will guide you through the following activities:

      • Identify Your Business Capabilities
      • Define your Organization’s Key Business Capabilities
      • Develop a Strategy Map that Aligns Business Capabilities to Your Strategic Focus

      This phase involves the following participants:

      • Data Governance Leader/Data Leader (CDO)
      • Senior Business Leaders
      • Business SMEs
      • Data Leadership, Data Owners, Data Stewards and Custodians

      Step 1.1

      Substantiate Business Drivers

      Activities

      1.1.1 Identify Your Business Capabilities

      1.1.2 Categorize Your Organization’s Key Business Capabilities

      1.1.3 Develop a Strategy Map Tied to Data Governance

      This step will guide you through the following activities:

      • Leverage your organization’s existing business capability map or initiate the formulation of a business capability map, guided by info-Tech’s approach
      • Determine which business capabilities are considered high priority by your organization
      • Map your organization’s strategic objectives to value streams and capabilities to communicate how objectives are realized with the support of data

      Outcomes of this step

      • A foundation for data governance initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map

      Info-Tech Insight

      Gaining a sound understanding of your business architecture (value streams and business capabilities) is a critical foundation for establishing and sustaining a data governance program that delivers measurable business value.

      1.1.1 Identify Your Business Capabilities

      Confirm your organization's existing business capability map or initiate the formulation of a business capability map:

      • If you have an existing business capability map, meet with the relevant business owners/stakeholders to confirm that the content is accurate and up to date. Confirm the value streams (how your organization creates and captures value) and their business capabilities are reflective of the organization’s current business environment.
      • If you do not have an existing business capability map, follow this activity to initiate the formulation of a map (value streams and related business capabilities):
        1. Define the organization’s value streams. Meet with senior leadership and other key business stakeholders to define how your organization creates and captures value.
        2. Define the relevant business capabilities. Meet with senior leadership and other key business stakeholders to define the business capabilities.

      Note: A business capability defines what a business does to enable value creation. Business capabilities are business terms defined using descriptive nouns such as “Marketing” or “Research and Development.” They represent stable business functions, are unique and independent of each other, and typically will have a defined business outcome.

      Input

      • List of confirmed value streams and their related business capabilities

      Output

      • Business capability map with value streams for your organization

      Materials

      • Your existing business capability map or the template provided in the Data Governance Planning and Roadmapping Workbook accompanying this blueprint

      Participants

      • Key business stakeholders
      • Data stewards
      • Data custodians
      • Data Governance Working Group

      For more information, refer to Info-Tech’s Document Your Business Architecture.

      Define or validate the organization’s value streams

      Value streams connect business goals to the organization’s value realization activities. These value realization activities, in turn, depend on data.

      If the organization does not have a business architecture function to conduct and guide Activity 1.1.1, you can leverage the following approach:

      • Meet with key stakeholders regarding this topic, then discuss and document your findings.
      • When trying to identify the right stakeholders, consider: Who are the decision makers and key influencers? Who will impact this piece of business architecture related work? Who has the relevant skills, competencies, experience, and knowledge about the organization?
      • Engage with these stakeholders to define and validate how the organization creates value.
      • Consider:
        • Who are your main stakeholders? This will depend on the industry in which you operate. For example, customers, residents, citizens, constituents, students, patients.
        • What are your stakeholders looking to accomplish?
        • How does your organization’s products and/or services help them accomplish that?
        • What are the benefits your organization delivers to them and how does your organization deliver those benefits?
        • How do your stakeholders receive those benefits?

      Align data governance to the organization's value realization activities.

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      Info-Tech Insight

      Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face the possibilities of elevated operational costs, missed opportunities, eroded stakeholder satisfaction, negative impact to reputation and brand, and/or increased exposure to business risk.

      Example of value streams – Retail Banking

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Retail Banking

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      Model example of value streams for retail banking.

      For this value stream, download Info-Tech’s Info-Tech’s Industry Reference Architecture for Retail Banking.

      Example of value streams – Higher Education

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Higher Education

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      Model example of value streams for higher education

      For this value stream, download Info-Tech’s Industry Reference Architecture for Higher Education.

      Example of value streams – Local Government

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Local Government

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      Model example of value streams for local government

      For this value stream, download Info-Tech’s Industry Reference Architecture for Local Government.

      Example of value streams – Manufacturing

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Manufacturing

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      Model example of value streams for manufacturing

      For this value stream, download Info-Tech’s Industry Reference Architecture for Manufacturing.

      Example of value streams – Retail

      Value streams connect business goals to the organization’s value realization activities.

      Example value stream descriptions for: Retail

      Model example of value streams for retail

      Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.

      For this value stream, download Info-Tech’s Industry Reference Architecture for Retail.

      Define the organization’s business capabilities in a business capability map

      A business capability defines what a business does to enable value creation. Business capabilities represent stable business functions and typically will have a defined business outcome.

      Business capabilities can be thought of as business terms defined using descriptive nouns such as “Marketing” or “Research and Development.”

      If your organization doesn’t already have a business capability map, you can leverage the following approach to build one. This initiative requires a good understanding of the business. By working with the right stakeholders, you can develop a business capability map that speaks a common language and accurately depicts your business.

      Working with the stakeholders as described above:

      • Analyze the value streams to identify and describe the organization’s capabilities that support them.
      • Consider: What is the objective of your value stream? (This can highlight which capabilities support which value stream.)
      • As you initiate your engagement with your stakeholders, don’t start a blank page. Leverage the examples on the next slides as a starting point for your business capability map.
      • When using these examples, consider: What are the activities that make up your particular business? Keep the ones that apply to your organization, remove the ones that don’t, and add any needed.

      Align data governance to the organization's value realization activities.

      Info-Tech Insight

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      For more information, refer to Info-Tech’s Document Your Business Architecture.

      Example business capability map – Retail Banking

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip:

      Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Retail Banking

      Model example business capability map for retail banking

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail Banking.

      Example business capability map – Higher Education

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip:

      Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Higher Education

      Model example business capability map for higher education

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Higher Education.

      Example business capability map – Local Government

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip:

      Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Local Government

      Model example business capability map for local government

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Local Government.

      Example business capability map – Manufacturing

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip:

      Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Manufacturing

      Model example business capability map for manufacturing

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Manufacturing.

      Example business capability map - Retail

      A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.

      Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.

      Info-Tech Tip:

      Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.

      Example business capability map for: Retail

      Model example business capability map for retail

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail.

      1.1.2 Categorize Your Organization’s Key Capabilities

      Determine which capabilities are considered high priority in your organization.

      1. Categorize or heatmap the organization’s key capabilities. Consult with senior and other key business stakeholders to categorize and prioritize the business’ capabilities. This will aid in ensuring your data governance future state planning is aligned with the mandate of the business. One approach to prioritizing capabilities with business stakeholders is to examine them through the lens of cost advantage creators, competitive advantage differentiators, and/or by high value/high risk.
      2. Identify cost advantage creators. Focus on capabilities that drive a cost advantage for your organization. Highlight these capabilities and prioritize programs that support them.
      3. Identify competitive advantage differentiators. Focus on capabilities that give your organization an edge over rivals or other players in your industry.

      This categorization/prioritization exercise helps highlight prime areas of opportunity for building use cases, determining prioritization, and the overall optimization of data and data governance.

      Input

      • Strategic insight from senior business stakeholders on the business capabilities that drive value for the organization

      Output

      • Business capabilities categorized and prioritized (e.g. cost advantage creators, competitive advantage differentiators, high value/high risk)

      Materials

      • Your existing business capability map or the business capability map derived in the previous activity

      Participants

      • Key business stakeholders
      • Data stewards
      • Data custodians
      • Data Governance Working Group

      For more information, refer to Info-Tech’s Document Your Business Architecture.

      Example of business capabilities categorization or heatmapping – Retail

      This exercise is useful in ensuring the data governance program is focused and aligned to support the priorities and direction of the business.

      • Depending on the mandate from the business, priority may be on developing cost advantage. Hence the capabilities that deliver efficiency gains are the ones considered to be cost advantage creators.
      • The business’ priority may be on maintaining or gaining a competitive advantage over its industry counterparts. Differentiation might be achieved in delivering unique or enhanced products, services, and/or experiences, and the focus will tend to be on the capabilities that are more end-stakeholder-facing (e.g. customer-, student-, patient,- and/or constituent-facing). These are the organization’s competitive advantage creators.

      Example: Retail

      Example of business capabilities categorization or heatmapping – Retail

      For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail.

      1.1.3 Develop a Strategy Map Tied to Data Governance

      Identify the strategic objectives for the business. Knowing the key strategic objectives will drive business-data governance alignment. It’s important to make sure the right strategic objectives of the organization have been identified and are well understood.

      1. Meet with senior business leaders and other relevant stakeholders to help identify and document the key strategic objectives for the business.
      2. Leverage their knowledge of the organization’s business strategy and strategic priorities to visually represent how these map to value streams, business capabilities, and, ultimately, to data and data governance needs and initiatives. Tip: Your map is one way to visually communicate and link the business strategy to other levels of the organization.
      3. Confirm the strategy mapping with other relevant stakeholders.

      Guide to creating your map: Starting with strategic objectives, map the value streams that will ultimately drive them. Next, link the key capabilities that enable each value stream. Then map the data and data governance to initiatives that support those capabilities. This is one approach to help you prioritize the data initiatives that deliver the most value to the organization.

      Input

      • Strategic objectives as outlined by the organization’s business strategy and confirmed by senior leaders

      Output

      • A strategy map that maps your organizational strategic objectives to value streams, business capabilities, and, ultimately, to data program

      Materials

      Participants

      • Key business stakeholders
      • Data stewards
      • Data custodians
      • Data Governance Working Group

      Download Info-Tech’s Data Governance Planning and Roadmapping Workbook

      Example of a strategy map tied to data governance

      • Strategic objectives are the outcomes that the organization is looking to achieve.
      • Value streams enable an organization to create and capture value in the market through interconnected activities that support strategic objectives.
      • Business capabilities define what a business does to enable value creation in value streams.
      • Data capabilities and initiatives are descriptions of action items on the data and data governance roadmap and which will enable one or multiple business capabilities in its desired target state.

      Info-Tech Tip:

      Start with the strategic objectives, then map the value streams that will ultimately drive them. Next, link the key capabilities that enable each value stream. Then map the data and data governance initiatives that support those capabilities. This process will help you prioritize the data initiatives that deliver the most value to the organization.

      Example: Retail

      Example of a strategy map tied to data governance for retail

      For this strategy map, download Info-Tech’s Industry Reference Architecture for Retail.

      Step 1.2

      Build High-Value Use Cases for Data Governance

      Activities

      1.2.1 Build High-Value Use Cases

      This step will guide you through the following activities:

      • Leveraging your categorized business capability map to conduct deep-dive sessions with key business stakeholders for creating high-value uses cases
      • Discussing current challenges, risks, and opportunities associated with the use of data across the lines of business
      • Exploring which other business capabilities, stakeholder groups, and business units will be impacted

      Outcomes of this step

      • Relevant use cases that articulate the data-related challenges, needs, or opportunities that are clear and contained and, if addressed ,will deliver value to the organization

      Info-Tech Tip

      One of the most important aspects when building use cases is to ensure you include KPIs or measures of success. You have to be able to demonstrate how the use case ties back to the organizational priorities or delivers measurable business value. Leverage the KPIs and success factors of the business capabilities tied to each particular use case.

      1.2.1 Build High-Value Use Cases

      This business needs-gathering activity will highlight and create relevant use cases around data-related problems or opportunities that are clear and contained and, if addressed, will deliver value to the organization.

      1. Bring together key business stakeholders (data owner, stewards, SMEs) from a particular line of business as well as the relevant data custodian(s) to build cases for their units. Leverage the business capability map you created for facilitating this act.
      2. Leverage Info-Tech’s framework for data requirements and methodology for creating use cases, as outlined in the Data Use Case Framework Template and seen on the next slide.
      3. Have the stakeholders move through each breakout session outlined in the Use Case Worksheet. Use flip charts or a whiteboard to brainstorm and document their thoughts.
      4. Debrief and document results in the Data Use Case Framework Template
      5. Repeat this exercise with as many lines of the business as possible, leveraging your business capability map to guide your progress and align with business value.

      Tip: Don’t conclude these use case discussions without substantiating what measures of success will be used to demonstrate the business value of the effort to produce the desired future state, as relevant to each particular use case.

      Input

      • Value streams and business capabilities as defined by business leaders
      • Business stakeholders’ subject area expertise
      • Data custodian systems, integration, and data knowledge

      Output

      • Use cases that articulate data-related challenges, needs or opportunities that are tied to defined business capabilities and hence if addressed will deliver measurable value to the organization.

      Materials

      • Your business capability map from activity 1.1.1
      • Info-Tech’s Data Use Case Framework Template
      • Whiteboard or flip charts (or shared screen if working remotely)
      • Markers/pens

      Participants

      • Key business stakeholders
      • Data stewards and business SMEs
      • Data custodians
      • Data Governance Working Group

      Download Info-Tech’s Data Use Case Framework Template

      Info-Tech’s Framework for Building Use Cases

      Objective: This business needs-gathering activity will highlight and create relevant use cases around data-related problems or opportunities that are clear and contained and, if addressed, will deliver value to the organization.

      Leveraging your business capability map, build use cases that align with the organization’s key business capabilities.

      Consider:

      • Is the business capability a cost advantage creator or an industry differentiator?
      • Is the business capability currently underserved by data?
      • Does this need to be addressed? If so, is this risk- or value-driven?

      Info-Tech’s Data Requirements and Mapping Methodology for Creating Use Cases

      1. What business capability (or capabilities) is this use case tied to for your business area(s)?
      2. What are your data-related challenges in performing this today?
      3. What are the steps in this process/activity today?
      4. What are the applications/systems used at each step today?
      5. What data domains are involved, created, used, and/or transformed at each step today?
      6. What does an ideal or improved state look like?
      7. What other business units, business capabilities, activities, and/or processes will be impacted or improved if this issue was solved?
      8. Who are the stakeholders impacted by these changes? Who needs to be consulted?
      9. What are the risks to the organization (business capability, revenue, reputation, customer loyalty, etc.) if this is not addressed?
      10. What compliance, regulatory, and/or policy concerns do we need to consider in any solution?
      11. What measures of success or change should we use to prove the value of the effort (such as KPIs, ROI)? What is the measurable business value of doing this?

      The resulting use cases are to be prioritized and leveraged for informing the business case and the data governance capabilities optimization plan.

      Taken from Info-Tech’s Data Use Case Framework Template

      Phase 2

      Understand Your Current Data Governance Capabilities

      Three circles are in the image that list the three phases and the main steps. Phase 2 is highlighted.

      This phase will guide you through the following activities:

      • Understand the Key Components of Data Governance
      • Gauge Your Organization’s Current Data Culture

      This phase involves the following participants:

      • Data Leadership
      • Data Ownership & Stewardship
      • Policies & Procedures
      • Data Literacy & Culture
      • Operating Model
      • Data Management
      • Data Privacy & Security
      • Enterprise Projects & Services

      Step 2.1

      Understand the Key Components of Data Governance

      This step will guide you through the following activities:

      • Understanding the core components of an effective data governance program and determining your organization’s current capabilities in these areas:
        • Data Leadership
        • Data Ownership & Stewardship
        • Policies & Procedures
        • Data Literacy & Culture
        • Operating Model
        • Data Management
        • Data Privacy & Security
        • Enterprise Projects & Services

      Outcomes of this step

      • An understanding the core components of an effective data governance program
      • An understanding your organization’s current data governance capabilities

      Review: Info-Tech’s Data Governance Framework

      An image of Info-Tech's Data Governance Framework

      Key components of data governance

      A well-defined data governance program will deliver:

      • Defined accountability and responsibility for data.
      • Improved knowledge and common understanding of the organization’s data assets.
      • Elevated trust and confidence in traceable data.
      • Improved data ROI and reduced data debt.
      • An enabling framework for supporting the ethical use and handling of data.
      • A foundation for building and fostering a data-driven and data-literate organizational culture.

      The key components of establishing sustainable enterprise data governance, taken from Info-Tech’s Data Governance Framework:

      • Data Leadership
      • Data Ownership & Stewardship
      • Operating Model
      • Policies & Procedures
      • Data Literacy & Culture
      • Data Management
      • Data Privacy & Security
      • Enterprise Projects & Services

      Data Leadership

      • Data governance needs a dedicated head or leader to steer the organization’s data governance program.
      • For organizations that do have a chief data officer (CDO), their office is the ideal and effective home for data governance.
      • Heads of data governance also have titles such as director of data governance, director of data quality, and director of analytics.
      • The head of your data governance program works with all stakeholders and partners to ensure there is continuous enterprise governance alignment and oversight and to drive the program’s direction.
      • While key stakeholders from the business and IT will play vital data governance roles, the head of data governance steers the various components, stakeholders, and initiatives, and provides oversight of the overall program.
      • Vital data governance roles include: data owners, data stewards, data custodians, data governance steering committee (or your organization’s equivalent), and any data governance working group(s).

      The role of the CDO: the voice of data

      The office of the chief data officer (CDO):

      • Has a cross-organizational vision and strategy for data.
      • Owns and drives the data strategy; ensures it supports the overall organizational strategic direction and business goals.
      • Leads the organizational data initiatives, including data governance
      • Is accountable for the policy, strategy, data standards, and data literacy necessary for the organization to operate effectively.
      • Educates users and leaders about what it means to be “data-driven.”
      • Builds and fosters a culture of data excellence.

      “Compared to most of their C-suite colleagues, the CDO is faced with a unique set of problems. The role is still being defined. The chief data officer is bringing a new dimension and focus to the organization: ‘data.’ ”

      – Carruthers and Jackson, 2020

      Who does the CDO report to?

      Example reporting structure.
      • The CDO should be a true C- level executive.
      • Where the organization places the CDO role in the structure sends an important signal to the business about how much it values data.

      “The title matters. In my opinion, you can’t have a CDO without executive authority. Otherwise no one will listen.”

      – Anonymous European CDO

      “The reporting structure depends on who’s the ‘glue’ that ties together all these uniquely skilled individuals.”

      – John Kemp, Senior Director, Executive Services, Info-Tech Research Group

      Data Ownership & Stewardship

      Who are best suited to be data owners?

      • Wherever they may sit in your organization, data owners will typically have the highest stake in that data.
      • Data owners need to be suitably senior and have the necessary decision-making power.
      • They have the highest interest in the related business data domain, whether they are the head of a business unit or the head of a line of business that produces data or consumes data (or both).
      • If they are neither of these, it’s unlikely they will have the interest in the data (in terms of its quality, protection, ethical use, and handling, for instance) necessary to undertake and adopt the role effectively.

      Data owners are typically senior business leaders with the following characteristics:

      • Positioned to accept accountability for their data domain.
      • Hold authority and influence to affect change, including across business processes and systems, needed to improve data quality, use, handling, integration, etc.
      • Have access to a budget and resources for data initiatives such as resolving data quality issues, data cleansing initiatives, business data catalog build, related tools and technology, policy management, etc.
      • Hold the influence needed to drive change in behavior and culture.
      • Act as ambassadors of data and its value as an organizational strategic asset.

      Right-size your data governance organizational structure

      • Most organizations strive to identify roles and responsibilities at a strategic and operational level. Several factors will influence the structure of the program such as the focus of the data governance project as well as the maturity and size of the organization.
      • Your data governance structure has to work for your organization, and it has to evolve as the organization evolves.
      • Formulate your blend of data governance roles, committees, councils, and cross-functional groups, that make sense for your organization.
      • Your data governance organizational structure should not add complexity or bureaucracy to your organization’s data landscape; it should support and enable your principle of treating data as an asset.

      There is no one-size-fits-all data governance organizational structure.

      Example of a Data Governance Organizational Structure

      Critical roles and responsibilities for data governance

      Data Governance Working Groups

      Data governance working groups:

      • Are cross-functional teams
      • Deliver on data governance projects, initiatives, and ad hoc review committees.

      Data Stewards

      Traditionally, data stewards:

      • Serve on an operational level addressing issues related to adherence to standards/procedures, monitoring data quality, raising issues identified, etc.
      • Are responsible for managing access, quality, escalating issues, etc.

      Data Custodians

      • Traditionally, data custodians:
      • Serve on an operational level addressing issues related to data and database administration.
      • Support the management of access, data quality, escalating issues, etc.
      • Are SMEs from IT and database administration.

      Example: Business capabilities to data owner and data stewards mapping for a selected data domain

      Info-Tech Insight

      Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.

      Enabling business capabilities with data governance role definitions

      Example: Business capabilities to data owner and data stewards mapping for a selected data domain

      Operating Model

      Your operating model is the key to designing and operationalizing a form of data governance that delivers measurable business value to your organization.

      “Generate excitement for data: When people are excited and committed to the vision of data enablement, they’re more likely to help ensure that data is high quality and safe.” – Petzold, et al., 2020

      Operating Model

      Defining your data governance operating model will help create a well-oiled program that sustainably delivers value to the organization and manages risks while building and fostering a culture of data excellence along the way. Some organizations are able to establish a formal data governance office, whether independent or attached to the office of the chief data officer. Regardless of how you are organized, data governance requires a home, a leader, and an operating model to ensure its sustainability and evolution.

      Examples of focus areas for your operating model:

      • Delivery: While there are core tenets to every data governance program, there is a level of variability in the implementation of data governance programs across organizations, sectors, and industries. Every organization has its own particular drivers and mandates, so the level and rigor applied will also vary.
      • The key is to determine what style will work best in your organization, taking into consideration your organizational culture, executive leadership support (present and ongoing), catalysts such as other enterprise-wide transformative and modernization initiatives, and/or regulatory and compliances drivers.

      • Communication: Communication is vital across all levels and stakeholder groups. For instance, there needs to be communication from the data governance office up to senior leadership, as well as communication within the data governance organization, which is typically made up of the data governance steering committee, data governance council, executive sponsor/champion, data stewards, and data custodians and working groups.
      • Furthermore, communication with the wider organization of data producers, users, and consumers is one of the core elements of the overall data governance communications plan.

      Communication is vital for ensuring acceptance of new processes, rules, guidelines, and technologies by all data producers and users as well as for sharing success stories of the program.

      Operating Model

      Tie the value of data governance and its initiatives back to the business capabilities that are enabled.

      “Leading organizations invest in change management to build data supporters and convert the skeptics. This can be the most difficult part of the program, as it requires motivating employees to use data and encouraging producers to share it (and ideally improve its quality at the source)[.]” – Petzold, et al., 2020

      Operating Model

      Examples of focus areas for your operating model (continued):

      • Change management and issue resolution: Data governance initiatives will very likely bring about a level of organizational disruption, with governance recommendations and future state requiring potentially significant business change. This may include a redesign of a substantial number of data processes affecting various business units, which will require tweaking the organization’s culture, thought processes, and procedures surrounding its data.
      • Preparing people for change well in advance will allow them to take the steps necessary to adapt and reduce potential confrontation. By planning for and efficiently communicating any changes that a data governance initiative may bring, many initial issues can be resolved from the outset.

        Attempting to implement change without an effective communications plan can result in disagreements over data control and stalemates between stakeholder units. The recommendations of the governance group must reflect the needs of all stakeholders or there will be pushback.

      • Performance measuring, monitoring and reporting: Measuring and reporting on performance, successes, and realization of tangible business value are a must for sustaining, growing, and scaling your data governance program.
      • Aligning your data governance to the organization's value realization activities enables you to leverage the KPIs of those business capabilities to demonstrate tangible and measurable value. Use terms and language that will resonate with your senior business leadership.

      Info-Tech Tip:

      Launching a data governance program will bring with it a level of disruption to the culture of the organization. That disruption doesn’t have to be detrimental if you are prepared to manage the change proactively and effectively.

      Policies, Procedures & Standards

      “Data standards are the rules by which data are described and recorded. In order to share, exchange, and understand data, we must standardize the format as well as the meaning.” – U.S. Geological Survey

      Policies, Procedures & Standards

      • When defining, updating, or refreshing your data policies, procedures, and standards, ensure they are relevant, serve a purpose, and/or support the use of data in the organization.
      • Avoid the common pitfall of building out a host of policies, procedures, and standards that are never used or followed by users and therefore don’t bring value or serve to mitigate risk for the organization.
      • Data policies can be thought of as formal statements and are typically created, approved, and updated by the organization’s data decision-making body (such as a data governance steering committee).
      • Data standards and procedures function as actions, or rules, that support the policies and their statements.
      • Standards and procedures are designed to standardize the processes during the overall data lifecycle. Procedures are instructions to achieve the objectives of the policies. The procedures are iterative and will be updated with approval from your data governance committee as needed.
      • Your organization’s data policies, standards, and procedures should not bog down or inhibit users; rather, they should enable confident data use and handling across the overall data lifecycle. They should support more effective and seamless data capture, integration, aggregation, sharing, and retention of data in the organization.

      Examples of data policies:

      • Data Classification Policy
      • Data Retention Policy
      • Data Entry Policy
      • Data Backup Policy
      • Data Provenance Policy
      • Data Management Policy

      Data Domain Documentation

      Select the correct granularity for your business need

      Diagram of data domain documentation
      Sources: Dataversity; Atlan; Analytics8

      Data Domain Documentation Examples

      Data Domain Documentation Examples

      Data Culture

      “Organizational culture can accelerate the application of analytics, amplify its power, and steer companies away from risky outcomes.” – Petzold, et al., 2020

      A healthy data culture is key to amplifying the power of your data and to building and sustaining an effective data governance program.

      What does a healthy data culture look like?

      • Everybody knows the data.
      • Everybody trusts the data.
      • Everybody talks about the data.

      Building a culture of data excellence.

      Leverage Info-Tech’s Data Culture Diagnostic to understand your organization’s culture around data.

      Screenshot of Data Culture Scorecard

      Contact your Info-Tech Account Representative for more information on the Data Culture Diagnostic

      Cultivating a data-driven culture is not easy

      “People are at the heart of every culture, and one of the biggest challenges to creating a data culture is bringing everyone into the fold.” – Lim, Alation

      It cannot be purchased or manufactured,

      It must be nurtured and developed,

      And it must evolve as the business, user, and data landscapes evolve.

      “Companies that have succeeded in their data-driven efforts understand that forging a data culture is a relentless pursuit, and magic bullets and bromides do not deliver results.” – Randy Bean, 2020

      Hallmarks of a data-driven culture

      There is a trusted, single source of data the whole company can draw from.

      There’s a business glossary and data catalog and users know what the data fields mean.

      Users have access to data and analytics tools. Employees can leverage data immediately to resolve a situation, perform an activity, or make a decision – including frontline workers.

      Data literacy, the ability to collect, manage, evaluate, and apply data in a critical manner, is high.

      Data is used for decision making. The company encourages decisions based on objective data and the intelligent application of it.

      A data-driven culture requires a number of elements:

      • High-quality data
      • Broad access and data literacy
      • Data-driven decision-making processes
      • Effective communication

      Data Literacy

      Data literacy is an essential part of a data-driven culture.

      • Building a data-driven culture takes an ongoing investment of time, effort, and money.
      • This investment will not realize its full return without building up the organization’s data literacy.
      • Data literacy is about filling data knowledge gaps across all levels of the organization.
      • It’s about ensuring all users – senior leadership right through to core users – are equipped with appropriate levels of training, skills, understanding, and awareness around the organization’s data and the use of associated tools and technologies. Data literacy ensures users have the data they need and they know how to interpret and leverage it.
      • Data literacy drives the appetite, demand, and consumption for data.
      • A data-literate culture is one where the users feel confident and skilled in their use of data, leveraging it for making informed or evidence-based decisions and generating insights for the organization.

      Data Management

      • Data governance serves as an enabler to all of the core components that make up data management:
        • Data quality management
        • Data architecture management
        • Data platform
        • Data integration
        • Data operations management
        • Data risk management
        • Reference and master data management (MDM)
        • Document and content management
        • Metadata management
        • Business intelligence (BI), reporting, analytics and advanced analytics, artificial intelligence (AI), machine learning (ML)
      • Key tools such as the business data glossary and data catalog are vital for operationalizing data governance and in supporting data management disciplines such as data quality management, metadata management, and MDM as well as BI, reporting, and analytics.

      Enterprise Projects & Services

      • Data governance serves as an enabler to enterprise projects and services that require, use, share, sell, and/or rely on data for their viability and, ultimately, their success.
      • Folding or embedding data governance into the organization’s project management function or project management office (PMO) serves to ensure that, for any initiative, suitable consideration is given to how data is treated.
      • This may include defining parameters, following standards and procedures around bringing in new sources of data, integrating that data into the organization’s data ecosystem, using and sharing that data, and retaining that data post-project completion.
      • The data governance function helps to identify and manage any ethical issues, whether at the start of the project and/or throughout.
      • It provides a foundation for asking relevant questions as it relates to the use or incorporation of data in delivering the specific project or service. Do we know where the data obtained from? Do we have rights to use that data? Are there legislations, policies, or regulations that guide or dictate how that data can be used? What are the positive effects, negative impacts, and/or risks associated with our intended use of that data? Are we positioned to mitigate those risks?
      • Mature data governance creates organizations where the above considerations around data management and the ethical use and handling of data is routinely implemented across the business and in the rollout and delivery of projects and services.

      Data Privacy & Security

      • Data governance supports the organization’s data privacy and security functions.
      • Key tools include the data classification policy and standards and defined roles around data ownership and data stewardship. These are vital for operationalizing data governance and supporting data privacy, security, and the ethical use and handling of data.
      • While some organizations may have a dedicated data security and privacy group, data governance provides an added level of oversight in this regard.
      • Some of the typical checks and balances include ensuring:
        • There are policies and procedures in place to restrict and monitor staff’s access to data (one common way this is done is according to job descriptions and responsibilities) and that these comply with relevant laws and regulations.
        • There’s a data classification scheme in place where data has been classified on a hierarchy of sensitivity (e.g. top secret, confidential, internal, limited, public).
        • The organization has a comprehensive data security framework, including administrative, physical, and technical procedures for addressing data security issues (e.g. password management and regular training).
        • Risk assessments are conducted, including an evaluation of risks and vulnerabilities related to intentional and unintentional misuse of data.
        • Policies and procedures are in place to mitigate the risks associated with incidents such as data breaches.
        • The organization regularly audits and monitors its data security.

      Ethical Use & Handling of Data

      Data governance will support your organization’s ethical use and handling of data by facilitating definition around important factors, such as:

      • What are the various data assets in the organization and what purpose(s) can they be used for? Are there any limitations?
      • Who is the related data owner? Who holds accountability for that data? Who will be answerable?
      • Where was the data obtained from? What is the intended use of that data? Do you have rights to use that data? Are there legislations, policies, or regulations that guide or dictate how that data can be used?
      • What are the positive effects, negative impacts, and/or risks associated with the use of that data?

      Ethical Use & Handling of Data

      • Data governance serves as an enabler to the ethical use and handling of an organization’s data.
      • The Open Data Institute (ODI) defines data ethics as: “A branch of ethics that evaluates data practices with the potential to adversely impact on people and society – in data collection, sharing and use.”
      • Data ethics relates to good practice around how data is collected, used and shared. It’s especially relevant when data activities have the potential to impact people and society, whether directly or indirectly (Open Data Institute, 2019).
      • A failure to handle and use data ethically can negatively impact an organization’s direct stakeholders and/or the public at large, lead to a loss of trust and confidence in the organization's products and services, lead to financial loss, and impact the organization’s brand, reputation, and legal standing.
      • Data governance plays a vital role in building and managing your data assets, knowing what data you have, and knowing the limitations of that data. Data ownership, data stewardship, and your data governance decision-making body are key tenets and foundational components of your data governance. They enable an organization to define, categorize, and confidently make decisions about its data.

      Step 2.2

      Gauge Your Organization’s Current Data Culture

      Activities

      2.2.1 Gauge Your Organization’s Current Data Culture

      This step will guide you through the following activities:

      • Conduct a data culture survey or leverage Info-Tech’s Data Culture Diagnostic to increase your understanding of your organization’s data culture

      Outcomes of this step

      • An understanding of your organizational data culture

      2.2.1 Gauge Your Organization’s Current Data Culture

      Conduct a Data Culture Survey or Diagnostic

      The objectives of conducting a data culture survey are to increase the understanding of the organization's data culture, your users’ appetite for data, and their appreciation for data in terms of governance, quality, accessibility, ownership, and stewardship. To perform a data culture survey:

      1. Identify members of the data user base, data consumers, and other key stakeholders for surveying.
      2. Conduct an information session to introduce Info-Tech’s Data Culture Diagnostic survey. Explain the objective and importance of the survey and its role in helping to understand the organization’s current data culture and inform the improvement of that culture.
      3. Roll out the Info-Tech Data Culture Diagnostic survey to the identified users and stakeholders.
      4. Debrief and document the results and scorecard in the Data Strategy Stakeholder Interview Guide and Findings document.

      Input

      • Email addresses of participants in your organization who should receive the survey

      Output

      • Your organization’s Data Culture Scorecard for understanding current data culture as it relates to the use and consumption of data
      • An understanding of whether data is currently perceived to be an asset to the organization

      Materials

      Screenshot of Data Culture Scorecard

      Participants

      • Participants include those at the senior leadership level through to middle management, as well as other business stakeholders at varying levels across the organization
      • Data owners, stewards, and custodians
      • Core data users and consumers

      Contact your Info-Tech Account Representative for details on launching a Data Culture Diagnostic.

      Phase 3

      Build a Target State Roadmap and Plan

      Three circles are in the image that list the three phases and the main steps. Phase 3 is highlighted.

      “Achieving data success is a journey, not a sprint.” Companies that set a clear course, with reasonable expectations and phased results over a period of time, get to the destination faster.” – Randy Bean, 2020

      This phase will guide you through the following activities:

      • Build your Data Governance Roadmap
      • Develop a target state plan comprising of prioritized initiatives

      This phase involves the following participants:

      • Data Governance Leadership
      • Data Owners/Data Stewards
      • Data Custodians
      • Data Governance Working Group(s)

      Step 3.1

      Formulate an Actionable Roadmap and Right-Sized Plan

      This step will guide you through the following activities:

      • Build your data governance roadmap
      • Develop a target state plan comprising of prioritized initiatives

      Outcomes of this step

      • A foundation for data governance initiative planning that’s aligned with the organization’s business architecture: value streams, business capability map, and strategy map

      Build a right-sized roadmap

      Formulate an actionable roadmap that is right sized to deliver value in your organization.

      Key considerations:

      • When building your data governance roadmap, ensure you do so through an enterprise lens. Be cognizant of other initiatives that might be coming down the pipeline that may require you to align your data governance milestones accordingly.
      • Apart from doing your planning with consideration for other big projects or launches that might be in-flight and require the time and attention of your data governance partners, also be mindful of the more routine yet still demanding initiatives.
      • When doing your roadmapping, consider factors like the organization’s fiscal cycle, typical or potential year-end demands, and monthly/quarterly reporting periods and audits. Initiatives such as these are likely to monopolize the time and focus of personnel key to delivering on your data governance milestones.

      Sample milestones:

      Data Governance Leadership & Org Structure Definition

      Define the home for data governance and other key roles around ownership and stewardship, as approved by senior leadership.

      Data Governance Charter and Policies

      Create a charter for your program and build/refresh associated policies.

      Data Culture Diagnostic

      Understand the organization’s current data culture, perception of data, value of data, and knowledge gaps.

      Use Case Build and Prioritization

      Build a use case that is tied to business capabilities. Prioritize accordingly.

      Business Data Glossary/Catalog

      Build and/or refresh the business’ glossary for addressing data definitions and standardization issues.

      Tools & Technology

      Explore the tools and technology offering in the data governance space that would serve as an enabler to the program. (e.g. RFI, RFP).

      Recall: Info-Tech’s Data Governance Framework

      An image of Info-Tech's Data Governance Framework

      Build an actionable roadmap

      Data Governance Leadership & Org Structure Division

      Define key roles for getting started.

      Use Case Build & Prioritization

      Start small and then scale – deliver early wins.

      Literacy Program

      Start understanding data knowledge gaps, building the program, and delivering.

      Tools & Technology

      Make the available data governance tools and technology work for you.

      Key components of your data governance roadmap

      By now, you have assessed current data governance environment and capabilities. Use this assessment, coupled with the driving needs of your business, to plot your data Governance roadmap accordingly.

      Sample data governance roadmap milestones:

      • Define data governance leadership.
      • Define and formalize data ownership and stewardship (as well as the role IT/data management will play as data custodians).
      • Build/confirm your business capability map and data domains.
      • Build business data use cases specific to business capabilities.
      • Define business measures/KPIs for the data governance program (i.e. metrics by use case that are relevant to business capabilities).
      • Data management:
        • Build your data glossary or catalog starting with identified and prioritized terms.
        • Define data domains.
      • Design and define the data governance operating model (oversight model definition, communication plan, internal marketing such as townhalls, formulate change management plan, RFP of data governance tool and technology options for supporting data governance and its administration).
      • Data policies and procedures:
        • Formulate, update, refresh, consolidate, rationalize, and/or retire data policies and procedures.
        • Define policy management and administration framework (i.e. roll-out, maintenance, updates, adherence, system to be used).
      • Conduct Info-Tech’s Data Culture Diagnostic or survey (across all levels of the organization).
      • Define and formalize the data literacy program (build modules, incorporate into LMS, plan lunch and learn sessions).
      • Data privacy and security: build data classification policy, define classification standards.
      • Enterprise projects and services: embed data governance in the organization’s PMO, conduct “Data Governance 101” for the PMO.

      Defining data governance roles and organizational structure at Organization

      The approach employed for defining the data governance roles and supporting organizational structure for .

      Key Considerations:

      • The data owner and data steward roles are formally defined and documented within the organization. Their involvement is clear, well-defined, and repeatable.
      • There are data owners and data stewards for each data domain within the organization. The data steward role is given to someone with a high degree of subject matter expertise.
      • Data owners and data stewards are effective in their roles by ensuring that their data domain is clean and free of errors and that they protect the organization against data loss.
      • Data owners and data stewards have the authority to make final decisions on data definitions, formats, and standard processes that apply to their respective data sets. Data owners and data stewards have authority regarding who has access to certain data.
      • Data owners and data stewards are not from the IT side of the organization. They understand the lifecycle of the data (how it is created, curated, retrieved, used, archived, and destroyed) and they are well-versed in any compliance requirements as it relates to their data.
      • The data custodian role is formally defined and is given to the relevant IT expert. This is an individual with technical administrative and/or operational responsibility over data (e.g. a DBA).
      • A data governance steering committee exists and is comprised of well-defined roles, responsibilities, executive sponsors, business representatives, and IT experts.
      • The data governance steering committee works to provide oversight and enforce policies, procedures, and standards for governing data.
      • The data governance working group has cross-functional representation. This comprises business and IT representation, as well as project management and change management where applicable: data stewards, data custodians, business subject matter experts, PM, etc.).
      • Data governance meetings are coordinated and communicated about. The meeting agenda is always clear and concise, and meetings review pressing data-related issues. Meeting minutes are consistently documented and communicated.

      Sample: Business capabilities to data owner and data stewards mapping for a selected data domain

      Info-Tech Insight

      Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.

      Enable business capabilities with data governance role definitions.

      Sample: Business capabilities to data owner and data stewards mapping for a selected data domain

      Consider your technology options:

      Make the available data governance tools and technology work for you:

      • Data catalog
      • Business data glossary
      • Data lineage
      • Metadata management

      Logos of data governance tools and technology.

      These are some of the data governance tools and technology players. Check out SoftwareReviews for help making better software decisions.

      Make the data steward the catalyst for organizational change and driving data culture

      The data steward must be empowered and backed politically with decision-making authority, or the role becomes stale and powerless.

      Ensuring compliance can be difficult. Data stewards may experience pushback from stakeholders who must deliver on the policies, procedures, and processes that the data steward enforces.

      Because the data steward must enforce data processes and liaise with so many different people and departments within the organization, the data steward role should be their primary full-time job function – where possible.

      However, in circumstances where budget doesn’t allow a full-time data steward role, develop these skills within the organization by adding data steward responsibilities to individuals who are already managing data sets for their department or line of business.

      Info-Tech Tip

      A stewardship role is generally more about managing the cultural change that data governance brings. This requires the steward to have exceptional interpersonal skills that will assist in building relationships across departmental boundaries and ensuring that all stakeholders within the organization believe in the initiative, understand the anticipated outcomes, and take some level of responsibility for its success.

      Changes to organizational data processes are inevitable; have a communication plan in place to manage change

      Create awareness of your data governance program. Use knowledge transfer to get as many people on board as possible.

      Data governance initiatives must contain a strong organizational disruption component. A clear and concise communication strategy that conveys milestones and success stories will address the various concerns that business unit stakeholders may have.

      By planning for and efficiently communicating any changes that a data governance initiative may bring, many initial issues can be resolved from the outset.

      Governance recommendations will require significant business change. The redesign of a substantial number of data processes affecting various business units will require an overhaul of the organization’s culture, thought processes, and procedures surrounding its data. Preparing people for change well in advance will allow them to take the necessary steps to adapt and reduce potential confrontation.

      Because a data governance initiative will involve data-driven business units across the organization, the governance team must present a compelling case for data governance to ensure acceptance of new processes, rules, guidelines, and technologies by all data producers and users.

      Attempting to implement change without an effective communication plan can result in disagreements over data control and stalemates between stakeholder units. The recommendations of the governance group must reflect the needs of all stakeholders or there will be pushback.

      Info-Tech Insight

      Launching a data governance initiative is guaranteed to disrupt the culture of the organization. That disruption doesn’t have to be detrimental if you are prepared to manage the change proactively and effectively.

      Create a common data governance vision that is consistently communicated to the organization

      A data governance program should be an enterprise-wide initiative.

      To create a strong vision for data governance, there must be participation from the business and IT. A common vision will articulate the state the organization wishes to achieve and how it will reach that state. Visioning helps to develop long-term goals and direction.

      Once the vision is established, it must be effectively communicated to everyone, especially those who are involved in creating, managing, disposing, or archiving data.

      The data governance program should be periodically refined. This will ensure the organization continues to incorporate best methods and practices as the organization grows and data needs evolve.

      Info-Tech Tips

      • Use information from the stakeholder interviews to derive business goals and objectives.
      • Work to integrate different opinions and perspectives into the overall vision for data governance.
      • Brainstorm guiding principles for data and understand the overall value to the organization.

      Develop a compelling data governance communications plan to get all departmental lines of business on board

      A data governance program will impact all data-driven business units within the organization.

      A successful data governance communications plan involves making the initiative visible and promoting staff awareness. Educate the team on how data is collected, distributed, and used, what internal processes use data, and how that data is used across departmental boundaries.

      By demonstrating how data governance will affect staff directly, you create a deeper level of understanding across lines of business, and ultimately, a higher level of acceptance for new processes, rules, and guidelines.

      A clear and concise communications strategy will raise the profile of data governance within the organization, and staff will understand how the program will benefit them and how they can share in the success of the initiative. This will end up providing support for the initiative across the board.

      A proactive communications plan will:

      • Assist in overcoming issues with data control, stalemates between stakeholder units, and staff resistance.
      • Provide a formalized process for implementing new policies, rules, guidelines, and technologies, and managing organizational data.
      • Detail data ownership and accountability for decision making, and identify and resolve data issues throughout the organization.
      • Encourage acceptance and support of the initiative.

      Info-Tech Tip

      Focus on literacy and communication: include training in the communication plan. Providing training for data users on the correct procedures for updating and verifying the accuracy of data, data quality, and standardized data policies will help validate how data governance will benefit them and the organization.

      Leverage the data governance program to communicate and promote the value of data within the organization

      The data governance program is responsible for continuously promoting the value of data to the organization. The data governance program should seek a variety of ways to educate the organization and data stakeholders on the benefit of data management.

      Even if data policies and procedures are created, they will be highly ineffective if they are not properly communicated to the data producers and users alike.

      There needs to be a communication plan that highlights how the data producer and user will be affected, what their new responsibilities are, and the value of that change.

      To learn how to manage organizational change, refer to Info-Tech’s Master Organizational Change Management Practices.

      Understand what makes for an effective policy for data governance

      It can be difficult to understand what a policy is, and what it is not. Start by identifying the differences between a policy and standards, guidelines, and procedures.

      Diagram of an effective policy for data governance

      The following are key elements of a good policy:

      Heading Descriptions
      Purpose Describes the factors or circumstances that mandate the existence of the policy. Also states the policy’s basic objectives and what the policy is meant to achieve.
      Scope Defines to whom and to what systems this policy applies. Lists the employees required to comply or simply indicates “all” if all must comply. Also indicates any exclusions or exceptions, i.e. those people, elements, or situations that are not covered by this policy or where special consideration may be made.
      Definitions Define any key terms, acronyms, or concepts that will be used in the policy. A standard glossary approach is sufficient.
      Policy Statements Describe the rules that comprise the policy. This typically takes the form of a series of short prescriptive and proscriptive statements. Sub-dividing this section into sub-sections may be required depending on the length or complexity of the policy.
      Non-Compliance Clearly describe consequences (legal and/or disciplinary) for employee non-compliance with the policy. It may be pertinent to describe the escalation process for repeated non-compliance.
      Agreement Confirms understanding of the policy and provides a designated space to attest to the document.

      Leverage myPolicies, Info-Tech’s web-based application for managing your policies and procedures

      Most organizations have problems with policy management. These include:

      1. Policies are absent or out of date
      2. Employees largely unaware of policies in effect
      3. Policies are unmonitored and unenforced
      4. Policies are in multiple locations
      5. Multiple versions of the same policy exist
      6. Policies managed inconsistently across different silos
      7. Policies are written poorly by untrained authors
      8. Inadequate policy training program
      9. Draft policies stall and lose momentum
      10. Weak policy support from senior management

      Technology should be used as a means to solve these problems and effectively monitor, enforce, and communicate policies.

      Product Overview

      myPolicies is a web-based solution to create, distribute, and manage corporate policies, procedures, and forms. Our solution provides policy managers with the tools they need to mitigate the risk of sanctions and reduce the administrative burden of policy management. It also enables employees to find the documents relevant to them and build a culture of compliance.

      Some key success factors for policy management include:

      • Store policies in a central location that is well known and easy to find and access. A key way that technology can help communicate policies is by having them published on a centralized website.
      • Link this repository to other policies’ taxonomies of your organization. E.g. HR policies to provide a single interface for employees to access guidance across the organization.
      • Reassess policies annually at a minimum. myPolicies can remind you to update the organization’s policies at the appropriate time.
      • Make the repository searchable and easily navigable.
      • myPolicies helps you do all this and more.
      myPolicies logo myPolicies

      Enforce data policies to promote consistency of business processes

      Data policies are short statements that seek to manage the creation, acquisition, integrity, security, compliance, and quality of data. These policies vary amongst organizations, depending on your specific data needs.

      • Policies describe what to do, while standards and procedures describe how to do something.
      • There should be few data policies, and they should be brief and direct. Policies are living documents and should be continuously updated to respond to the organization’s data needs.
      • The data policies should highlight who is responsible for the data under various scenarios and rules around how to manage it effectively.

      Examples of Data Policies

      Trust

      • Data Cleansing and Quality Policy
      • Data Entry Policy

      Availability

      • Acceptable Use Policy
      • Data Backup Policy

      Security

      • Data Security Policy
      • Password Policy Template
      • User Authorization, Identification, and Authentication Policy Template
      • Data Protection Policy

      Compliance

      • Archiving Policy
      • Data Classification Policy
      • Data Retention Policy

      Leverage data management-related policies to standardize your data management practices

      Info-Tech’s Data Management Policy:

      This policy establishes uniform data management standards and identifies the shared responsibilities for assuring the integrity of the data and that it efficiently and effectively serves the needs of the organization. This policy applies to all critical data and to all staff who may be creators and/or users of such data.

      Info-Tech’s Data Entry Policy:

      The integrity and quality of data and evidence used to inform decision making is central to both the short-term and long-term health of an organization. It is essential that required data be sourced appropriately and entered into databases and applications in an accurate and complete manner to ensure the reliability and validity of the data and decisions made based on the data.

      Info-Tech’s Data Provenance Policy:

      Create policies to keep your data's value, such as:

      • Only allow entry of data from reliable sources.
      • Employees entering and accessing data must observe requirements for capturing/maintaining provenance metadata.
      • Provenance metadata will be used to track the lifecycle of data from creation through to disposal.

      Info-Tech’s Data Integration and Virtualization Policy:

      This policy aims to assure the organization, staff, and other interested parties that data integration, replication, and virtualization risks are taken seriously. Staff must use the policy (and supporting guidelines) when deciding whether to integrate, replicate, or virtualize data sets.

      Select the right mix of metrics to successfully supervise data policies and processes

      Policies are only as good as your level of compliance. Ensure supervision controls exist to oversee adherence to policies and procedures.

      Although they can be highly subjective, metrics are extremely important to data governance success.

      • Establishing metrics that measure the performance of a specific process or data set will:
        • Create a greater degree of ownership from data stewards and data owners.
        • Help identify underperforming individuals.
        • Allow the steering committee to easily communicate tailored objectives to individual data stewards and owners.
      • Be cautious when establishing metrics. The wrong metrics can have negative repercussions.
        • They will likely draw attention to an aspect of the process that doesn’t align with the initial strategy.
        • Employees will work hard and grow frustrated as their successes aren’t accurately captured.

      Policies are great to have from a legal perspective, but unless they are followed, they will not benefit the organization.

      • One of the most useful metrics for policies is currency. This tracks how up to date the policy is and how often employees are informed about the policy. Often, a policy will be introduced and then ignored. Policies must be continuously reviewed by management and employees.
      • Some other metrics include adherence (including performance in tests for adherence) and impacts from non-adherence.

      Review metrics on an ongoing basis with those data owners/stewards who are accountable, the data governance steering committee, and the executive sponsors.

      Establish data standards and procedures for use across all organizational lines of business

      A data governance program will impact all data-driven business units within the organization.

      • Data management procedures are the methods, techniques, and steps to accomplish a specific data objective. Creating standard data definitions should be one of the first tasks for a data governance steering committee.
      • Data moves across all departmental boundaries and lines of business within the organization. These definitions must be developed as a common set of standards that can be accepted and used enterprise wide.
      • Consistent data standards and definitions will improve data flow across departmental boundaries and between lines of business.
      • Ensure these standards and definitions are used uniformly throughout the organization to maintain reliable and useful data.

      Data standards and procedural guidelines will vary from company to company.

      Examples include:

      • Data modeling and architecture standards.
      • Metadata integration and usage procedures.
      • Data security standards and procedures.
      • Business intelligence standards and procedures.

      Info-Tech Tip

      Have a fundamental data definition model for the entire business to adhere to. Those in the positions that generate and produce data must follow the common set of standards developed by the steering committee and be accountable for the creation of valid, clean data.

      Changes to organizational data processes are inevitable; have a communications plan in place to manage change

      Create awareness of your data governance program, using knowledge transfer to get as many people on board as possible.

      By planning for and efficiently communicating any changes that a data governance initiative may bring, many initial issues can be resolved from the outset.

      Governance recommendations will require significant business change. The redesign of a substantial number of data processes affecting various business units will require an overhaul of the organization’s culture, thought processes, and procedures surrounding its data. Preparing people for change well in advance will allow them to take the necessary steps to adapt and reduce potential confrontation.

      Because a data governance initiative will involve data-driven business units across the organization, the governance team must present a compelling case for data governance to ensure acceptance of new processes, rules, guidelines, and technologies by all data producers and users.

      Attempting to implement change without an effective communications plan can result in disagreements over data control and stalemates between stakeholder units. The recommendations of the governance group must reflect the needs of all stakeholders or there will be pushback.

      Data governance initiatives will very likely bring about a level of organizational disruption. A clear and concise communications strategy that conveys milestones and success stories will address the various concerns that business unit stakeholders may have.

      Info-Tech Tip

      Launching a data governance program will bring with it a level of disruption to the culture of the organization. That disruption doesn’t have to be detrimental if you are prepared to manage the change proactively and effectively.

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

      Picture of analyst

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team. Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      Screenshot of example data governance strategy map.

      Build Your Business and User Context

      Work with your core team of stakeholders to build out your data governance strategy map, aligning data governance initiatives with business capabilities, value streams, and, ultimately, your strategic priorities.

      Screenshot of Data governance roadmap

      Formulate a Plan to Get to Your Target State

      Develop a data governance future state roadmap and plan based on an understanding of your current data governance capabilities, your operating environment, and the driving needs of your business.

      Related Info-Tech Research

      Build a Robust and Comprehensive Data Strategy

      Key to building and fostering a data-driven culture.

      Create a Data Management Roadmap

      Streamline your data management program with our simplified framework.

      The First 100 Days as CDO

      Be the voice of data in a time of transformation.

      Research Contributors

      Name Position Company
      David N. Weber Executive Director - Planning, Research and Effectiveness Palm Beach State College
      Izabela Edmunds Information Architect Mott MacDonald
      Andy Neill Practice Lead, Data & Analytics Info-Tech Research Group
      Dirk Coetsee Research Director, Data & Analytics Info-Tech Research Group
      Graham Price Executive Advisor, Advisory Executive Services Info-Tech Research Group
      Igor Ikonnikov Research Director, Data & Analytics Info-Tech Research Group
      Jean Bujold Senior Workshop Delivery Director Info-Tech Research Group
      Rajesh Parab Research Director, Data & Analytics Info-Tech Research Group
      Reddy Doddipalli Senior Workshop Director Info-Tech Research Group
      Valence Howden Principal Research Director, CIO Info-Tech Research Group

      Bibliography

      Alation. “The Alation State of Data Culture Report – Q3 2020.” Alation, 2020. Accessed 25 June 2021.

      Allott, Joseph, et al. “Data: The next wave in forestry productivity.” McKinsey & Company, 27 Oct. 2020. Accessed 25 June 2021.

      Bean, Randy. “Why Culture Is the Greatest Barrier to Data Success.” MIT Sloan Management Review, 30 Sept. 2020. Accessed 25 June 2021.

      Brence, Thomas. “Overcoming the Operationalization Challenge with Data Governance at New York Life.” Informatica, 18 March 2020. Accessed 25 June 2021.

      Bullmore, Simon, and Stuart Coleman. “ODI Inside Business – a checklist for leaders.” Open Data Institute, 19 Oct. 2020. Accessed 25 June 2021.

      Canadian Institute for Health Information. “Developing and implementing accurate national standards for Canadian health care information.” Canadian Institute for Health Information. Accessed 25 June 2021.

      Carruthers, Caroline, and Peter Jackson. “The Secret Ingredients of the Successful CDO.” IRM UK Connects, 23 Feb. 2017.

      Dashboards. “Useful KPIs for Healthy Hospital Quality Management.” Dashboards. Accessed 25 June 2021.

      Dashboards. “Why (and How) You Should Improve Data Literacy in Your Organization Today.” Dashboards. Accessed 25 June 2021.

      Datapine. “Healthcare Key Performance Indicators and Metrics.” Datapine. Accessed 25 June 2021.

      Datapine. “KPI Examples & Templates: Measure what matters the most and really impacts your success.” Datapine. Accessed 25 June 2021.

      Diaz, Alejandro, et al. “Why data culture matters.” McKinsey Quarterly, Sept. 2018. Accessed 25 June 2021.

      Everett, Dan. “Chief Data Officer (CDO): One Job, Four Roles.” Informatica, 9 Sept. 2020. Accessed 25 June 2021.

      Experian. “10 signs you are sitting on a pile of data debt.” Experian. Accessed 25 June 2021.

      Fregoni, Silvia. “New Research Reveals Why Some Business Leaders Still Ignore the Data.” Silicon Angle, 1 Oct. 2020.

      Informatica. Holistic Data Governance: A Framework for Competitive Advantage. Informatica, 2017. Accessed 25 June 2021.

      Knight, Michelle. “What Is a Data Catalog?” Dataversity, 28 Dec. 2017. Web.

      Lim, Jason. “Alation 2020.3: Getting Business Users in the Game.” Alation, 2020. Accessed 25 June 2021.

      McDonagh, Mariann. “Automating Data Governance.” Erwin, 29 Oct. 2020. Accessed 25 June 2021.

      NewVantage Partners. Data-Driven Business Transformation: Connecting Data/AI Investment to Business Outcomes. NewVantage Partners, 2020. Accessed 25 June 2021.

      Olavsrud, Thor. “What is data governance? A best practices framework for managing data assets.” CIO.com, 18 March 2021. Accessed 25 June 2021.

      Open Data Institute. “Introduction to data ethics and the data ethics canvas.” Open Data Institute, 2020. Accessed 25 June 2021.

      Open Data Institute. “The UK National Data Strategy 2020: doing data ethically.” Open Data Institute, 17 Nov. 2020. Accessed 25 June 2021.

      Open Data Institute. “What is the Data Ethics Canvas?” Open Data Institute, 3 July 2019. Accessed 25 June 2021.

      Pathak, Rahul. “Becoming a Data-Driven Enterprise: Meeting the Challenges, Changing the Culture.” MIT Sloan Management Review, 28 Sept. 2020. Accessed 25 June 2021.

      Redman, Thomas, et al. “Only 3% of Companies’ Data Meets Basic Quality Standards.” Harvard Business Review. 11 Sept 2017.

      Petzold, Bryan, et al. “Designing data governance that delivers value.” McKinsey & Company, 26 June 2020. Accessed 25 June 2021.

      Smaje, Kate. “How six companies are using technology and data to transform themselves.” McKinsey & Company, 12 Aug. 2020. Accessed 25 June 2021.

      Talend. “The Definitive Guide to Data Governance.” Talend. Accessed 25 June 2021.

      “The Powerfully Simple Modern Data Catalog.” Atlan, 2021. Web.

      U.S. Geological Survey. “Data Management: Data Standards.” U.S. Geological Survey. Accessed 25 June 2021.

      Waller, David. “10 Steps to Creating a Data-Driven Culture.” Harvard Business Review, 6 Feb. 2020. Accessed 25 June 2021.

      “What is the Difference Between A Business Glossary, A Data Dictionary, and A Data Catalog, and How Do They Play A Role In Modern Data Management?” Analytics8, 23 June 2021. Web.

      Wikipedia. “RFM (market research).” Wikipedia. Accessed 25 June 2021.

      Windheuser, Christoph, and Nina Wainwright. “Data in a Modern Digital Business.” Thoughtworks, 12 May 2020. Accessed 25 June 2021.

      Wright, Tom. “Digital Marketing KPIs - The 12 Key Metrics You Should Be Tracking.” Cascade, 3 March 2021. Accessed 25 June 2021.

      Stabilize Release and Deployment Management

      • Buy Link or Shortcode: {j2store}453|cart{/j2store}
      • member rating overall impact: 9.6/10 Overall Impact
      • member rating average dollars saved: $38,699 Average $ Saved
      • member rating average days saved: 37 Average Days Saved
      • Parent Category Name: Operations Management
      • Parent Category Link: /i-and-o-process-management

      Lack of control over the release process, poor collaboration between teams, and manual deployments lead to poor quality releases at a cost to the business.

      Our Advice

      Critical Insight

      • Manage risk. Release management should stabilize the IT environment. A poorly designed release can take down the whole business. Rushing releases out the door leads to increased risk for the business.
      • Quality processes are key. Standardized process will enable your release and deployment management teams to have a framework to deploy new releases with minimal chance of costly downtime further down the production chain.
      • Business must own the process. Release managers need oversight of the business to remain good stewards of the release management process.

      Impact and Result

      • Be prepared with a release management policy. With vulnerabilities discovered and published at an alarming pace, organizations have to build a plan to address and fix them quickly. A detailed release and patch policy should map out all the logistics of the deployment in advance, so that when necessary, teams can handle rollouts like a well-oiled machine.
      • Automate your software deployment and patch management strategy. Replace tedious and time-consuming manual processes with the use of automated release and patch management tools. Some organizations have a variety of release tools for various tasks and processes to ensure all or most of the required processes are covered across a diverse development environment.
      • Test deployments and monitor your releases. Larger organizations may have the luxury of a test environment prior to deployment, but that may be cost prohibitive for smaller organizations. If resources are a constraint, roll out the patch gradually and closely monitor performance to be able to quickly revert in the event of an issue.

      Stabilize Release and Deployment Management Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should control and stabilize your release and deployment management practice while improving the quality of releases and deployments, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Analyze current state

      Begin improving release management by assessing the current state and gaining a solid understanding of how core operational processes are actually functioning within the organization.

      • Stabilize Release and Deployment Management – Phase 1: Analyze Current State
      • Release Management Maturity Assessment
      • Release Management Project Roadmap Tool
      • Release Management Workflow Library (Visio)
      • Release Management Workflow Library (PDF)
      • Release Management Standard Operating Procedure
      • Patch Management Policy
      • Release Management Policy
      • Release Management Deployment Tracker
      • Release Management Build Procedure Template

      2. Plan releases and deployments

      Plan releases to gather all the pieces in one place and define what, why, when, and how a release will happen.

      • Stabilize Release and Deployment Management – Phase 2: Release and Deployment Planning

      3. Build, test, deploy

      Take a holistic and comprehensive approach to effectively designing and building releases. Get everything right the first time.

      • Stabilize Release and Deployment Management – Phase 3: Build, Test, Deploy

      4. Measure, manage, improve

      Determine desired goals for release management to ensure both IT and the business see the benefits of implementation.

      • Stabilize Release and Deployment Management – Phase 4: Measure, Manage, Improve
      [infographic]

      Workshop: Stabilize Release and Deployment Management

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Analyze Current State

      The Purpose

      Release management improvement begins with assessment of the current state.

      Key Benefits Achieved

      A solid understanding of how core operational processes are actually functioning within the organization.

      Activities

      1.1 Evaluate process maturity.

      1.2 Assess release management challenges.

      1.3 Define roles and responsibilities.

      1.4 Review and rightsize existing policy suite.

      Outputs

      Maturity Assessment

      Release Management Policy

      Release Management Standard Operating Procedure

      Patch Management Policy

      2 Release Management Planning

      The Purpose

      In simple terms, release planning puts all the pertinent pieces in one place.

      Key Benefits Achieved

      It defines the what, why, when, and how a release will happen.

      Activities

      2.1 Design target state release planning process.

      2.2 Define, bundle, and categorize releases.

      2.3 Standardize deployment plans and models.

      Outputs

      Release Planning Workflow

      Categorization and prioritization schemes

      Deployment models aligned to release types

      3 Build, Test, and Deploy

      The Purpose

      Take a holistic and comprehensive approach to effectively designing and building releases.

      Key Benefits Achieved

      Standardize build and test procedures to begin to drive consistency.

      Activities

      3.1 Standardize build procedures for deployments.

      3.2 Standardize test plans aligned to release types.

      Outputs

      Build procedure for hardware and software releases

      Test models aligned to deployment models

      4 Measure, Manage, and Improve

      The Purpose

      Determine and define the desired goals for release management as a whole.

      Key Benefits Achieved

      Agree to key metrics and success criteria to start tracking progress and establish a post-deployment review process to promote continual improvement.

      Activities

      4.1 Determine key metrics to track progress.

      4.2 Establish a post-deployment review process.

      4.3 Understand and define continual improvement drivers.

      Outputs

      List of metrics and goals

      Post-deployment validation checklist

      Project roadmap

      Application Portfolio Management

      • Buy Link or Shortcode: {j2store}28|cart{/j2store}
      • Related Products: {j2store}28|crosssells{/j2store}
      • member rating overall impact: 9.1/10
      • member rating average dollars saved: $81,275
      • member rating average days saved: 20
      • Parent Category Name: Applications
      • Parent Category Link: /applications

      The challenge

      • The chances are that you, too, have too many or far too many applications in your organization. You will not be alone. Almost 60% of companies report the same issue. 
      • That is due to poorly managed portfolios.
      • Your application managers now need to support too many non-critical applications, and they spend insufficient time on the vital applications.
      • You can rarely find the required pieces to rationalize your portfolio in one place. You will need to find the resources and build a team.
      • The lack of standard practices to define the value that each application in a portfolio provides to the company causes misalignments.

      Our advice

      Insight

      • There is no silver bullet solution. Going too rigid in your approach causes delays in value realization through application portfolio management. It may even prevent this altogether. Define flexible inputs to your portfolio and align closely with your business goals.

      Impact and results 

      • Define the outputs of your application rationalization effort, with clear roles and responsibilities.
      • Tailor the application rationalization framework (ARF) to your company's motivations, goals, and limitations.
      • Apply various application assessments to build a clear picture of your portfolio.
      • Build an application portfolio roadmap that shows your target state based on your rationalization decisions.

      The roadmap

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Get started

      Our concise executive brief shows you why you should rationalize your application portfolio using a tailored framework for your company. We'll show you our methodology and the ways we can help you in handling this.

      Lay the foundations

      Define why you want to rationalize your application portfolio. Define the end state and scope. Build your action plan.

      • Build an Application Rationalization Framework – Phase 1: Lay Your Foundations (ppt)
      • Application Rationalization Tool (xls)

      Plan the application rationalization framework

      Understand what the core assessments are that you perform in these rationalizations. Define your framework and how rigorous you want to apply the reviews based on your business context.

      • Build an Application Rationalization Framework – Phase 2: Plan Your Application Rationalization Framework (ppt)

      Test and adapt your application rationalization framework (ARF)

      Our tool allows you to test the elements of your ARF. Then do a retrospective and adapt based on your experience and desired outcomes. 

      • Build an Application Rationalization Framework – Phase 3: Test and Adapt Your Application Rationalization Framework (ppt)
      • Application TCO Calculator (xls)
      • Value Calculator (xls)

      Initiate your roadmap

      Review your dispositions to ensure they align with your goals. 

      • Build an Application Rationalization Framework – Phase 4: Initiate Your Roadmap (ppt)
      • Disposition Prioritization Tool (xls)

       

      Assess the Viability of M365-O365 Security Add-Ons

      • Buy Link or Shortcode: {j2store}251|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Security Strategy & Budgeting
      • Parent Category Link: /security-strategy-and-budgeting

      The technical side of IT security demands the best security possible, but the business side of running IT demands that you determine what is cost-effective and can still do the job. You likely shrugged off the early iterations of Microsoft’s security efforts, but you may have heard that things have changed. Where do you start in evaluating Microsoft’s security products in terms of effectiveness? The value proposition sounds tremendous to the CFO, “free” security as part of your corporate license, but how does it truly measure up and how do you articulate your findings to the business?

      Our Advice

      Critical Insight

      Microsoft’s security products have improved to the point where they are often ranked competitively with mainstream security products. Depending on your organization’s licensing of Office 365/Microsoft 365, some of these products are included in what you’re already paying for. That value proposition is hard to deny.

      Impact and Result

      Determine what is important to the business, and in what order of priority.

      Take a close look at your current solution and determine what are table stakes, what features you would like to have in its replacement, and what your current solution is missing.

      Consider Microsoft’s security solutions using an objective methodology. Sentiment will still be a factor, but it shouldn’t dictate the decision you make for the good of the business.

      Assess the Viability of M365/O365 Security Add-Ons Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to assess the viability of M365/O365 security add-ons. Review Info-Tech’s methodology and understand the four key steps to completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Review your current state

      Examine what you are licensed for, what you are paying, what you need, and what your constraints are.

      • Microsoft 365/Office 365 Security Add-Ons Assessment Tool

      2. Assess your needs

      Determine what is “good enough” security and assess the needs of your organization.

      3. Select your path

      Decide what you will go with and start planning your next steps.

      [infographic]

      Build a Vendor Security Assessment Service

      • Buy Link or Shortcode: {j2store}318|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: $17,501 Average $ Saved
      • member rating average days saved: 17 Average Days Saved
      • Parent Category Name: Threat Intelligence & Incident Response
      • Parent Category Link: /threat-intelligence-incident-response
      • Vendor security risk management is a growing concern for many organizations. Whether suppliers or business partners, we often trust them with our most sensitive data and processes.
      • More and more regulations require vendor security risk management, and regulator expectations in this area are growing.
      • However, traditional approaches to vendor security assessments are seen by business partners and vendors as too onerous and are unsustainable for information security departments.

      Our Advice

      Critical Insight

      • An efficient and effective assessment process can only be achieved when all stakeholders are participating.
      • Security assessments are time-consuming for both you and your vendors. Maximize the returns on your effort with a risk-based approach.
      • Effective vendor security risk management is an end-to-end process that includes assessment, risk mitigation, and periodic re-assessments.

      Impact and Result

      • Develop an end-to-end security risk management process that includes assessments, risk treatment through contracts and monitoring, and periodic re-assessments.
      • Base your vendor assessments on the actual risks to your organization to ensure that your vendors are committed to the process and you have the internal resources to fully evaluate assessment results.
      • Understand your stakeholder needs and goals to foster support for vendor security risk management efforts.

      Build a Vendor Security Assessment Service Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should build a vendor security assessment service, review Info-Tech’s methodology, and understand the three ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Define governance and process

      Determine your business requirements and build your process to meet them.

      • Build a Vendor Security Assessment Service – Phase 1: Define Governance and Process
      • Vendor Security Policy Template
      • Vendor Security Process Template
      • Vendor Security Process Diagram (Visio)
      • Vendor Security Process Diagram (PDF)

      2. Develop assessment methodology

      Develop the specific procedures and tools required to assess vendor risk.

      • Build a Vendor Security Assessment Service – Phase 2: Develop Assessment Methodology
      • Service Risk Assessment Questionnaire
      • Vendor Security Questionnaire
      • Vendor Security Assessment Inventory

      3. Deploy and monitor process

      Implement the process and develop metrics to measure effectiveness.

      • Build a Vendor Security Assessment Service – Phase 3: Deploy and Monitor Process
      • Vendor Security Requirements Template
      [infographic]

      Workshop: Build a Vendor Security Assessment Service

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Define Governance and Process

      The Purpose

      Understand business and compliance requirements.

      Identify roles and responsibilities.

      Define the process.

      Key Benefits Achieved

      Understanding of key goals for process outcomes.

      Documented service that leverages existing processes.

      Activities

      1.1 Review current processes and pain points.

      1.2 Identify key stakeholders.

      1.3 Define policy.

      1.4 Develop process.

      Outputs

      RACI Matrix

      Vendor Security Policy

      Defined process

      2 Define Methodology

      The Purpose

      Determine methodology for assessing procurement risk.

      Develop procedures for performing vendor security assessments.

      Key Benefits Achieved

      Standardized, repeatable methodologies for supply chain security risk assessment.

      Activities

      2.1 Identify organizational security risk tolerance.

      2.2 Develop risk treatment action plans.

      2.3 Define schedule for re-assessments.

      2.4 Develop methodology for assessing service risk.

      Outputs

      Security risk tolerance statement

      Risk treatment matrix

      Service Risk Questionnaire

      3 Continue Methodology

      The Purpose

      Develop procedures for performing vendor security assessments.

      Establish vendor inventory.

      Key Benefits Achieved

      Standardized, repeatable methodologies for supply chain security risk assessment.

      Activities

      3.1 Develop vendor security questionnaire.

      3.2 Define procedures for vendor security assessments.

      3.3 Customize the vendor security inventory.

      Outputs

      Vendor security questionnaire

      Vendor security inventory

      4 Deploy Process

      The Purpose

      Define risk treatment actions.

      Deploy the process.

      Monitor the process.

      Key Benefits Achieved

      Understanding of how to treat different risks according to the risk tolerance.

      Defined implementation strategy.

      Activities

      4.1 Define risk treatment action plans.

      4.2 Develop implementation strategy.

      4.3 Identify process metrics.

      Outputs

      Vendor security requirements

      Understanding of required implementation plans

      Metrics inventory

      AI Trends 2023

      • Buy Link or Shortcode: {j2store}207|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Business Intelligence Strategy
      • Parent Category Link: /business-intelligence-strategy

      As AI technologies are constantly evolving, organizations are looking for AI trends and research developments to understand the future applications of AI in their industries.

      Our Advice

      Critical Insight

      • Understanding trends and the focus of current and future AI research helps to define how AI will drive an organization’s new strategic opportunities.
      • Understanding the potential application of AI and its promise can help plan the future investments in AI-powered technologies and systems.

      Impact and Result

      Understanding AI trends and developments enables an organization’s competitive advantage.

      AI Trends 2023 Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. AI Trends 2023 – An overview of trends that will continue to drive AI innovation.

      • AI Trends Report 2023
      [infographic]

      Further reading

      AI Trends Report 2023

      The eight trends:

      1. Design for AI
      2. Event-Based Insights
      3. Synthetic Data
      4. Edge AI
      5. AI in Science and Engineering
      6. AI Reasoning
      7. Digital Twin
      8. Combinatorial Optimization
      Challenges that slowed the adoption of AI

      To overcome the challenges, enterprises adopted different strategies

      Data Readiness

      • Lack of unified systems and unified data
      • Data quality issues
      • Lack of the right data required for machine learning
      • Improve data management capabilities, including data governance and data initiatives
      • Create data catalogs
      • Document data and information architecture
      • Solve data-related problems including data quality, privacy, and ethics

      ML Operations Capabilities

      • Lack of tools, technologies, and methodologies to operationalize models created by data scientists
      • Increase availability of cloud platforms, tools, and capabilities
      • Develop and grow machine learning operations (MLOps) tools, platforms, and methodologies to enable model operationalizing and monitoring in production

      Understanding of AI Role and Its Business Value

      • Lack of understanding of AI use cases – how AI/ML can be applied to solve specific business problems
      • Lack of understanding how to define the business value of AI investments
      • Identify AI C-suite toolkits (for example, Empowering AI Leadership from the World Economic Forum, 2022)
      • Document industry use cases
      • Use frameworks and tools to define business value for AI investments

      Design for AI

      Sustainable AI system design needs to consider several aspects: the business application of the system, data, software and hardware, governance, privacy, and security.

      It is important to define from the beginning how AI will be used by and for the application to clearly articulate business value, manage expectations, and set goals for the implementation.

      Design for AI will change how we store and manage data and how we approach the use of data for development and operation of AI systems.

      An AI system design approach should cover all stages of AI lifecycle, from design to maintenance. It should also support and enable iterative development of an AI system.

      To take advantage of different tools and technologies for AI system development, deployment, and monitoring, the design of an AI system should consider software and hardware needs and design for seamless and efficient integrations of all components of the system and with other existing systems within the enterprise.

      AI in Science and Engineering

      AI helps sequence genomes to identify variants in a person’s DNA that indicate genetic disorders. It allows researchers to model and calculate complicated physics processes, to forecast the genesis of the universe’s structure, and to understand planet ecosystem to help advance the climate research. AI drives advances in drug discovery and can assist with molecule synthesis and molecular property identification.

      AI finds application in all areas of science and engineering. The role of AI in science will grow and allow scientists to innovate faster.

      AI will further contribute to scientific understanding by assisting scientists in deriving new insights, generating new ideas and connections, generalizing scientific concepts, and transferring them between areas of scientific research.

      Using synthetic data and combining physical and machine learning models and other advances of AI/ML – such as graphs, use of unstructured data (language models), and computer vision – will accelerate the use of AI in science and engineering.

      Event- and Scenario-Driven AI

      AI-driven signal-gathering systems analyze a continuous stream of data to generate insights and predictions that enable strategic decision modeling and scenario planning by providing understanding of how and what areas of business might be impacted by certain events.

      AI enables the scenario-based approach to drive insights through pattern identification in addition to familiar pattern recognition, helping to understand how events are related.

      A system with anticipatory capabilities requires an event-driven architecture that enables gathering and analyzing different types of data (text, video, images) across multiple channels (social media, transactional systems, news feeds, etc.) for event-driven and event-sequencing modeling.

      ML simulation-based training of the model using advanced techniques under the umbrella of Reinforcement Learning in conjunction with statistically robust Bayesian probabilistic framework will aid in setting up future trends in AI.

      AI Reasoning

      Most of the applications of machine learning and AI today is about predicting future behaviors based on historical data and past behaviors. We can predict what product the customer would most likely buy or the price of a house when it goes on sale.

      Most of the current algorithms use the correlation between different parameters to make a prediction, for example, the correlation between the event and the outcome can look like “When X occurs, we can predict that Y will occur.” This, however, does not translate into “Y occurred because of X.”

      The development of a causal AI that uses causal inference to reason and identify the root cause and the causal relationships between variables without mistaking correlation and causation is still in its early stages but rapidly evolving.

      Some of the algorithms that the researchers are working with are casual graph models and algorithms that are at the intersection of causal inference with decision making and reinforcement learning (Causal Artificial Intelligence Lab, 2022).

      Synthetic Data

      Synthetic data is artificially generated data that mimics the structure of real-life data. It should also have the same mathematical and statistical properties as the real-world data that it is created to replicate.

      Synthetic data is used to train machine learning models when there is not enough real data or the existing data does not meet specific needs. It allows users to remove contextual bias from data sets containing personal data, prevent privacy concerns, and ensure compliance with privacy laws and regulations.

      Another application of synthetic data is solving data-sharing challenges.

      Researchers learned that quite often synthetic data sets outperform real-world data. Recently, a team of researchers at MIT built a synthetic data set of 150,000 video clips capturing human actions and used that data set to train the model. The researchers found that “the synthetically trained models performed even better than models trained on real data for videos that have fewer background objects” (MIT News Office, 2022).

      Today, synthetic data is used in language systems, in training self-driving cars, in improving fraud detection, and in clinical research, just to name a few examples.

      Synthetic data opens the doors for innovation across all industries and applications of AI by enabling access to data for any scenario and technology and business needs.

      Digital Twins

      Digital twins (DT) are virtual replicas of physical objects, devices, people, places, processes, and systems. In Manufacturing, almost every product and manufacturing process can have a complete digital replica of itself thanks to IoT, streaming data, and cheap cloud storage.

      All this data has allowed for complex simulations of, for example, how a piece of equipment will perform over time to predict future failures before they happen, reducing costly maintenance and extending equipment lifetime.

      In addition to predictive maintenance, DT and AI technologies have enabled organizations to design and digitally test complex equipment such as aircraft engines, trains, offshore oil platforms, and wind turbines before physically manufacturing them. This helps to improve product and process quality, manufacturing efficiency, and costs. DT technology also finds applications in architecture, construction, energy, infrastructure industries, and even retail.

      Digital twins combined with the metaverse provide a collaborative and interactive environment with immersive experience and real-time physics capabilities (as an example, Siemens presented an Immersive Digital Twin of a Plant at the Collision 2022 conference).

      Future trends include enabling autonomous behavior of a DT. An advanced DT can replicate itself as it moves into several devices, hence requiring the autonomous property. Such autonomous behavior of the DT will in turn influence the growth and further advancement of AI.

      Edge AI

      A simple definition for edge AI: A combination of edge computing and artificial intelligence, it enables the deployment of AI applications in devices of the physical world, in the field, where the data is located, such as IoT devices, devices on the manufacturing floor, healthcare devices, or a self-driving car.

      Edge AI integrates AI into edge computing devices for quicker and improved data processing and smart automation.

      The main benefits of edge AI include:

      • Real-time data processing capabilities to reduce latency and enable near real-time analytics and insights.
      • Reduced cost and bandwidth requirements as there is no need to transfer data to the cloud for computing.
      • Increased data security as the data is processed locally, on the device, reducing the risk of loss of sensitive data.
      • Improved automation by training machines to perform automated tasks.

      Edge AI is already used in a variety of applications and use cases including computer vision, geospatial intelligence, object detection, drones, and health monitoring devices.

      Combinatorial Optimization

      “Combinatorial optimization is a subfield of mathematical optimization that consists of finding an optimal object from a finite set of objects” (Wikipedia, retrieved December 2022).

      Applications of combinatorial optimization include:

      • Supply chain optimization
      • Scheduling and logistics, for example, vehicle routing where the trucks are making stops for pickup and deliveries
      • Operations optimization

      Classical combinatorial optimization (CO) techniques were widely used in operations research and played a major role in earlier developments of AI.

      The introduction of deep learning algorithms in recent years allowed researchers to combine neural network and conventional optimization algorithms; for example, incorporating neural combinatorial optimization algorithms in the conventional optimization framework. Researchers confirmed that certain combinations of these frameworks and algorithms can provide significant performance improvements.

      The research in this space continues and we look forward to learning how machine learning and AI (backtracking algorithms, reinforcement learning, deep learning, graph attention networks, and others) will be used for solving challenging combinatorial and decision-making problems.

      References

      “AI Can Power Scenario Planning for Real-Time Strategic Insights.” The Wall Street Journal, CFO Journal, content by Deloitte, 7 June 2021. Accessed 11 Dec. 2022.
      Ali Fdal, Omar. “Synthetic Data: 4 Use Cases in Modern Enterprises.” DATAVERSITY, 5 May 2022. Accessed
      11 Dec. 2022.
      Andrews, Gerard. “What Is Synthetic Data?” NVIDIA, 8 June 2021. Accessed 11 Dec. 2022.
      Bareinboim, Elias. “Causal Reinforcement Learning.” Causal AI, 2020. Accessed 11 Dec. 2022.
      Bengio, Yoshua, Andrea Lodi, and Antoine Prouvost. “Machine learning for combinatorial optimization: A methodological tour d’horizon.” European Journal of Operational Research, vol. 290, no. 2, 2021, pp. 405-421, https://doi.org/10.1016/j.ejor.2020.07.063. Accessed 11 Dec. 2022.
      Benjamins, Richard. “Four design principles for developing sustainable AI applications.” Telefónica S.A., 10 Sept. 2018. Accessed on 11 Dec. 2022.
      Blades, Robin. “AI Generates Hypotheses Human Scientists Have Not Thought Of.” Scientific American, 28 October 2021. Accessed 11 Dec. 2022.
      “Combinatorial Optimization.” Wikipedia article, Accessed 11 Dec. 2022.
      Cronholm, Stefan, and Hannes Göbel. “Design Principles for Human-Centred Artificial Intelligence.” University of Borås, Sweden, 11 Aug. 2022. Accessed on 11 Dec. 2022
      Devaux, Elise. “Types of synthetic data and 4 real-life examples.” Statice, 29 May 2022. Accessed 11 Dec. 2022.
      Emmental, Russell. “A Guide to Causal AI.” ITBriefcase, 30 March 2022. Accessed 11 Dec. 2022.
      “Empowering AI Leadership: AI C-Suite Toolkit.” World Economic Forum, 12 Jan. 2022. Accessed 11 Dec 2022.
      Falk, Dan. “How Artificial Intelligence Is Changing Science.” Quanta Magazine, 11 March 2019. Accessed 11 Dec. 2022.
      Fritschle, Matthew J. “The Principles of Designing AI for Humans.” Aumcore, 17 Aug. 2018. Accessed 8 Dec. 2022.
      Garmendia, Andoni I., et al. Neural Combinatorial Optimization: a New Player in the Field.” IEEE, arXiv:2205.01356v1, 3 May 2022. Accessed 11 Dec. 2022.
      Gülen, Kerem. “AI Is Revolutionizing Every Field and Science is no Exception.” Dataconomy Media GmbH, 9 Nov. 9, 2022. Accessed 11 Dec. 2022
      Krenn, Mario, et al. “On scientific understanding with artificial intelligence.” Nature Reviews Physics, vol. 4, 11 Oct. 2022, pp. 761–769. https://doi.org/10.1038/s42254-022-00518-3. Accessed 11 Dec. 2022.
      Laboratory for Information and Decision Systems. “The real promise of synthetic data.” MIT News, 16 Oct. 2020. Accessed 11 Dec. 2022.
      Lecca, Paola. “Machine Learning for Causal Inference in Biological Networks: Perspectives of This Challenge.” Frontiers, 22 Sept. 2021. Accessed 11 Dec. 2022. Mirabella, Lucia. “Digital Twin x Metaverse: real and virtual made easy.” Siemens presentation at Collision 2022 conference, Toronto, Ontario. Accessed 11 Dec. 2022. Mitchum, Rob, and Louise Lerner. “How AI could change science.” University of Chicago News, 1 Oct. 2019. Accessed 11 Dec. 2022.
      Okeke, Franklin. “The benefits of edge AI.” TechRepublic, 22 Sept. 2022, Accessed 11 Dec. 2022.
      Perlmutter, Nathan. “Machine Learning and Combinatorial Optimization Problems.” Crater Labs, 31 July 31, 2019. Accessed 11 Dec. 2022.
      Sampson, Ovetta. “Design Principles for a New AI World.” UX Magazine, 6 Jan. 2022. Accessed 11 Dec. 2022.
      Sgaier, Sema K., Vincent Huang, and Grace Charles. “The Case for Causal AI.” Stanford Social Innovation Review, Summer 2020. Accessed 11 Dec. 2022.
      “Synthetic Data.” Wikipedia article, Accessed 11 Dec. 2022.
      Take, Marius, et al. “Software Design Patterns for AI-Systems.” EMISA Workshop 2021, CEUR-WS.org, Proceedings 30. Accessed 11 Dec. 2022.
      Toews, Rob. “Synthetic Data Is About To Transform Artificial Intelligence.” Forbes, 12 June 2022. Accessed
      11 Dec. 2022.
      Zewe, Adam. “In machine learning, synthetic data can offer real performance improvements.” MIT News Office, 3 Nov. 2022. Accessed 11 Dec. 2022.
      Zhang, Junzhe, and Elias Bareinboim. “Can Humans Be out of the Loop?” Technical Report, Department of Computer Science, Columbia University, NY, June 2022. Accessed 11 Dec. 2022.

      Contributors

      Irina Sedenko Anu Ganesh Amir Feizpour David Glazer Delina Ivanova

      Irina Sedenko

      Advisory Director

      Info-Tech

      Anu Ganesh

      Technical Counselor

      Info-Tech

      Amir Feizpour

      Co-Founder & CEO

      Aggregate Intellect Inc.

      David Glazer

      VP of Analytics

      Kroll

      Delina Ivanova

      Associate Director, Data & Analytics

      HelloFresh

      Usman Lakhani

      DevOps

      WeCloudData

      Select and Implement an IT PPM Solution

      • Buy Link or Shortcode: {j2store}440|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $125,999 Average $ Saved
      • member rating average days saved: 29 Average Days Saved
      • Parent Category Name: Portfolio Management
      • Parent Category Link: /portfolio-management
      • The number of IT project resources and the quantity of IT projects and tasks can no longer be recorded, prioritized, and tracked using non-commercial project portfolio management (PPM) solutions.
      • Your organization has attained a moderate level of PPM maturity.
      • You have sufficient financial and technical resources to purchase a commercial PPM solution.
      • There is a wide variety of commercial PPM solutions; different kinds of PPM solutions are more appropriate for organizations of a certain size and a certain PPM maturity level than others.

      Our Advice

      Critical Insight

      • Implementations of PPM solutions are often unsuccessful resulting in wasted time and resources; failing to achieve sustainable adoption of the tool is a widespread pain point.
      • The costs of PPM solutions do not end after the implementation and subscription invoices are paid. Have realistic expectations about the time required to use and maintain PPM solutions to ensure success.
      • PPM solutions help PMOs serve the organization’s core decision makers. Success depends on improved service to these stakeholders.

      Impact and Result

      • Using Info-Tech’s Vendor Landscape and PPM solution use cases, you will be able to make sense of the diversity of PPM solutions available in today’s market and choose the most appropriate solution for your organization’s size and level of PPM maturity.
      • Info-Tech’s blueprint for a PPM solution selection and implementation project will provide you with a variety of tools and templates.
      • A carefully planned out and executed selection and implementation process will help ensure your organization can maximize the value of your project portfolio and will allow the PMO to improve portfolio stakeholder satisfaction.

      Select and Implement an IT PPM Solution Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should implement a commercial PPM solution, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Launch the PPM solution project and collect requirements

      Create a PPM solution selection and implementation project charter and gather your organizations business and technical requirements.

      • Select and Implement a PPM Solution – Phase 1: Launch the PPM Solution Project and Collect Requirements
      • PPM Solution Project Charter Template
      • PPM Implementation Work Breakdown Structure
      • PPM Solution Requirements Gathering Tool
      • PPM Solution Cost-of-Use Estimation Tool
      • PPM Solution RFP Template
      • PPM Solution Success Metrics Workbook
      • PPM Solution Use-Case Fit Assessment Tool

      2. Select a PPM solution

      Select the most appropriate PPM solution for your organization by using Info-Tech’s PPM solution Vendor Landscape and use cases to help you create a vendor shortlist, produce an RFP, and establish evaluation criteria for ranking your shortlisted solutions.

      • Select and Implement a PPM Solution – Phase 2: Select a PPM Solution
      • PPM Vendor Shortlist & Detailed Feature Analysis Tool
      • PPM Solution Vendor Response Template
      • PPM Solution Evaluation & RFP Scoring Tool
      • PPM Solution Vendor Demo Script

      3. Plan the PPM solution implementation

      Plan a PPM solution implementation that will result in long-term sustainable adoption of the tool and that will allow the PMO to meet the needs of core project portfolio stakeholders.

      • Select and Implement a PPM Solution – Phase 3: Plan the PPM Solution Implementation
      [infographic]

      Workshop: Select and Implement an IT PPM Solution

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Launch the PPM Solution Project and Gather Requirements

      The Purpose

      Create a PPM solution selection and implementation project charter.

      Gather the business and technical requirements for the PPM solution.

      Establish clear and measurable success criteria for your PPM solution project.

      Key Benefits Achieved

      Comprehensive project plan

      Comprehensive and organized record of the various PPM solution requirements

      A record of PPM solution project goals and criteria that can be used in the future to establish the success of the project

      Activities

      1.1 Brainstorm, refine, and prioritize your PPM solution needs

      1.2 Stakeholder identification exercise

      1.3 Project charter work session

      1.4 Requirements gathering work session

      1.5 PPM solution success metrics workbook session

      Outputs

      High-level outline of PPM solution requirements

      Stakeholder consultation plan

      A draft project charter and action plan to fill in project charter gaps

      A draft requirements workbook and action plan to fill in requirement gathering gaps

      A PPM project success metrics workbook that can be used during and after the project

      2 Select a PPM Solution

      The Purpose

      Identify the PPM solutions that are most appropriate for your organization’s size and level of PPM maturity.

      Create a PPM solution and vendor shortlist.

      Create a request for proposal (RFP).

      Create a PPM solution scoring and evaluation tool.

      Key Benefits Achieved

      Knowledge of the PPM solution market and the various features available

      An informed shortlist of PPM vendors

      An organized and focused method for evaluating the often long and complex responses to the RFP that vendors provide

      The groundwork for an informed and defensible selection of a PPM solution for your organization

      Activities

      2.1 Assess the size of your organization and the level of PPM maturity to select the most appropriate use case

      2.2 PPM solution requirements and criteria ranking activity

      2.3 An RFP working session

      2.4 Build an RFP evaluation tool

      Outputs

      Identification of the most appropriate use case in Info-Tech’s Vendor Landscape

      A refined and organized list of the core features that will be included in the RFP

      A draft RFP with an action plan to fill in any RFP gaps

      An Excel tool that can be used to compare and evaluate vendors’ responses to the RFP

      3 Prepare for the PPM Solution Implementation

      The Purpose

      To think ahead to the eventual implementation of the solution that will occur once the selection phase is completed

      Key Benefits Achieved

      An understanding of key insights and steps that will help avoid mistakes resulting in poor adoption or PPM solutions that end up producing little tangible value

      Activities

      3.1 Outline high-level implementation stages

      3.2 Organizational change management strategy session

      3.3 A PPM project success metrics planning session

      Outputs

      High-level implementation tasks and milestones

      A RACI chart for core implementation tasks

      A high-level PPM solution implementation organizational change management strategy

      A RACI chart for core organizational change management tasks related to the PPM solution implementation

      A PPM project success metrics schedule and plan

      Consolidate Your Data Centers

      • Buy Link or Shortcode: {j2store}498|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Center & Facilities Strategy
      • Parent Category Link: /data-center-and-facilities-strategy
      • Data center operating costs continue to escalate as organizations struggle with data center sprawl.
      • While data center consolidation is an attractive option to reduce cost and sprawl, the complexity of these projects makes them extremely difficulty to execute.
      • The status quo is also not an option, as budget constraints and the challenges with managing multiple data centers continues to increase.

      Our Advice

      Critical Insight

      • Despite consolidation being an effective way of addressing sprawl, it is often difficult to secure buy-in and funding from the business.
      • Many consolidation projects suffer cost overruns due to unforeseen requirements and hidden interdependencies which could have been mitigated during the planning phase.
      • Organizations that avoid consolidation projects due to their complexity are just deferring the challenge, while costs and inefficiencies continue to increase.

      Impact and Result

      • Successful data center consolidation will have an immediate impact on reducing data center sprawl. Maximize your chances of success by securing buy-in from the business.
      • Avoid cost overruns and unforeseen requirements by engaging with the business at the start of the process. Clearly define business requirements and establish common expectations.
      • While cost improvements often drive data center consolidation, successful projects will also improve scalability, operational efficiency, and data center redundancy.

      Consolidate Your Data Centers Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should perform a data center consolidation, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Discover

      Identify IT infrastructure systems and establish dependency bundles for the current and target sites.

      • Consolidate Your Data Centers – Phase 1: Discover
      • Data Center Consolidation Data Collection Workbook
      • Data Center Consolidation Project Planning and Prioritization Tool

      2. Plan

      Build a strong business case for data center consolidation by leveraging a TCO analysis and incorporating business requirements.

      • Consolidate Your Data Centers – Phase 2: Plan
      • Data Center Consolidation TCO Comparison Tool
      • Data Center Relocation Vendor Statement of Work Evaluation Tool

      3. Execute

      Streamline the move-day process through effective communication and clear delegation of duties.

      • Consolidate Your Data Centers – Phase 3: Execute
      • Communications Plan Template for Data Center Consolidation
      • Data Center Consolidation Executive Presentation
      • Minute-to-Minute Move Day Script (PDF)
      • Minute-to-Minute Move Day Script (Visio)
      • Data Center Relocation Minute-to-Minute Project Planning and Monitoring Tool

      4. Close

      Close the loop on the data center consolidation project by conducting an effective project retrospective.

      • Consolidate Your Data Centers – Phase 4: Close
      • Data Center Relocation QA Team Project Planning and Monitoring Tool
      • Data Center Move Issue Resolution and Change Order Template
      • Data Center Relocation Wrap-up Checklist
      [infographic]

      Design an Enterprise Architecture Strategy

      • Buy Link or Shortcode: {j2store}580|cart{/j2store}
      • member rating overall impact: 9.4/10 Overall Impact
      • member rating average dollars saved: $63,181 Average $ Saved
      • member rating average days saved: 30 Average Days Saved
      • Parent Category Name: Strategy & Operating Model
      • Parent Category Link: /strategy-and-operating-model
      • The enterprise architecture (EA) team is constantly challenged to articulate the value of its function.
      • The CIO has asked the EA team to help articulate the business value the team brings.
      • Traceability from the business goals and vision to the EA contributions often does not exist.
      • Also, clients often struggle with complexity, priorities, and agile execution.

      Our Advice

      Critical Insight

      • EA can deliver many benefits to an organization. However, to increase the likelihood of success, the EA group needs to deliver value to the business and cannot be seen solely as IT.
      • Support from the organization is needed.
      • An EA strategy anchored in a value proposition will ensure that EA focuses on driving the most critical outcomes in support of the organization’s enterprise strategy.
      • As agility is not just for project execution, architects need to understand ways to deliver their guidance to influence project execution in real time, to enable the enterprise agility, and to enhance their responsiveness to changing conditions.

      Impact and Result

      • Create an EA value proposition based on enterprise needs that clearly articulates the expected contributions of the EA function.
      • Establish the EA fundamentals (vision and mission statement, goals and objectives, and principles) needed to position the EA function to deliver the promised value proposition.
      • Identify the services that EA has to provide to the organization to deliver on the promised value proposition.

      Design an Enterprise Architecture Strategy Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Design an Enterprise Architecture Strategy Deck – A guide to help you define services that your EA function will provide to the organization.

      Establish an effective EA function that will realize value for the organization with an EA strategy.

      • Design an Enterprise Architecture Strategy – Phases 1-4

      2. EA Function Strategy Template – A communication tool to secure the approval of the EA strategy from organizational stakeholders.

      Use this template to document the outputs of the EA strategy and to communicate the EA strategy for approval by stakeholders.

      • EA Function Strategy Template

      3. Stakeholder Power Map Template – A template to help visualize the importance of various stakeholders and their concerns.

      Identify and prioritize the stakeholders that are important to your IT strategy development effort.

      • Stakeholder Power Map Template

      4. PESTLE Analysis Template – A template to help you complete and document a PESTLE analysis.

      Use this template to analyze the effect of external factors on IT.

      • PESTLE Analysis Template

      5. EA Value Proposition Template – A template to communicate the value EA can provide to the organization.

      Use this template to create an EA value proposition that explicitly communicates to stakeholders how an EA function can contribute to addressing their needs.

      • EA Value Proposition Template

      6. EA Goals and Objectives Template – A template to identify the EA goals that support the identified promises of value from the EA value proposition.

      Use this template to help set goals for your EA function based on the EA value proposition and identify objectives to measure the progression towards those EA goals.

      • EA Goals and Objectives Template

      7. EA Principles Template – A template to identify the universal EA principles relevant to your organization.

      Use this template to define relevant universal EA principles and create new EA principles to guide and inform IT investment decisions.

      • EA Principles Template – EA Strategy

      8. EA Service Planning Tool – A template to identify the EA services your organization will provide to deliver on the EA value proposition.

      Use this template to identify the EA services relevant to your organization and then define how those services will be accessed.

      • EA Service Planning Tool
      [infographic]

      Workshop: Design an Enterprise Architecture Strategy

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Map the EA Contributions to Business Goals

      The Purpose

      Show an example of traceability.

      Key Benefits Achieved

      Members have a real-world example of traceability between business goals and EA contributions.

      Activities

      1.1 Start from the business goals of the organization.

      1.2 Document business and IT drivers.

      1.3 Identify EA contributions that help achieve the business goals.

      Outputs

      Business goals documented.

      Business and IT drivers documented.

      Identified EA contributions and traced them to business goals.

      2 Determine the Role of the Architect in the Agile Ceremonies of the Organization

      The Purpose

      Create an understanding about role of architect in Agile ceremonies.

      Key Benefits Achieved

      Understanding of the role of the EA architect in Agile ceremonies.

      Activities

      2.1 Document the Agile ceremony used in the organization (based on SAFe or other Agile approaches).

      2.2 Determine which ceremonies the system architect will participate in.

      2.3 Determine which ceremonies the solution architect will participate in.

      2.4 Determine which ceremonies the enterprise architect will participate in.

      2.5 Determine architect syncs, etc.

      Outputs

      Documented the Agile ceremonial used in the organization (based on SAFe or other Agile approaches).

      Determined which ceremonies the system architect will participate in.

      Determined which ceremonies the solution architect will participate in.

      Determined which ceremonies the enterprise architect will participate in.

      Determined architect syncs, etc.

      Further reading

      Design an Enterprise Architecture Strategy

      Develop a strategy that fits the organization’s maturity and remains adaptable to unforeseen future changes.

      EXECUTIVE BRIEF

      Build a right-size enterprise architecture strategy

      Enterprise Architecture Strategy

      Business & IT Strategy
      • Organizational Goals and Objectives
      • Business Drivers
      • Environment and Industry Trends
      • EA Capabilities and Services
      • Business Architecture
      • Data Architecture
      • Application Architecture
      • Integration Architecture
      • Innovation
      • Roles and Organizational Structure
      • Security Architecture
      • Technology Architecture
      • Integration Architecture
      • Insight and Knowledge
      • EA Operating Model
      Unlock the Value of Architecture
      • Increased Business and IT Alignment
      • Robust, Flexible, Scalable, Interoperable, Extensible and Reliable Solutions
      • Timely/Agile Service Delivery and Operations
      • Cost-Effective Solutions
      • Appropriate Risk Management to Address the Risk Appetite
      • Increased Competitive Advantage
      Current Environment
      • Business and IT Challenges
      • Opportunities
      • Enterprise Architecture Maturity

      Enterprise Architecture – Thought Model

      A thought model built around 'Enterprise Architecture', represented by a diagram on a cross-section of a ship which will be explained in the next slide. It begins with an arrow that says 'Organizational goals are the driving force and the ultimate goal' pointing to a bubble titled 'Organization' containing 'Analysis', 'Decisions', 'Actions'. An blue arrow on the right side with one '$' is labelled 'Iterations' and connects 'Organization' to 'Enterprise Architecture', 'Enterprise architecture creates new business value'. A green arrow on the left side with five '$' is labelled 'Goals' and connects back to 'Organization'. A the bottom, a bubble titled 'External forces, pressures, trends, data, etc.' has a blue arrow on the right side with one '$' connecting back to 'Enterprise Architecture'. Another blue arrow representing an output is labelled 'Outcomes' and originates from 'Enterprise Architecture'.

      Enterprise Architecture Capabilities

      A diagram on a cross-section of a ship representing 'Enterprise Architecture', including a row of process arrows beneath the ship pointing forward all labelled 'Agile iteration' and one airborne arrow above the stern pointing forward labelled 'Business Strategy'. Overlaid on the ship, starting at the back, are 'EA Strategy', 'EA Operating Model', 'Enterprise Principles, Methods, etc.', 'Foundational enterprise decisions: Business, Data/Apps, Technology, Integration, Security', 'Enterprise Reference Architecture', 'Goals, Value Chain, Capability, Business Processes', 'Enterprise Governance (e.g., Standard Mgmt.)', 'Domain Arch', 'Data & App Architecture', 'Security Architecture', 'Infrastructure: Cloud, Hybrid, etc.', at the very front is 'Implementation', and running along the bottom from back to front is 'Operations, Monitoring, and Continuous Improvement'.

      Analyst Perspective

      Enterprise architecture (EA) needs to be right-sized for the needs of the organization.

      Photo of Milena Litoiu, Principal/Senior Director, Enterprise Architecture, Info-Tech Research Group

      Enterprise architecture is NOT a one-size-fits-all endeavor. It needs to be right-sized to the needs of the organization.

      Enterprise architects are boots on the ground and part of the solution; in addition, they need to have a good understanding of the corporate strategy, vision, and goals and have a vested interest on the optimization of the outcomes for the enterprise. They also need to anticipate the moves ahead, to be able to determine future trends and how they will impact the enterprise.

      Milena Litoiu
      Principal/Senior Director, Enterprise Architecture
      Info-Tech Research Group

      Analyst Perspective

      EA provides business options based on a deep understanding of the organization.

      “Enterprise architects need to think about and consider different areas of expertise when formulating potential business options. By understanding the context, the puzzle pieces can combine to create a positive business outcome that aligns with the organization’s strategies. Sometimes there will be missing pieces; leveraging what you know to create an outline of the pieces and collaborating with others can provide a general direction.”

      Jean Bujold
      Senior Workshop Delivery Director
      Info-Tech Research Group

      “The role of enterprise architecture is to eliminate misalignment between the business and IT and create value for the organization.”

      Reddy Doddipalli
      Senior Workshop Director, Research
      Info-Tech Research Group

      “Every transformation journey is an opportunity to learn: ‘Tell me and I forget. Teach me and I remember. Involve me and I learn.’ Benjamin Franklin.”

      Graham Smith
      Senior Lead Enterprise Architect and Independent Consultant

      Develop an enterprise architecture strategy that:

      • Helps the organization make decisions that are hard to change in a complex environment.
      • Fits the current organization’s maturity and remains flexible and adaptable to unforeseen future changes.

      Executive Summary

      Your Challenge

      We need to make decisions today for an unknown future. Decisions are influenced by:

      • Changes in the environment you operate in.
      • Complexity of both the business and IT landscapes.
      • IT’s difficulty in keeping up with business demands and remaining agile.
      • Program/project delivery pressure and long-term planning needs.
      • Other internal and external factors affecting your enterprise.

      Common Obstacles

      Decisions are often made:

      • Without a clear understanding of the business goals.
      • Without a holistic understanding; sometimes in conflict with one another.
      • That hinder the continuity of the organization.
      • That prevent value optimization at the enterprise level.

      The more complex an organization, the more players involved, the more difficult it is to overcome these obstacles.

      Info-Tech’s Approach

      • Is a holistic, top-down approach, from the business goals all the way to implementation.
      • Has EA act as the canary in the coal mine. EA will identify and mitigate risks in the organization.
      • Enables EA to provide an essential service rather than be an isolated kingdom or an ivory tower.
      • Acknowledges that EA is a balancing act among competing demands.
      • Makes decisions using guiding principles and guardrails, to create a flexible architecture that can evolve and expand, enabling enterprise agility.

      Info-Tech Insight

      There is no “right architecture” for organizations of all sizes, maturities, and cultural contexts. The value of enterprise architecture can only be measured against the business goals of a single organization. Enterprise architecture needs to be right-sized for your organization.

      Info-Tech insight summary on arch. agility

      Continuous innovation is of paramount importance in achieving and maintaining competitive advantage in the marketplace.

      Business engagement

      It is important to trace architectural decisions to business goals. As business goals evolve, architecture should evolve as well.

      As new business input is provided during Agile cycles, architecture is continuously evolving.

      EA fundamentals

      EA fundamentals will shape how enterprise architects think and act, how they engage with the organization, what decisions they make, etc.

      Start small and lean and evolve as needed.

      Continuously align strategy with delivery and operations.

      Architects should establish themselves as business partners as well as implementation/delivery leaders.

      Enterprise services

      Definitions of enterprise services should start from the business goals of the organization and the capabilities IT needs to perform for the organization to survive in the marketplace.

      Continuous delivery and continuous innovation are the two facets of architecture.

      Tactical insight

      Your current maturity should be reflected as a baseline in the strategy.

      Tactical insight

      Take Agile/opportunistic steps toward your strategic North star.

      Tactical insight

      EA services differ based on goals, maturity, and the Agile appetite of the enterprise.

      From the best industry experts

      “The trick to getting value from enterprise architecture is to commit to the long haul.”

      Jeanne W. Ross, MIT CISR
      Co-author of Enterprise Architecture as Strategy: Creating a Foundation for Business Execution,
      Harvard Business Press, 2006.

      Typical EA maturity stages

      A line chart that moves through multiple stages titled 'Enterprise Architecture Maturity Stages (MIT CISR)' The five stages of the chart, starting on the left, are 'Business Silos', 'Standardized Technology', 'Optimized Core', 'Business Componentization', and 'Digital Ecosystem'. 'The trick to getting value from enterprise architecture is to commit to the long haul.' The line begins at the bottom left of the chart and gradually creates a stretched S shape to the top right. Points along the line, respective to the aforementioned stages, are 'Locally Optimal Business Solutions', 'Technology Infrastructure Platform', 'Digitized Process Platform', 'Repository of Reusable Business Components', 'Components Connecting with Partners' Components', and at the end of the line, outside of the chart is 'Strategic Business Value from Technology'. Percentages along the bottom, respective to the aforementioned stages, read 20%, 36%, 45%, 7%, 2%. Percentages are rough approximations based on findings reported in Mocker, M., Ross, J.W., Beath, C.M., 'How Companies Use Digital Technologies to Enhance Customer Offerings--Summary of Survey Findings,' MIT CISR Working Paper No. 434, Feb. 2019. Copyright MIT, 2019.

      Enterprise Architecture maturity

      A maturity ladder visualization for 'Enterprise Architecture' with five color-coded levels. From the bottom up, the colors and designations are Red: 'Unstable', Orange: 'Firefighter', Yellow: 'Trusted Operator', Blue: 'Business Partner', and Green: 'Innovator'. Beside the visualization at the bottom it says 'EA is here', then an arrow in the direction of the top where it says 'EA needs to be here'.
      • Innovator – Transforms the Business
        Reliable Technology Innovation
      • Business Partner – Expands the Business
        Effective Use of Enterprise Architecture in all Business Projects, Enterprise Architecture Is Strategically Engaged
      • Trusted Operator – Optimizes the Business
        Enterprise Architecture Provides Business, Data, Application & Technology Architectures for All IT Projects
      • Firefighter – Supports the Business
        Reliable Architecture for Some Practices/Projects
      • Unstable – Struggles to Support
        Inability to Provide Reliable Architectures

      Info-Tech Insight

      There is no “absolute maturity” for organizations of all sizes, maturities, and cultural contexts. The maturity of enterprise architecture can only be measured against the business goals of the organization.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com1-888-670-8889

      Session 1 Session 2 Session 3 Session 4 Session 5
      Activities
      Identify organizational needs and landscape

      1.0 Interview stakeholders to identify business and technology needs

      1.1 Review organization perspective, including business needs, challenges, and strategic directions

      1.2 Conduct PESTLE analysis to identify business and technology trends

      1.3 Conduct SWOT analysis to identify business and technology internal perspective

      Create the EA value proposition

      2.1 Identify and prioritize EA stakeholders

      2.2 Create business and technology drivers from needs

      2.3 Define the EA value proposition

      2.4 Identify EA maturity and target

      Define the EA fundamentals

      3.1 Define the EA goals and objectives

      3.2 Determine EA scope

      3.3 Create a set of EA principles

      3.4. Define the need of a methodology/agility

      3.5 Create the EA vision and mission statement

      Identify the EA framework and communicate the EA strategy

      4.1 Define initial EA operating model and governance mechanism

      4.2 Define the activities and services the EA function will provide, derived from business goals

      4.3 Determine effectiveness measures

      4.4 Create EA roadmap and next steps

      4.5 Build communication plan for stakeholders

      Next Steps and Wrap-Up (offsite)

      5.1 Generate workshop report

      5.2 Set up review time for workshop report and to discuss next steps

      Outcomes
      1. Stakeholder insights
      2. Organizational needs, challenges, and direction summary
      3. PESTLE & SWOT analysis
      1. Stakeholder power map
      2. List of business and technology drivers with associated pains
      3. Set of EA contributions articulating the promises of value in the EA value proposition
      4. EA maturity assessment
      1. EA scope
      2. List of EA principles
      3. EA vision statement
      4. EA mission statement
      5. Statement about role of enterprise architect relative to agility
      1. EA capabilities mapped to business goals of the organization
      2. List of EA activities and services the EA function is committed to providing
      3. KPI definitions
      4. EA roadmap
      5. EA communication plan
      1. Completed workshop report on EA strategy with roadmap, recommendations, and outcomes from workshop

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      While variations depend on the maturity of the organization as well as its aspirations, these are some typical steps:

        Phase 1

      • Call #1: Explore the role of EA in your organization.
      • Phase 2

      • Call #2: Identify and prioritize stakeholders.
      • Call #3: Use a PESTLE analysis to identify business and technology needs.
      • Call #4: Prepare for stakeholder interviews.
      • Call #5: Discuss your EA value proposition.
      • Phase 3

      • Call #5: Understand the importance of EA fundamentals.
      • Call #6: Define the relevant EA services and their contributions to the organization.
      • Call #7: Measure EA effectiveness.
      • Phase 4

      • Call #8: Build your EA roadmap and communication plan.
      • Call #9: Discuss the EA role relative to agility.
      • Call #10: Summarize results and plan next steps.

      Design an Enterprise Architecture Strategy

      Phase 1

      Explore the Role of Enterprise Architecture

      Phase 1

      • 1.1 Explore a general EA strategy approach
      • 1.2 Introduce Agile EA architecture

      Phase 2

      • 2.1 Define the business and technology drivers
      • 2.2 Define your value proposition

      Phase 3

      • 3.1 Realize the importance of EA fundamentals
      • 3.2 Finalize the EA fundamentals

      Phase 4

      • 4.1 Select relevant EA services
      • 4.2 Finalize the set of services and secure approval

      This phase will walk you through the following activities:

      Define the role of the group and different roles inside the enterprise architecture competency.

      This phase involves the following participants:

      • CIO
      • IT Leaders
      • Business Leaders

      Enterprise architecture optimizes the outcomes of the entire organization

      Corporate Strategy –› Enterprise Architecture Strategy

      Info-Tech Insight

      Enterprise architecture needs to have input from the corporate strategy of the organization. Similarly, EA governance needs to be informed by corporate governance. If this is not the case, it is like planning and governing with your eyes closed.

      Existing EA functions vary in the value they achieve due to their level of maturity

      EA Functions
      Operationalized
      • EA function is operationalized and operates as an effective core function.
      • Effectively aligns the business and IT through governance, communication, and engagement.
      –––› Common EA value
      Decreased cost Reduced risk
      Emerging
      • Emerging but limited ad hoc EA function.
      • Limited by lack of alignment to the business and IT.
      –x–› Cut through complexity Increased agility
      (Source: Booz & Co., 2009)

      Benefits of enterprise architecture

      1. Focuses on business outcomes (business centricity)
      2. Provides traceability of architectural decisions to/from business goals
      3. Provides ways to measure results
      4. Provides consistency across different lines of business: establishes a common vocabulary, reducing inconsistencies
      5. Reduces duplications, creating additional efficiencies at the enterprise level
      6. Presents an actionable migration to the strategy/vision, through short-term milestones/steps

      Benefits of enterprise architecture continued

      1. Done right, increases agility
      2. Done right, reduces costs
      3. Done right, mitigates risks
      4. Done right, stimulates innovation
      5. Done right, helps achieve the stated business goals (e.g. customer satisfaction) and improves the enterprise agility.
      6. Done right, enhances competitive advantage of the enterprise

      Qualities of a well-established and practical enterprise architecture

      1. Objective
      2. Impartial
      3. Credible
      4. Practical
      5. Measurable
      6. (Source: University of Toronto, 2021)

      Role of the enterprise architecture

      • Primarily to set up guardrails for the enterprise, so Agile teams work independently in a safe, ready-to-integrate environment
      • Establish strategy
      • Establish priorities
      • Continuously innovate
      • Establish enterprise standards and enterprise guardrails to guide Solution/Domain/Portfolio Architectures
      • Align with and be informed by the organization’s direction

      Members of the Architecture Board:

      • Chief (Business) Strategist
      • Lead Enterprise Architect
      • Business SME from each major domain
      • IT SME from each major domain
      • Operational & Infrastructure SME
      • Security & Risk Officer
      • Process Management
      • Other relevant stakeholders

      For enterprise architecture to contribute, EA must address the organizational vision and goals

      External Factors –› Layers of a Business Model
      (Organization)
      –› Architecture Supported Transformation
      Industry Changes Business Strategy
      Competition Value Streams
      (Business Outcomes)
      Regulatory Impacts Business Capability Maps
      • Security
      Workforce Impacts Execution
      • Policies
      • Processes
      • People
      • Information
      • Applications
      • Technology

      Info-Tech Insight

      External forces can affect the organization as a whole; they need to be included as part of the holistic approach for enterprise architecture.

      How does EA provide value?

      Business and Technology Drivers – A set of statements created from business and technology needs. Gathered from information sources, it communicates improvements needed.

      • Vision, Aspirations, Long-Term Goals – Vision, aspirations, long term goals

        • EA Contributions – EA contributions that will alleviate obstructions. Removing the obstructions will allow EA to help satisfy business and technology needs.

          • Promise of Value – A statement that depicts a concrete benefit that the EA practice can provide for the organization in response to business and technology drivers.

      Info-Tech Insight

      Enterprise architecture needs to create and be part of a culture where decisions are made through collaboration while focusing on enterprise-wide efficiencies (e.g. reduced duplication, reusability, enterprise-wide cost minimization, overall security, comprehensive risk mitigation, and any other cross-cutting concerns) to optimize corporate business goals.

      The EA function scope is influenced by the EA value proposition and previously developed EA fundamentals

      Establish the EA function scope by using the EA value proposition and EA fundamentals that have already been developed. After defining the EA function scope, refer back to these statements to ensure it accurately reflects the EA value proposition and EA fundamentals.

      EA value proposition

      +

      EA vision statement
      EA mission statement
      EA goals and objectives

      —›
      Influences

      Organizational coverage

      Architectural domains

      Depth

      Time horizon

      —›
      Defines
      EA function scope

      EA team characteristics

      Create the optimal EA strategy by including personnel who understand a broad set of topics in the organization

      The team assembled to create the EA strategy will be defined as the “EA strategy creation team” in this blueprint.

      • Someone who has been in the organization for a long time and has built strong relationships with key stakeholders. This individual can exert influence and become the EA strategy sponsor.
      • An individual who understands how the different technology components in the organization support its business operations.
      • Someone in the organization who can communicate IT concepts to business managers in a language the business understands.
      • An individual with a strategy background or perspective on the organization. This individual will understand where the organization is headed.
      • Any individuals who feel an acute pain as a result of poorly made investment decisions. They can be champions of EA strategy in their respective functions.

      EA skills and competencies

      Apart from business know-how, the EA team should have the following skills

      • Architectural thinking
      • Analytical
      • Trusted, credible
      • Can handle complexity
      • Can change perspectives
      • Can learn fast (business and technology)
      • Independent and steadfast
      • Not afraid to go against the stream
      • Able to understand problems of others with empathy
      • Able to estimate scaling on design decisions such as model patterns
      • Intrinsic capability to identify where relevant details are
      • Able to identify root causes quickly
      • Able to communicate complex issues clearly
      • Able to negotiate and come up with acceptable solutions
      • Can model well
      • Able to change perspectives (from business to implementation and operational perspectives).

      Use of enterprise architecture methodologies

      Balance EA methodologies with Agile approaches

      Using an enterprise architecture methodology is a good starting point to achieving a common understanding of what that is. Often, organizations agree to "tailor" methodologies to their needs.

      The use of lean/Agile approaches will increase efficiency beyond traditional methodologies.

      Use of EA methodologies vs. Agile methods

      When to use what?

      • Use an existing methodology to structure your thinking and establish a common vocabulary to communicate basic concepts, processes, and approaches.
      • Customize the methodology to your needs; make it as lean as possible.
      • Execute in an Agile way, but keep in mind the thoughtful checks recommended by your end-to-end methodology.
      • Clarify goals.
      • Have good measures and metrics in place.
      • Continuously monitor progress, fit for purpose, etc.
      • Highlight risks, roadblocks, etc.
      • Get support.
      • Communicate vision, goals, key decisions, etc.
      • Iterate.

      Business strategy first, EA strategy second, and EA operating model third

      Corporate Strategy
      “Why does our enterprise exist in the market?”
      EA Strategy
      “What does EA need to be and do to support the enterprise’s ability to meet its goals? What is EA’s value proposition?”
      Business & IT Operating Culture
      “How does the organization’s culture and structure influence the EA operating model?”
      EA Operating Model
      How does EA need to operate on a daily basis to deliver the value proposition?”

      High-level perspective

      Creating an effective practice involves many moving parts.

      A visual of the many moving parts in an effective practice; there are 6 smaller circles in a large circle, an input arrow labelled 'Environment', an output arrow labelled 'Results', and a thin arrow connecting 'Results' back to 'Environment'. Of the circles, 'Leadership' is in the center, connected to each of the others, while 'Culture', 'Strategy', 'Core Processes', 'Structure', and 'Systems' create a cycle. (Source: The Center for Organizational Design)

      • Environment. Influences that are external to the organization, such as customer perceptions, changing needs, and changes in technology, and the organization’s ability to adjust to them.
      • Strategy. The business strategy defines how the organization adds value and acts as the rudder to direct the organization. Organizational strategy defines the character of the organization, what it wants to be, its values, its vision, its mission, etc.
      • Core Process. The flow of work through the organization.
      • Structure. How people are organized around business processes. Includes reporting structures, boundaries, roles, and responsibilities. The structure should assist the organization with achieving its goals rather than hinder its performance.
      • Systems. Interrelated sets of tasks or activities that help organize and coordinate work.
      • Culture. The personality of the organization: its leadership style, attitudes, habits, and management practices. Culture measures how well philosophy is translated into practice.
      • Results. Measurement of how well the organization achieved its goals.
      • Leadership. Brings the organization together by providing vision and strategy; designing, monitoring, and nurturing the culture; and fostering agility.

      The answer to the strategic planning entity dilemma is enterprise architecture

      Enterprise architecture is a discipline that defines the structure and operation of an organization. The intent of enterprise architecture is to determine how an organization can most effectively achieve its current and future objectives.

      Vision, goals, and aspirations as well internal and external pressures

      Business current state

      • Existing capability
      • Existing capability
      • Existing capability
      • Existing capability
      • Existing capability
      Enterprise Architecture

      IT current state

      • IT asset management
      • Database services
      • Application development

      Business target state

      • Existing capability
      • Existing capability
      • Existing capability
      • Existing capability
      • Existing capability
      • New capability

      IT target state

      • IT asset management
      • Database services
      • Application development
      • Business analytics
      Complex, overlapping, contradictory world of humans vs. logical binary world of IT
      EA is a planning tool to help achieve the corporate business goals

      EA spans across all the domains of architecture

      Business architecture is the cornerstone that sets the foundation for all other architectural domains: security, data, application, and technology.

      A flow-like diagram titled 'Enterprise Architecture' beginning with 'Digital Architecture' and 'Business Architecture', which feeds into 'Security Architecture', which feeds into both 'Data Architecture' and 'Application Architecture', which both feed into 'Technology Architecture: Infrastructure'.

      “An enterprise architecture practice is both difficult and costly to set up. It is normally built around a process of peer review and involves the time and talent of the strategic technical leadership of an enterprise.” (The Open Group Architecture Framework, 2018)

      Enterprise architecture deployment continuum

      A diagram visualizing the Enterprise architecture deployment continuum with two continuums, 'Level of Embedding' and 'EA Value', assigning terms to EA deployments based on where they fall. On the left is an 'Ivory Tower' configuration: EA' is separated from the 'BU's but is still controlling them. Level of Embedding: 'Centralized', EA Value: 'Dictatorship'. In the center is a 'Balanced' configuration: 'EA' is spread across and connected to each 'BU'. Level of Embedding: 'Federated', EA Value: 'Democracy'. On the right is a 'Siloed' configuration: Each 'BU' has its own separate 'EA'. Level of Embedding: 'Decentralized', EA Value: 'Abdication of enterprise role'.

      Info-Tech Insight

      The primary question during the design of the EA operating model is how to integrate the EA function with the rest of the business.

      If the EA practice functions on its own, you end up with ivory tower syndrome and a dictatorship.

      If you totally embed the EA function within business units it will become siloed with no enterprise value.

      Organizations need to balance consistency at the enterprise level with creativity from the grass roots.

      Enterprise vs. Program/Portfolio/Domain

      Enterprise vs. Program/Portfolio/Domain. Image depicts where Enterprise Scope overlaps Program/Portfolio Scope. Enterprise Scope includes Business Architecture. Program/Portfolio Scope includes Business Requirements, Business Process, and Solutions Architecture. Overlap between scope includes Technology Architecture, Data Architecture, and Applications Architecture.

      Info-Tech Insight

      Decisions at the enterprise level apply across multiple programs/portfolios/solutions and represent the guardrails set for all to play within.

      Decide on the degree of centralization

      Larger organizations with multiple domains/divisions or business units will need to decide which architecture functions will be centralized and which, if any, will be decentralized as they plan to scope their EA program. What are the core functions to be centralized for the EA to deliver the greatest benefits?

      Typically, we see a need to have a centralized repository of reusable assets and standards across the organization, while other approaches/standards can operate locally.

      Centralization

      • Allows for more strategic planning
      • Visibility into standards and assets across the organization promotes rationalization and cost savings
      • Ensures enterprise-wide assets are used
      • More strategic sourcing of vendors and resellers
      • Can centrally negotiate pricing for better deals
      • Easier to manage risk and prepare for audits
      • Greater coordination of resources
      • Derives benefits from enterprise decisions, e.g. integration…

      Decentralization

      • May allow for more innovation
      • May be easier to demonstrate local compliance if the organization is geographically decentralized
      • May be easier to procure software if offices are in different countries
      • Deployment and installation of software on user devices may be easier

      EA strategy

      What is the role of enterprise architecture vis-à-vis business goals?

      • What needs to be done?
      • Who needs to be involved?
      • When?
      • Where?
      • Why?
      • How?

      Top-down approach starting from the goals of the organization

        What the Business Sees...
      • Business Goals
        • Value Streams
            What the CxO Sees...
          • Capabilities
              What the App Managers See...
            • Processes
              • Applications
                  What the Program Managers See...
                • Programs/Projects

      Info-Tech Insight

      Being able to answer the deceptively simple question “How am I doing?” requires traceability to and from the business goals to be achieved all the way to applications, to infrastructure, and ultimately, to the funded initiatives (portfolios, programs, projects, etc.).

      Measure EA strategy effectiveness by tracking the benefits it provides to the corporate business goals

      The success of the EA function spans across three main dimensions:

      1. The delivery of EA-enabled business outcomes that are most important to the enterprise.
      2. The alignment between the business and the technology from a planning perspective.
      3. Improvements in the corporate business goals due to EA contributions (standardization, rationalization, reuse, etc.).

      Corporate Business Goals

      • Reduction in operating costs
      • Decreased regulatory compliance infractions
      • Increased revenue from existing channels
      • Increased revenue from new channels
      • Faster time to business value
      • Improved business agility
      • Reduction in enterprise risk exposure

      EA Contributions

      • Alignment of IT investments to business strategy
      • Achievement of business results directly linked to IT involvement
      • Application and platform rationalization
      • Standards in place
      • Flexible architecture
      • Better integration
      • Higher organizational satisfaction with technology-enabled services and solutions

      Measurements

      • Cost reductions based on application and platform rationalization
      • Time and cost reductions due to standardization
      • Time reduction for integration
      • Service reused
      • Stakeholder satisfaction with EA services
      • Increase in customer satisfaction
      • Rework minimized
      • Lower cost of integration
      • Risk reduction
      • Faster time to market
      • Better scalability, etc.

      Info-Tech Insight

      Organizations must create clear and smart KPIs (key performance indicators) across the board.

      From corporate strategy to enterprise architecture

      A model connecting 'Enterprise Architecture' with 'Corporate Strategy' through 'EA Services' and 'EA Strategy'.

      Info-Tech Insight

      In the absence of a corporate strategy, enterprise architecture is missing its North Star.

      However, enterprise architects can partner with the business strategists to build the needed vision.

      Traceability to and from business corporate business goals to EA contributions (sample)

      A model connecting 'Enterprise Architecture' with 'Corporate Goals' through 'EA Contributions'.

      Enterprise architecture journey

      The enterprise architecture journey, from left to right: 'Business Goals' and 'EA Maturity Assessment', 'EA Strategy', 'Industry-Specific Capability Model' and 'Customized to the Organization's Needs', 'EA Operating Model' and 'EA Governance', 'Business Architecture' and 'EA Tooling', 'Data Architecture' and 'Application Architecture', 'Infrastructure Architecture'.

      Agile architecture principles

      Agile architecture principles:
      • Fast learning cycle
      • Explore alternatives
      • Create environment for decentralized ideation and innovation

      According to the Scaled Agile Framework, three of the most applicable principles for the architectural professions refer to the following:

      1. "Fast learning cycle" refers to learning cycles that allow for quick reiterations as well as the opportunity to fail fast to learn fast.
      2. "Explore alternatives" refers to the exploration phase and also to the need to make tough decisions and balance competing demands.
      3. "Create environment for decentralized ideation and innovation" ensures that no one has a monopoly on innovation. Moreover, EA needs to invite ideas from various stakeholders (from the business to operations as well as implementers, etc.).

      Architecture roles in lean enterprises

      Typical architecture roles in modern/Agile lean enterprises

      • System Architect
      • Solution Architect
      • Enterprise Architect

      Depth vs. strategy focus

      Typical architect roles

      A graph with different architect roles mapped onto it. Axes are 'Low Strategic Impact' to 'High Strategic Impact' and 'Breadth' to 'Depth'. 'Enterprise Architect' has the highest strategic impact and most breadth. 'Technical/System Architect' has the lowest strategic impact and most depth. 'Solution Architect' sits in the middle of both axes.

      Architecture roles continued

      The three architect roles from above and their impacts on the list of 'Common Domains' to the right. 'Enterprise Architect's impact is 'Across Value Streams', 'Solution Architect's impact is 'Across Systems', 'Technical/System Architect's impact is 'Single System'. Adapted from Scaled Agile.

      Common Domains

      Business Architecture

      Information Architecture

      Application Architecture

      Technical Architecture

      Integration Architecture

      Security Architecture

      Others

      Info-Tech Insight

      All architects are boots on the ground and play in the solutioning space. What differs is their decisions’ impact (the enterprise architect’s decisions affects all domains and solutions).

      SAFe definitions of the Enterprise/Solution and System Architect roles can be found here.

      The role of the Enterprise Architect is detailed here.

      Collaboration models across the enterprise

      A collaboration model with 'Enterprise Architecture' at the top consisting of a 'Chief Enterprise Architect', 'Enterprise Architects', and 'EA Concerns across solutions': 'Architect A', 'Architect B', and 'Architect C'. Each lettered Architect is connected to their respective 'Solution Architect (A-C)' which runs their respective 'Delivery Team (A-C)' with 'Other Team Members'.(Adapted from Disciplined Agile)

      There are both formal and informal collaborations between enterprise architects and solution architects across the enterprise.

      Info-Tech Insight

      Enterprise architects should collaborate with solutions architects to create the best solutions at the enterprise level and to provide guidance across the board.

      Architect roles in SAFe

      According to Scale Agile Framework 5 for Lean Enterprises:

      • The system architect participates in the Essential SAFe
      • Solution architects and system architects participate in Large Solution
      • The enterprise architect participates in the Portfolio SAFe
      • Enterprise, solution, and system architects are all involved in Full SAFe

      Please check the SAFe Scaled Agile site for detailed information on the approach.

      Architect roles and their participation in Agile events (see likely events and a typical calendar)

      Info-Tech Insight

      A clear commitment for architects to achieve and support agility is needed. Architects should not be in an ivory tower; they should be hands on and engaged in all relevant Agile ceremonies, like the pre- and post-program increment (PI) planning, etc.

      Architect syncs are also required to ensure the needed collaboration.

      Architect participation in Agile ceremonies, according to SAFe:

      Architecture runway (at scale)

      Info-Tech Insight

      Architecting for scale, modularity, and extensibility is key for the architecture to adapt to changing conditions and evolve.

      Proactively address NFRs; architect for performance and security.

      Continuously refine the solution intent.

      For large solutions, longer foundational architectural runways are needed.

      Having an intentional continuous improvement/continuous development (CI/CD) pipeline to continuously release, test, and monitor is key to evolving large and complex systems.

      Parallel continuous exploration/integration/deployment

      A cycle titled DevOps containing three smaller cycles labelled 'Continuous Explorations', 'Continuous Integration', and 'Continuous Deployment'.

      Info-Tech Insight

      Architects need to help make some fundamental decisions, e.g. help define the environment that best supports continuous innovation or exploration and continuous integration, deployment, and delivery.

      Typical strategic enterprise architecture involvement

      Enterprise Architect —DRIVES–› Enterprise Architecture Strategy

      Enterprise Architecture Strategy
      • Application Strategy
      • Business Strategy
      • Data Strategy
      • Implementation Strategy
      • Infrastructure Strategy
      • Inter-domain Collaboration
      • Integration Strategy
      • Operations Strategy
      • Security Strategy
      • (Adapted from Scaled Agile)

      The EA statement relative to agility

      The enterprise architecture statement relative to agility specifies the architects’ responsibilities as well as the Agile protocols they will participate in. This statement will guide every architect’s participation in planning meetings, pre- and post-PI, various syncs, etc. Use simple and concise terminology; speak loudly and clearly.

      Strong EA statement relative to agility has the following characteristics:

      • Describes what different architect roles do to achieve the vision of the organization
      • In an agile way
      • Compelling
      • Easy to grasp
      • Sharply focused
      • Specific
      • Concise

      Sample EA statement relative to agility

      • Create strategies that provide guardrails for the organization, provide standards, reusable assets, accelerators, and other decisions at the enterprise level that support agility.
      • Participate in pre-PI and post-PI planning activities, architect syncs, etc.

      A clear statement can include additional details surrounding the enterprise architect’s role relative to agility

      Below is a sample of connecting keywords to form an enterprise architect role statement, relative to agility.

      Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture in an agile way.

      Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.

      Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.

      Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.

      Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture and provide guidance and accelerators.

      Target enterprise structure in an agile way – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:

      • Business capabilities and processes (business architecture)
      • Data, application, and technology assets that enable business capabilities and processes (technology architecture)
      • Architecture principles
      • Standards and reusable assets
      • Continuous exploration, integration, and deployment

      Traditional vs. Agile approaches

      Traditional Enterprise Architecture Next-Generation Enterprise Architecture
      Scope: Technology focused Business transformation (scope includes both business and technology)
      Bottom up Top down
      Inside out Outside In
      Point to point; difficult to change Expandable, extensible, evolvable
      Control-based: Governance intensive; often over-centralized Guidance-based: Collaboration and partnership-driven based on accepted guardrails
      Big up-front planning Incremental/dynamic planning; frequent changes
      Functional siloes and isolated projects, programs, and portfolios Enterprise-driven outcome optimization (across value streams)

      Info-Tech Insight

      The role of the architecture in Lean (Agile) approaches is to set up the needed guardrails and ensure a safe environment where everyone can be effective and creative.

      Design an Enterprise Architecture Strategy

      Phase 2

      Create the EA Value Proposition

      Phase 1

      • 1.1 Explore a general EA strategy approach
      • 1.2 Introduce Agile EA architecture

      Phase 2

      • 2.1 Define the business and technology drivers
      • 2.2 Define your value proposition

      Phase 3

      • 3.1 Realize the importance of EA fundamentals
      • 3.2 Finalize the EA fundamentals

      Phase 4

      • 4.1 Select relevant EA services
      • 4.2 Finalize the set of services and secure approval

      This phase will walk you through the following activities:

      • Identify and prioritize EA stakeholders.
      • Create business and technology drivers from stakeholder information.
      • Identify business pains and technology drivers.
      • Define EA contributions to alleviate the pains.
      • Create promises of value to fully articulate the value proposition.

      This phase involves the following participants:

      • CIO
      • IT Leaders
      • Business Leaders

      Step 2.1

      Define the Business and Technology Drivers

      Activities
      • 2.1.1 Use a stakeholder power map to identify and prioritize EA stakeholders
      • 2.1.2 Conduct a PESTLE analysis
      • 2.1.3 Review strategic planning documents
      • 2.1.4 Conduct EA stakeholder interviews

      This step will walk you through the following activities:

      • Learn the five-step process to create an EA value proposition.
      • Uncover business and technology needs from stakeholders.

      This step involves the following participants:

      • CIO
      • IT Leaders
      • Business Leaders

      Outcomes of this step

      An understanding of your organization’s EA needs.

      Create the Value Proposition

      Step 2.1 Step 2.2

      Value proposition is an important step in the creation of the EA strategy

      Creating an EA value proposition should be the first step to realizing a healthy EA function. The EA value proposition demonstrates to organizational stakeholders the importance of EA in helping to realize their needs.

      Five steps towards the successful articulation of EA value proposition:

      1. Identify and prioritize stakeholders. The EA function must know to whom to communicate the value proposition.
      2. Construct business and technology drivers. Drivers are derived from the needs of the business and IT. Needs come from the analysis of external factors, strategic documents, and interviewing stakeholders. Helping stakeholders and the organization realize their needs demonstrates the value of EA.
      3. Discover pains that prevent driver realization. There are always challenges that obstruct drivers of the organization. Find out what they are to get closer to showing the value of EA.
      4. Brainstorm EA contributions. Pains that obstruct drivers have now been identified. To demonstrate EA’s value, think about how EA can help to alleviate those pains. Create statements that show how EA’s contribution will be able to overcome the pain to show the value of EA.
      5. Derive promises of value. Complete the articulation of value for the EA value proposition by stating how realizing the business or technology will provide in terms of value for the organization. Speak with the stakeholders to discover the value that can be achieved.

      Info-Tech Insight

      EA can deliver many benefits to an organization. To increase the likelihood of success, each EA group needs to commit to delivering value to their organization based on the current operating environment and the desired direction of the enterprise. An EA value proposition will articulate the group’s promises of value to the enterprise.

      The foundation of an optimal EA value proposition is laid by defining the right stakeholders

      All stakeholders need to know how the EA function can help them. Provide the stakeholders with an understanding of the EA strategy’s impact on the business by involving them.

      A stakeholder map can be a powerful tool to help identify and prioritize stakeholders. A stakeholder map is a visual sketch of how various stakeholders interact with your organization, with each other, and with external audience segments.

      An example stakeholder map with the 'Key players' quadrant highlighted, it includes 'CEO', 'CIO', and the modified position of 'CFO' after being engaged.

      “Stakeholder management is critical to the success of every project in every organization I have ever worked with. By engaging the right people in the right way in your project, you can make a big difference to its success…and to your career.” (Rachel Thompson, MindTools)

      2.1.1 Use a stakeholder power map to identify and prioritize EA stakeholders

      2 hours

      Input: Expertise from the EA strategy creation team

      Output: An identified and prioritized set of stakeholders for the EA function to target

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      1. A stakeholder power map helps to visualize the importance of various stakeholders and their concerns so you can prioritize your time according to the most powerful and most impacted stakeholders.
      2. Evaluate each stakeholder in terms of power, Involvement, impact, and support.
        • Power: How much influence does the stakeholder have? Enough to drive the project forward or into the ground?
        • Involvement: How interested is the stakeholder? How involved is the stakeholder in the project already?
        • Impact: To what degree will the stakeholder be impacted? Will this significantly change how they do their job?
        • Support: Is the stakeholder a supporter of the project? Neutral? A resistor?
      3. Map each stakeholder to an area on the Power Map Template.
      4. Ask yourself if the power map looks accurate. Is there someone who has no involvement in EA strategy development but should?
      5. Some stakeholders may have influence over others. For example, a COO who highly values the opinion of the Director of Operations would be influenced by that director. Draw an arrow from one stakeholder to another to signify this relationship.

      Download the Stakeholder Power Map Template for more detailed instructions on completing this activity.

      Each stakeholder will have a set of needs that will influence the final EA value proposition

      All stakeholders will have a set of needs they would like to address. Take those needs and translate them into business and technology drivers. Drivers help clearly articulate to stakeholders, and the EA function, the stakeholder needs to be addressed.

      Business Driver

      Business drivers are internal or external business conditions, changing business capabilities, and changing market trends that impact the way EA operates and provides value to the enterprise.

      Examples:

      Ensure corporate compliance with legislation pertaining to data and security (e.g. regulated oil fields).

      Enable the automation and digitization of internal processes and services to business stakeholders.

      Technology Driver

      Technology drivers are internal or external technology conditions or factors that are not within the control of the EA group that impact the way that the EA group operates and provides value to the enterprise.

      Examples:

      Establish standards and policies for enabling the organization to take advantage of cloud and mobile technologies.

      Reduce the frequency of shadow IT by lowering the propensity to make business–technology decisions in isolation.

      (Source: The Strategic CFO, 2013)

      Gather information from stakeholders to begin the process of distilling business and technology drivers

      Review information sources, then analyze them to derive business and technology drivers. Information sources are not targeted towards EA stakeholders. Analyze the information sources to create drivers that are relevant to EA stakeholders.

      Information Sources Drivers (Examples)

      PESTLE Analysis

      Strategy Documents

      Stakeholder Interviews

      SWOT Analysis

      —›

      Analysis

      —›

      Help the organization align technology investments with corporate strategy

      Ensure corporate compliance with legislation.

      Increase the organization’s speed to market.

      Business and Technology Needs

      By examining information sources, the EA team will come across a set of business and technology needs. Through analysis, these needs can be synthesized into drivers.

      The PESTLE analysis will help you uncover external factors impacting the organization

      PESTLE examines six perspectives for external factors that may impact business and technology needs. Below are prompting questions to facilitate a PESTLE analysis working session.

      Political
      • Will a change in government (at any level) affect your organization?
      • Do inter-government or trade relations affect you?
      • Are there shareholder needs or demands that must be considered?
      • How are your costs changing (moving off-shore, fluctuations in markets, etc.)?
      • Do currency fluctuations have an effect on your business?
      • Can you attract and pay for top-quality talent (e.g. desirable location, reasonable cost of living, changes to insurance requirements)?
      Economic
      Social
      • What are the demographics of your customers and/or employees?
      • What are the attitudes of your customers and/or staff (e.g. do they require social media, collaboration, transparency of costs)?
      • What is the general lifecycle of an employee (i.e. is there high turnover)?
      • Is there a market of qualified staff?
      • Is your business seasonal?
      • Do you require constant technology upgrades (e.g. faster network, new hardware)?
      • What is the appetite for innovation within your industry/business?
      • Are there demands for increasing data storage, quality, BI, etc.?
      • Are you looking to cloud technologies?
      • What is the stance on bring your own device?
      • Are you required to do a significant amount of development work in-house?
      Technological
      Legal
      • Are there changes to trade laws?
      • Are there changes to regulatory requirements (i.e. data storage policies, privacy policies)?
      • Are there union factors that must be considered?
      • Is there a push towards being environmentally friendly?
      • Does the weather have any effect on your business (hurricanes, flooding, etc.)?
      Environmental

      2.1.2 Conduct a PESTLE analysis

      2 hours

      Input: Expertise from EA strategy creation team

      Output: Identified set of business and technology needs from PESTLE

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      1. Begin conducting the PESTLE analysis by breaking the participants into groups. Divide the six different perspectives amongst the groups.
      2. Ask each group to begin to derive business and technology needs from their assigned perspectives. Use some of the areas noted below along with the questions on the previous slide to derive business and technology needs.
        • Political: Examine taxes, environmental regulations, and zoning restrictions.
        • Economic: Examine interest rates, inflation rate, exchange rates, the financial and stock markets, and the job market.
        • Social: Examine gender, race, age, income, disabilities, educational attainment, employment status, and religion.
        • Technological: Examine servers, computers, networks, software, database technologies, wireless capabilities, and availability of Software as a Service.
        • Legal: Examine trade laws, labor laws, environmental laws, and privacy laws.
        • Environmental: Examine green initiatives, ethical issues, weather patterns, and pollution.
      3. Ask each group to take into account the following questions when deriving business and technology needs:
        • Will business components require any changes to address the factor?
        • Will information technology components changes be needed to address any factor?
      4. Have each team record its findings. Have each team present its list and have remaining teams give feedback and additional suggestions. Record any changes in this step.

      Download the PESTLE Analysis Template to assist with completing this activity.

      Strategic planning documents can provide information regarding the direction of the organization

      Some organizations (and business units) create an authoritative strategy document. These documents contain corporate aspirations and outline initiatives, reorganizations, and shifts in strategy. From these documents, a set of business and technology needs can be generated.

      Overt Statements

      • Corporate objectives and initiatives are often explicitly stated in these documents. Look for statements that begin with phrases such as “Our corporate objectives are…”
      • Remember that different organizations use different terminology; if you cannot find the word goal or objective then look for “pillar,” “imperative,” “theme,” etc.

      Turn these statements to business and technology needs by:

      Asking the following:
      • Is there a need from a business perspective to address these objectives, initiatives, and shifts in strategy?
      • Is there a need from a technology perspective to address these objectives, initiatives, and shifts in strategy?

      Covert Statements

      • Some corporate objectives and initiatives will be mentioned in passing and will require clarification. For example: “As we continue to penetrate new markets, we will be diversifying our manufacturing geography to simplify distribution.”

      2.1.3 Review strategic planning documents

      2 hours

      Input: Strategic documents in the organization

      Output: Identified set of business and technology needs from documents

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin the identification process of business and technology needs from strategic documents with the following steps:

      1. Work with the EA strategy creation team to identify the strategic documents within the organization. Look for documents with any of the following content:
        • Corporate strategy document
        • Business unit strategy documents
        • Annual general reports
      2. Gather the strategic documents into one place and call a meeting with the EA strategy creation team to identify the business and technology needs in those documents.
      3. Pick one document and look through its contents. Look for future-looking words such as:
        • We will be…
        • We are planning to…
        • We will need…
      4. Consider those portions of the document with future-looking words and ask the following:
        • Will business components require any changes to address these objectives?
        • Will information technology components changes be needed to address these objectives?
      5. Record the business and technology needs identified in step 4. As well, record any questions you may have regarding the document contents for stakeholders to validate later.
      6. Move to the next document once complete. Complete steps 3-5 for the remaining strategy documents.

      Stakeholder interviews will help you collect primary data and will shed light on stakeholder priorities and challenges

      In this interview process, you will be asking EA stakeholders questions that uncover their business and technology needs. You will also be able to ask follow-up questions to get a better understanding of abstract or complex concepts from the strategy document review and PESTLE analysis.

      EA Stakeholders:

      • Stakeholders may not think of their business and technology needs. But stakeholders will often explicitly state their objectives and initiatives.
      • Objectives often result in risks, opportunities, and annoyances:
        • Risks: Potential damage associated with pursuing an objective or initiative.
        • Opportunities: Potential gains that could be leveraged when capturing objectives and initiatives.
        • Annoyances: Roadblocks that could hinder the pursuit of objectives and initiatives.
      • Ask stakeholders questions on these areas to discern their business and technology needs.

      Risks + Opportunities + Annoyances –› Business and Technology Needs

      2.1.4 Conduct EA stakeholder interviews

      4-8 hours

      Input: Expertise from the EA stakeholders

      Output: Business and technology needs for EA stakeholders

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team, Identified EA stakeholders

      1. Schedule an interview with each of the stakeholders that were identified as key stakeholders in the Stakeholder Power Map.
      2. Meet with the key EA stakeholders and start business and technology needs gathering. Schedule each identified key stakeholder for an interview.
      3. When a stakeholder arrives for their interview, ask the following questions and record the answers to help uncover needs. Be sure to record which stakeholder answered the question. Further, record any future stakeholders that agree.
        • What are the current strengths of your organization?
        • What are the current weaknesses of your organization?
        • What is the number 1 risk you need to prevent?
        • What is the number 1 opportunity you want to capitalize on?
        • What is the number 1 annoying pet peeve you want to remove?
        • How would you prioritize these risks, opportunities, and annoyances?
      4. Recorded answer example: “We can’t see what the other departments are doing; when we spend a lot of money to invest in something, we later find out the capability is already within the company.”
      5. After completing each interview, verify with each stakeholder that you have captured their business and technology needs. Continue the interview process until all identified key stakeholders have been interviewed.
      6. Capture all inputs into a SWOT (strengths, weaknesses, opportunities, and threats) format.

      Step 2.2

      Define Your Value Proposition

      Activities
      • 2.2.1 Create a set of business and technology drivers from business and technology needs
      • 2.2.2 Identify the pains associated with the business and technology drivers
      • 2.2.3 Identify the EA contributions that can address the pains
      • 2.2.4 Create promises of value to shape the EA value proposition

      This step will walk you through the following activities:

      • Use business and technology drivers to determine EA’s role in your organization.

      This step involves the following participants:

      • CIO
      • IT Leaders
      • Business Leaders

      Outcomes of this step

      A value proposition document that ties the value of the EA function to stakeholder needs.

      Create the EA Value Proposition

      Step 2.1 Step 2.2

      Synthesize the collected data into business and technology drivers

      Two triangles labelled 'Business needs' and 'Technology needs' point to a cloud labelled 'Analysis', which connects to the driver attributes on the right via a dotted line.

      There are several key attributes that a driver should have.

      Driver Key Attributes
      • A succinct statement.
      • Begins with “action words” to communicate a call to action (e.g. Support, Help, Enable).
      • Written in a language understood by all parties involved.
      • Communicates a need for improvement or prevention.

      “The greatest impact of enterprise architecture is the strategic impact. Put the mission and the needs of the organization first.” (Matthew Kern, Clear Government Solutions)

      2.2.1 Create a set of business and technology drivers from business and technology needs

      3 hours

      Input: Expertise from EA strategy creation team

      Output: A set of business and technology drivers

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team, EA stakeholders

      Meet with the EA strategy creation team and follow the steps below to begin the process of synthesizing the business and technology needs into drivers.

      1. Lay out the documented business and technology needs your team gathered from PESTLE analysis, strategy document reviews, and stakeholder interviews.
      2. Assess the documented business and technology needs to see if there are common themes. Consolidate those similar business and technology needs by crafting one driver for them. For example:
        • PESTLE: Influx of competitors in the marketplace causing tighter margins.
        • Document review: Improve investment quality and their value to the organization.
        • Stakeholder interview: “We can’t see what the other departments are doing; when we spend a lot of money to invest in something, we later find out the capability is already within the company.”
        • Consolidated business driver example: Help the organization align investments with the corporate strategy and departmental priorities.
      3. As well, synthesize the business and technology needs that cannot be consolidated.
      4. Verify the completed list of drivers with stakeholders. This is to ensure you have fully captured their needs.

      Download the EA Value Proposition Template to record your findings in this activity.

      When addressing business and technology drivers, an organization can expect obstacles

      A pain is an obstacle that business stakeholders will face when attempting to address business and technology drivers. Identify the pains associated with each driver so that EA’s contributions can be linked to resolving obstacles to address business needs.

      Business and Technology Drivers

      Pains

      Created by assessing information sources. A sentence that states the nature of the pain and how the pain stops the organization from addressing the drivers.
      Examples:
      • Business driver: Help the organization align investments with the corporate strategy and departmental priorities.
      • Technology driver: Improve the organization’s technology responsiveness and increase speed to market.
      Examples:
      • Business driver pains: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
      • Technology driver pains: Ineffective application development requiring delays decreases the speed to market.

      2.2.2 Identify the pains associated with the business and technology drivers

      2 hours

      Input: Expertise from EA strategy creation team and EA stakeholders

      Output: An associated pain that obstructs each identified driver

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team, EA stakeholders

      Call a meeting with the EA strategy creation team and any available stakeholders to identify the pains that obstruct addressing the business and technology drivers.

      Take each driver and ask the questions below to the EA strategy creation team and to any EA stakeholders who are available. Record the answers to identify the pains when realizing the drivers.

      1. What are your challenges in performing the activity or process today?
      2. What other business activities/processes will be impacted/improved if we solve this?
      3. What compliance/regulatory/policy concerns do we need to consider in any solution?
      4. What are the steps in the process/activity?

      Take the recorded answers and follow the steps below to create the pain statements:

      1. Answers to the questions above can be long, unfocused, or spoken in a casual manner. To turn the answer into pains, refine the recorded answers into a succinct sentence that captures its meaning.
        • Recorded answer example: “I feel like there needs to be a holistic view of the organization. If we had a tool to see all the capabilities across the business, then we can figure out what investments should be prioritized.”
        • Example of pain statement: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
      2. When the list of pains has been written out, verify with the stakeholders that you have fully captured their pains.

      Download the EA Value Proposition Template to record your findings in this activity.

      The identified pains can be alleviated by a set of EA contributions

      Set the foundations for the value proposition by brainstorming the EA contributions that can alleviate the pains.

      Business and technology drivers produce:

      Pains

      —›
      EA contributions produce:

      Value by alleviating pains

      Pains

      Obstructions to addressing business and technology drivers. Stakeholders will face these pains.

      Examples
      • Business driver pains: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
      EA contributions

      Activities the EA function can perform to help alleviate the pains. Demonstrates the contributions the EA function can make to business value.

      Examples:
      • Business driver EA contributions: Business capability mapping shows the business capabilities of the organization and the technology that supports those capabilities in the current and target state. This provides a view for the set of investments that are needed by the organization, which can then be prioritized.

      Enterprise architecture functions can provide a diverse set of contributions to any organization – Sample

      EA contribution category EA contribution details
      Define business capabilities and processes As-is and target business capabilities and processes are documented and understood by both IT and the business.
      Design information flows and services Information flows and services effectively support business capabilities and processes.
      Analyze gaps and identify project opportunities Create informed project identification, scope definition, and project portfolio management.
      Optimize technology assets Greater homogeneity and interoperability between tangible and intangible technology assets.
      Create and maintain technology standards Decrease development, integration, and support efforts. Reduce complexity and improve interoperability.
      Rationalize technology assets Tangible and intangible technology assets are rationalized to adequately and efficiently support information flows and services.

      2.2.3 Identify the EA contributions that can address the pains

      2 hours

      Input: Expertise from EA strategy creation team

      Output: EA contributions that addresses the pains that were identified

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Gather with the EA strategy creation team, take each pain, then ask and record the answers to the questions below to identify the EA contributions that would solve the pains:

      1. What activities can the EA practice conduct to overcome the pain?
      2. What are the core EA models that can help accurately define the problem and assist in finding appropriate resolutions?
      3. What are the general EA benefits that can be associated with solving this pain?

      Answers to the questions above will generate a list of activities EA can do to help alleviate the pains. Use the following steps to complete this activity:

      1. Create a stronger tie between the EA contributions and pains by linking the EA contribution statement to the pain.
        • Example of pain statement: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
        • Example of EA contributions statement: Business capability mapping shows the business capabilities of the organization and the technology that supports those capabilities in the current and target state. This provides a view for the set of investments that are needed by the organization, which can then be prioritized.
      2. Verify with the stakeholders that they understand the EA contributions have been written out and how those contributions address the pains.

      Download the EA Value Proposition Template to record your findings in this activity.

      EA promises of value articulate EA’s commitment to the organization

      • Business Goals and Technology Drivers
        A set of statements created from business and technology needs. Gathered from information sources, it communicates improvements needed.

        • Value Streams, Aspirations, Long-Term Goals
          Value streams, aspirations, long-term goals

          • EA Contributions
            EA contributions that will alleviate the obstructions. Removing the obstructions will allow EA to help satisfy business and technology needs.

            • Promise of Value
              A statement that depicts a concrete benefit the EA practice can provide for the organization in response to business and technology drivers.
              Communicate the statements in a language that stakeholders understand to complete the articulation of EA’s value proposition.

      2.2.4 Create promises of value to shape the EA value proposition

      2 hours

      Input: Expertise from EA strategy creation team and EA stakeholders

      Output: Promises of value for each business and technology driver

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team, EA stakeholders

      Now that the EA contributions have been identified, identify the promises of value to articulate the value proposition.

      Take each driver, then ask and record the answers to the questions below to identify the promises of value when realizing the drivers:

      1. What does amazing look like if we solve this perfectly?
      2. What other business activities/processes will be impacted/improved if we solve this?
      3. What measures of success/change should we use to prove value of the effort (KPIs/ROI)?

      Take the recorded answers and follow the steps below to create the promises of value.

      1. Answers to the questions above can be long, unfocused, or spoken in a casual manner. To turn the answer into a promise of value, refine the recorded answer into a succinct sentence that captures its meaning.
        • Business driver example: Help the organization align investments with the corporate strategy and departmental priorities.
        • Recorded answer example: “If this would be solved perfectly, we would have a very easy time planning investments and investment planning hours can be spent doing other activities.”
        • Promises of value example: Increase the number of investments that have a direct tie to corporate strategy.
      2. When the promises of value have been written out, verify with the stakeholders that you have fully captured their ideas.

      Download the EA Value Proposition Template to record your findings in this activity.

      Design an Enterprise Architecture Strategy

      Phase 3

      Build the EA Fundamentals

      Phase 1

      • 1.1 Explore a general EA strategy approach
      • 1.2 Introduce Agile EA architecture

      Phase 2

      • 2.1 Define the business and technology drivers
      • 2.2 Define your value proposition

      Phase 3

      • 3.1 Realize the importance of EA fundamentals
      • 3.2 Finalize the EA fundamentals

      Phase 4

      • 4.1 Select relevant EA services
      • 4.2 Finalize the set of services and secure approval

      This phase will walk you through the following activities:

      • Create an EA vision statement and an EA mission statement.
      • Create EA goals, define EA objectives, and link them to EA goals.
      • Define the EA function scope dimensions.
      • Create a set of EA principles for your organization.
      • Discuss current methodology.

      This phase involves the following participants:

      • CIO
      • EA Team
      • IT Leaders
      • Business Leaders

      Step 3.1

      Realize the Importance of EA Fundamentals

      Activities
      • 3.1.1 Create the EA vision statement
      • 3.1.2 Create the EA mission statement
      • 3.1.3 Create EA goals
      • 3.1.4 Define EA objectives and link them to EA goals
      • 3.1.5 Record the details of each EA objective

      This step will walk you through the following activities:

      • Define and document the fundamentals that guide the EA function.

      This step involves the following participants:

      • CIO
      • EA Team
      • IT Leaders
      • Business Leaders

      Outcomes of this step

      • Vision and mission statements for the EA function.
      • A set of EA goals and a set of objectives to track progression toward those goals.
      Build the EA Fundamentals
      Step 3.1 Step 3.2

      EA fundamentals guide the EA function

      EA fundamentals include a vision statement, a mission statement, goals and objectives, and principles. They are a set of documented statements that guide the EA function. The fundamentals guide the EA function in terms of its strategy and decision making.

      EA vision statement EA mission statement

      EA fundamentals

      EA goals and objectives EA principles

      Info-Tech Insight

      Treat the critical elements of the EA group the same way as you would a business. Create a directional foundation for EA and define the vision, mission, goals, principles, and scope necessary to deliver on the established value proposition.

      The EA vision statement articulates the aspirations of the EA function

      The enterprise architecture vision statement communicates a desired future state of the EA function. The statement is expressed in the present tense. It seeks to articulate the desired role of the EA function and how the EA function will be perceived.

      Strong EA vision statements have the following characteristics:

      • Describe a desired future
      • Focus on ends, not means
      • Communicate promise
      • Concise, no unnecessary words
      • Compelling
      • Achievable
      • Inspirational
      • Memorable

      Sample EA vision statements:

      • To be a trusted partner for both the business and IT, driving enterprise effectiveness, efficiency, and agility at [Company Name].
      • To be a trusted partner and advisor to both the business and IT, contributing to business-IT alignment and cost reduction at [Company Name].
      • To create distinctive value and accelerate [Company Name]’s transformation.

      The EA mission statement articulates the purpose of the EA function

      The enterprise architecture mission statement specifies the team’s purpose or “reason of being.” The mission should guide each day’s activities and decisions. The mission statements use simple and concise terminology, speak loudly and clearly, and generate enthusiasm for the organization.

      Strong EA mission statements have the following characteristics:

      • Articulates EA function purpose and reason for existence
      • Describes what the EA function does to achieve its vision
      • Defines who the customers of the EA function are
      • Compelling
      • Easy to grasp
      • Sharply focused
      • Inspirational
      • Memorable
      • Concise

      Sample EA mission statements:

      • Define target enterprise architecture for [Company Name], identify solution opportunities, inform IT investment management, and direct solution development, acquisition, and operation compliance.
      • Synergize with both the business and IT to define and help realize [Company Name]’s target enterprise architecture that enables the business strategy and optimizes IT assets, resources, and capabilities.

      The EA vision and mission statements become relevant to EA stakeholders when linked to the promises of value

      The process for constructing the enterprise architecture vision statement and enterprise architecture mission statement is articulated below.

      Promises of value Derive keywords Construct draft statements Reference test criteria Finalize statements
      Derive the a set of keywords from the promises of value to accurately capture their essence. Create the initial statement using the keywords. Check the initial statement against a set of test criteria to ensure their quality. Finalize the statement after referencing the initial statement against the test criteria.

      Derive keywords from promises of value to begin the vision and mission statement creation process

      Develop keywords by summarizing the promises of value that were derived from drivers into one word that will take on the essence of the promise. See examples below:

      Business and technology drivers Promises of value Keywords
      Help the organization align investments with the corporate strategy and departmental priorities. Increase the number of investments that have a direct tie to corporate strategy. Business
      Support the rapid growth and development of the company through fiscal planning, project planning, and technology sustainability. Ensure budgets and projects are delivered on time with the assistance of technology. IT-Enabled
      Reduce the duplication and work effort to build and deploy technology solutions across the entire organization. Aim to reduce the number of redundant applications in the organization to streamline processes and save costs. Catalyst
      Improve the organization’s technology responsiveness and increase speed to market. Reduce the number of days required in the SDLC for all core business support projects. Value delivery

      An inspirational vision statement is greater than the sum of the individual words

      Ensure the sentence is cohesive and captures additional value outside of the keywords. The statement as a whole should be greater than the sum of the parts. Expand upon the meaning of the words, if necessary, to communicate the value. Below is an example of a finished vision statement.

      Sample

      Be a catalyst for IT-enabled business value delivery.

      Catalyst – We will continuously interact with the business and IT to accelerate and improve results.

      IT-enabled – We will ensure the optimal use of technology in enabling business capabilities to achieve business objectives.

      Business – We will be perceived as a business-focused unit that understands [Company name]’s business priorities and required business capabilities.

      Value delivery – EA’s value will be recognized by both business and IT stakeholders. We will track and market EA’s contribution to business value organization-wide.

      A clear mission statement can include additional details surrounding the EA team’s desired and expected value

      Likewise, below is a sample of connecting keywords together to form an EA mission statement:

      Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture.

      Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.

      Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.

      Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.

      Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture.

      Target enterprise structure – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:

      • Business capabilities and processes (business architecture)
      • Data, application, and technology assets that enable business capabilities and processes (technology architecture)
      • Architecture principles and standards

      3.1.1 Create the EA vision statement

      1 hour

      Input: Identified promises of value, Vision statement test criteria

      Output: EA function vision statement

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin the creation of the EA vision statement by following the steps below:

      1. Gather the EA strategy creation team and have the promises of value from the EA value proposition laid out.
      2. Select one promise of value and work with the team to identify one word that captures the essence of that promise of value.
      3. Continue to the next promise of value until all of the promises of value have a keyword identified.
      4. Have the identified set of keywords laid out and see if any of their meanings are similar and can be consolidated together. Consolidate similar meaning keywords.
      5. Create the initial draft of the EA vision statement by linking the keywords together.
      6. Check the initial draft of the vision statement against the test criteria below. Ask the team if the vision statement satisfies each of the test criteria.
        • Do you find this vision exciting?
        • Is the vision clear, compelling, and easy to grasp?
        • Does this vision somehow connect to the core purpose?
        • Will this vision be exciting to a broad base of people in the organization, not just those within the EA team?
      7. Make changes to the initial draft to satisfy the test criteria. Socialize the EA vision statement with EA stakeholders to make sure it captures their needs.

      3.1.2 Create the EA mission statement

      1 hour

      Input: Identified promises of value, Mission statement test criteria

      Output: EA function mission statement

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin the creation of the EA mission statement by following the steps below:

      1. Gather the EA strategy creation team and have the promises of value from the EA value proposition laid out.
      2. Select one promise of value and work with the team to identify one word that captures the essence of that promise of value.
      3. Continue to the next promise of value until all of the promises of value have a keyword identified.
      4. Have the identified set of keywords laid out, and see if any of their meanings are similar and can be consolidated together. Consolidate similar meaning keywords.
      5. Create the initial draft of the EA mission statement by linking the keywords together.
      6. Check the initial draft of the mission statement against the following test criteria below. Ask the team if the mission statement satisfies each of the test criteria.
        • Do you find this purpose personally inspiring?
        • Does the purpose help you to decide what activities to not pursue, to eliminate from consideration? Is this purpose authentic – something true to what the organization is all about – not merely words on paper that sound nice?
        • Would this purpose be greeted with enthusiasm rather than cynicism by a broad base of people in the organization?
      7. Make changes to the initial draft to satisfy the test criteria. Socialize the EA mission statement with EA stakeholders to make sure it captures their needs.

      EA goals demonstrate the achievement of success of the EA function

      Enterprise architecture goals define specific desired outcomes of an EA function. EA goals are important because they establish the milestones the EA function can strive toward to deliver their promises of value.

      Inform EA goals by examining:

      Promises of value

      —›
      EA goals produce:

      Targets and milestones

      Promises of value

      Produce EA strategic outcomes that can be classified into four categories. The four categories are:

      • Business performance
      • IT performance
      • Customer value
      • Risk management
      EA goals

      Support the strategic outcomes. EA goals can be strategic or operational:

      • EA strategic goals support the strategic outcomes.
      • EA operational goals help measure the architecture capability quality and supporting processes.

      3.1.3 Create EA goals

      2 hours

      Input: Identified promises of value

      Output: EA goals

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin the creation of EA goals by following the steps below:

      1. Gather the EA strategy creation team and the identified promises of value from Phase 2, Create the EA Value Proposition.
      2. Open the EA Goals and Objectives Template and examine the list of default EA goals already within the template.
      3. Take the identified promises of value and discuss with the team if any of the EA goals in the template relate to the promises of value. Record the related EA goal and promise of value. See example below:
        • Promises of value example: Increase the number of investments that have a direct tie to corporate strategy.
        • Related EA goal example: Alignment of IT and business strategy.
      4. Repeat step 3 until all identified promises of value have been examined in relation to the EA goals in the template.
      5. If there are promises of value that are not related to an EA goal in the template, create EA goals to relate to those promises of value. Keep in mind that EA goals need to support the strategic outcomes produced by the promises of value. Record the EA goals in the template and document the related promises of value.

      Download the EA Goals and Objectives Template to assist with completing this activity.

      Starting with COBIT, select the appropriate objectives to track EA goals – Sample

      Below are examples of EA goals and the objectives that track their performance:

      IT performance-oriented goals Objectives
      Alignment of IT and business strategy
      • Increase the percentage of enterprise strategic goals and requirements supported by IT strategic goals by X percent in the fiscal year.
      • Improve stakeholder satisfaction with planned function and services portfolio scope by X percent in the fiscal year.
      • Increase the percentage of IT value drivers mapped to business value drivers by X percent in the next fiscal year.
      Increase in IT agility
      • Improve business executive satisfaction with IT’s responsiveness to new requirements by X percent in the fiscal year.
      • Increase the number of critical business processes supported by up-to-date infrastructure and applications in the next three years.
      • Lower the average time to turn strategic IT objectives into agreed-upon and approved initiatives.
      Optimization of IT assets, resources, and capabilities
      • Increase the frequency of capability maturity and cost optimization assessments.
      • Improve the frequency of reporting for assessment result trends.
      • Raise the satisfaction levels of business and IT executives with IT-related costs and capabilities by X percent.

      3.1.4 Define EA objectives and link them to EA goals

      2 hours

      Input: Defined EA goals

      Output: EA objectives linked to EA goals

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin the process of defining EA objectives and linking them to EA goals using the following steps:

      1. Gather the EA strategy creation team and open the EA Goals and Objectives Template.
      2. Have the goals laid out, and refer to the objectives already in the EA Goals and Objectives Template. Examine if any of them will fit the goals your team has created.
      3. If some of the goals your team has created do not fit with the objectives in the template, begin the process of creating new objectives. Remember, EA objectives are SMART metrics that help track the progress toward the EA goals.
      4. Create an EA objective and check if it is SMART by asking some of the questions below:
        • Specific: Is the objective specific to the goal? Is the objective clear to anyone who has basic knowledge of the goal?
        • Measurable: Is it possible to figure out how far the team would be away from completing the objective?
        • Agreed Upon: Does everyone involved agree the objective is the correct way to measure progress?
        • Realistic: Can the objective be met within the availability of resources, knowledge, and time?
        • Time Based: Is there a time-bound component to the goal?
      5. Continue to create new objectives until each goal has an objective linked to it.

      Download the EA Goals and Objectives Template to assist with completing this activity.

      For each of the objectives, determine how they will be collected, reported, and implemented

      Add details to the enterprise architecture objectives previously defined to increase their clarity to stakeholders.

      EA objective detail category Description
      Unit of measure
      • The unit in which the objective will be presented.
      Calculation formula
      • The formula by which the objective will be calculated.
      Objective baseline, status, and target
      • Baseline: The state of the objective at the start of measurement.
      • Status: The current state of the measurement.
      • Target: The target state the measurement should reach.
      Data collection
      • Responsible: The individual responsible for collecting the data.
      • Source: Where the data originates.
      • Frequency: How often the data will be collected to calculate the objective.
      Reporting
      • Target Audience: The people the objective will be presented to.
      • Method: The method used to present the data collected on the objective (e.g. report, presentation).
      • Frequency: How often the data will be presented to the target audience.

      3.1.5 Record the details of each EA objective

      2 hours

      Input: Defined list of EA objectives

      Output: Increased detail into each defined EA objective

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Record the details of each EA objective. Use the following steps below to assist with recording the details:

      1. Gather the EA strategy creation team, and open the EA Goals and Objectives Template.
      2. Select one objective that has been identified and discuss the formula for calculating the objective and in what units the objective will be recorded. Record the information in the “Calculation formula” and “Unit of measure” columns in the template once they have been agreed upon.
      3. Using the same objective, move to the “Data Collection” portion of the template. Discuss and record the following: the source of the data that generates the objective, the frequency of reporting on the objective, and the person responsible for reporting the objective.
      4. Move to the “Reporting” portion of the template. Discuss and record the target audience for the objective and the reporting frequency and method to those audiences.
      5. Examine the “Objective baseline,” “Objective status,” and “Objective target” columns. Record any measurement you may currently have in the “Objective baseline” column. Record what you would like the objective measurement to be in the “Objective target” column. Note: Keep track of the progression towards the target in the “Objective status” column in the future.
      6. Select the next objective and complete steps 2–5 for that measure. Continue this process until you have recorded details for all objectives.

      Download the EA Goals and Objectives Template to assist with completing this activity.

      Step 3.2

      Finalize the EA Fundamentals

      Activities
      • 3.2.1 Define the organizational coverage dimension of the EA function scope
      • 3.2.2 Define the architectural domains and depth dimension
      • 3.2.3 Define the time horizon dimension
      • 3.2.4 Create a set of EA principles for your organization
      • 3.2.5 Add the rationale and implications to the principles
      • 3.2.6 Operationalize the EA principles
      • 3.2.7 Discuss the need for classical methodology and/or a combination including Agile practices

      This step will walk you through the following activities:

      • Define the EA function scope dimensions.
      • Create a set of EA principles.
      • Discuss the organization’s current methodology, if any, and whether it works for the business.

      This step involves the following participants:

      • CIO
      • EA Team
      • IT Leaders
      • Business Leaders

      Outcomes of this step

      • Defined scope of the EA function.
      • A set of EA principles for your organization.
      • A decision on traditional vs. Agile methodology or a blend of both.

      Build the EA Fundamentals

      Step 3.1 Step 3.2

      A clear EA function scope defines the EA sandbox

      The EA function scope constrains the promises of value the EA function will deliver on by taking into account factors across four dimensions. The EA function scope ensures that the EA function is not stretched beyond its current/planned means and capabilities when delivering the promised value. The four dimensions are illustrated below:

      Organizational coverage
      Determine the focus of the enterprise architecture effort in terms of specific business units, functions, departments, capabilities, or geographical areas.
      Depth
      Determine the appropriate level of detail to be captured, based on the intended use of the enterprise architecture and the contingent decisions to be made.

      EA Scope

      Architectural Domains
      Determine the EA domains (business, data, application, infrastructure, security) that are appropriate to address stakeholder concerns and architecture requirements.
      Time horizon
      Determine the target-state architecture’s objective time period.

      The EA function scope is influenced by the EA value proposition and previously developed EA fundamentals

      Establish the EA function scope by using the EA value proposition and EA fundamentals that have been developed. After defining the EA function scope, refer back to these statements to ensure the EA function scope accurately reflects the EA value proposition and EA fundamentals.

      EA value proposition

      +

      EA vision statement
      EA mission statement
      EA goals and objectives

      —›
      Influences

      Organizational coverage

      Architectural domains

      Depth

      Time horizon

      —›
      Defines
      EA function scope

      EA scope – Organizational Coverage

      The organizational coverage dimension of EA scope determines the focus of enterprise architecture effort in the organization. Coverage can be determined by specific business units, functions, departments, capabilities, or geographic areas. Info-Tech has typically seen two types of coverage based on the size of the organization.

      Small and medium-size enterprise

      Indicators: Full-time employees dedicated to manage its data and IT infrastructure. Individuals are IT generalists and may have multiple roles.

      Recommended coverage: Typically, for small and medium-size businesses, the organizational coverage of architecture work is the entire enterprise. (Source: The Open Group, 2018)

      Large enterprise

      Indicators: Dedicated full-time IT staff with expertise to manage specific applications or parts of the IT infrastructure.

      Recommended coverage: For large enterprises, it is often necessary to develop a number of architectures focused on specific business segments and/or geographies. In this federated model, an overarching enterprise architecture should be established to ensure interoperability and conformance to overarching EA principles. (Source: DCIG, 2011)

      EA objectives track the progression towards the target set by EA goals

      Enterprise architecture objectives are specific metrics that help measure and monitor progress towards achieving an EA goal. Objectives are SMART.

      EA goals —› EA objectives
      • EA strategic goals:
        • Business performance
        • IT performance
        • Customer value
        • Risk management
      • EA operational goals
      • Specific
      • Measurable
      • Agreed upon
      • Realistic
      • Time bound
      (Source: Project Smart, 2014)

      Download the EA Goals and Objectives Template to see examples between the relationship of EA goals to objectives.

      Measure the EA strategy effectiveness by tracking the benefits it provides to the corporate business goals

      The success of the EA function is influenced by the following:

      • The delivery of EA-enabled business outcomes that are most important to the enterprise.
      • The alignment between the business and IT from a planning perspective.
      • Improvements in the corporate business goals due to EA contributions (standardization, rationalization, reuse, etc.).
      Corporate Business Goals Measurements
      • Reduction in operating costs
      • Decrease in regulatory compliance infractions
      • Increased revenue from existing channels
      • Increased revenue from new channels
      • Faster time to business value
      • Improved business agility
      • Reduction in enterprise risk exposure
      • Cost reductions based on application and platform rationalization
      • Standard-based solutions
      • Time reduction for integration
      • Service reused
      • Stakeholder satisfaction with EA services
      • Increase customer satisfaction
      • Rework minimized
      • Lower cost of integration
      • Risk reduction
      • Faster time to market
      • Better scalability, etc.

      3.2.1 Define the organizational coverage dimension of the EA function scope

      2 hours

      Input: EA value proposition, Previously defined EA fundamentals

      Output: Organizational coverage dimension of EA scope defined

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Define the organizational coverage of the EA function scope using the following steps below:

      1. Gather the EA strategy creation team. As well, gather the EA value proposition, the EA vision and mission statements, and the EA goals and objectives your team has already created.
      2. Ask the team to read each of the documents gathered in the previous step. This ensures the concepts are fresh in the team members’ minds when defining the EA function scope organizational coverage.
      3. Consider how much of the organization the EA function would need to cover. Refer to the gathered materials to assist with your decision. For example:
        • EA mission statement: Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture.
        • Implications on organizational coverage: If the purpose of the EA function is to help optimize, transform, and innovate with target-state architecture mapping, then the scope should cover the entire organization. Only by mapping the entire organization’s architecture can the EA function assist with optimizing, transforming, and innovating.
      4. Work with the EA strategy creation team to examine all the gathered materials and document the implications on organization coverage as shown in step 3.
      5. Discuss with the team and select the organizational coverage level that best fits the documented implications for all the gathered materials. Refer back to the gathered materials and make any changes necessary to ensure they support the selected organizational coverage.

      EA scope – Architectural Domains

      A complete enterprise architecture should address all five architectural domains. The five architectural domains are business, data, application, infrastructure, and security.

      Enterprise Architecture
      —› Data Architecture
      Business Architecture —› Infrastructure Architecture
      Security Architecture
      —› Application Architecture

      “The realities of resource and time constraints often mean there is not enough time, funding, or resources to build a top-down, all-inclusive architecture encompassing all four architecture domains. Build architecture domains with a specific purpose in mind.” (The Open Group, 2018)

      Each architectural domain creates a different view of the organization

      Below are the definitions of different domains of enterprise architecture (Info-Tech perspective; others can be identified as well, e.g. Integration Architecture).

      Business Architecture

      Business architecture is a means of demonstrating the business value of subsequent architecture work to key stakeholders and the return on investment to those stakeholders from supporting and participating in the subsequent work. Business architecture defines the business strategy, governance, organization, and key business processes.

      Data Architecture

      Describes the structure of an organization’s logical and physical data assets and data management resources.

      Application Architecture

      Provides a blueprint for the individual applications to be deployed, their interactions, and their relationships to the core business processes of the organization.

      Infrastructure Architecture

      Represents the sum of hardware, software, and telecommunications-related IT capability associated with a particular enterprise. It is concerned with the synergistic operations and management of the devices in the organization.

      Security Architecture

      Provides an unified security design that addresses the necessities and potential risks involved in a certain scenario or environment. It also specifies when and where to apply security controls.
      (Sources: The Open Group, 2018; IT Architecture Journal, 2014; Technopedia, 2016)

      EA scope – Depth

      EA scope depth defines the architectural detail for each EA domain that the organization has selected to pursue. The level of depth is broken down into four levels. The level of depth the organization decides to pursue should be consistent across the domains.

      Contextual
      • Helps define the organization scope, and examines external and internal requirements and their effect on the organization. For example, enterprise governance.
      Conceptual
      • High-level representations of the organization or what the organization wants to be. For example, business strategy, IT strategy.
      Logical
      • Models that define how to implement the representation in the conceptual stage. For example, identifying the business gaps from the current state to the target state defined by the business strategy.
      Physical
      • The technology and physical tools used to implement the representation created in the logical stage. For example, business processes that need to be created to bridge the gaps identified and reach the target stage.
      (Source: Zachman International, 2011) Business Architecture Data Architecture Application Architecture Infrastructure Architecture Security Architecture

      Each architectural depth level contains a set of key artifacts

      The graphic below depicts examples of the key artifacts that each domain of architecture would produce at each depth level.

      Contextual Enterprise Governance
      Conceptual Business strategy Business objects Use-case models Technology landscaping Security policy
      Logical Business capabilities Data attribution Application integration Network/ hardware topology Security standards
      Physical Business process Database design Application design Configuration management Security configuration
      Business Architecture Data Architecture Application Architecture Infrastructure Architecture Security Architecture

      3.2.2 Define the architectural domains and depth dimension of the EA function scope

      2 hours

      Input: EA value proposition, Previously defined EA fundamentals

      Output: Architectural domain and depth dimensions of EA scope defined

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Define the EA function scope for your organization using the following steps below:

      1. Gather the EA strategy creation team. As well, gather the EA value proposition, the EA vision and mission statements, and the EA goals and objectives that your team has already created.
      2. Ask the team to read each of the documents gathered in the previous step. This ensures the concepts are fresh in the team members’ minds when defining the architectural domains and depth of the EA function scope.
      3. Consider the architectural domains and the depth those domains need to reach. Refer to the gathered materials to assist with your decision. For example:
        • Promise of value: Increase the number of IT investments with a direct tie to business strategy.
        • Implications on architectural domains: The EA function will need business architecture. Business architecture generates business capability mapping, which will anticipate what IT investments are needed for the future.
        • Implications on depth: Depth for business architecture needs to reach a logical level to encompass business capabilities.
      4. Work with the EA strategy creation team to examine all the gathered materials and document the implications on architectural domains and depth as shown in step 3.
      5. Discuss with the team and select the architectural domains and the depth for each domain that best fits the documented implication. Refer back to the gathered materials and make any changes necessary to ensure they support the selected architectural domains and depth.

      EA scope – Time Horizon

      The EA scope time horizon dictates how long to plan for the architecture.

      It is important that the EA team’s work has an appropriate planning horizon while avoiding two extremes:

      1. A planning horizon that is too short focuses on immediate operational goals and strategic quick wins, missing the “big picture,” and fails to support the achievement of strategic long-term enterprise goals.
      2. A planning horizon that is too long is at a higher risk of becoming irrelevant.

      Target the same strategic planning horizon as your business. Additionally, consider the following recommendations:

      Planning Horizon: 1 year 2-3 years 5 years
      Recommended under the following conditions:
      • Corporate strategy is not stable and frequently changes direction (typical for small and some mid-sized companies).
      • There will be a major update of the corporate strategy in one year.
      • The company will be acquired by or merged with another company in one year.
      • The business' strategic plan spans the next two to three years, and corporate strategy is moderately stable within this time frame (typical for mid-sized and some large companies).
      • The business' strategic plan spans the next five years and corporate strategy is very stable (typical for large companies).

      3.2.3 Define the time horizon dimension of the EA function scope

      2 hours

      Input: EA value proposition, Previously defined EA fundamentals

      Output: Time horizon dimension of EA scope defined

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Define the EA function scope for your organization using the following steps below:

      1. Gather the EA strategy creation team. As well, gather the EA value proposition, the EA vision and mission statements, and the EA goals and objectives your team has already created.
      2. Ask the team to read each of the documents gathered in the previous step. This ensures the concepts are fresh in the team members’ minds when crafting the EA function scope.
      3. Consider the time horizons of the EA function scope. Refer to the gathered materials to assist with your decision. For example:
        • EA Objective: Increase the percentage of enterprise strategic goals and requirements supported by IT strategic goals by 30% in the next 3 years.
        • Implications on time horizon: Because it will take 3 years to measure the success of these EA objectives, the time horizon may need to be 3 years.
      4. Work with the EA strategy creation team to examine all the gathered materials and document the implications on time horizon as shown in step 3.
      5. Discuss with the team and select the time horizon that best fits the documented implication. Refer back to the gathered materials and make any changes necessary to ensure they support the selected architectural time horizon.

      EA principles capture the EA value proposition essence and provide guidance for the decisions that impact architecture

      EA principles are shared, long-lasting beliefs that guide the use of IT in constructing, transforming, and operating the enterprise by informing and restricting target-state enterprise architecture design, IT investment portfolio management, solution development, and procurement decisions.

      EA value proposition Influences
      —›
      EA Principles Guide and inform
      —›
      Decisions on the Use of IT Direct and control
      ‹—
      Specific Domain Policies
      ‹———————

      What decisions should be made?
      ————— ————— —————
      How should decisions be made?
      ————— ————— —————————›
      Who has the accountability and authority to make decisions?

      EA principles must be carefully constructed to make sure they are adhered to and relevant

      Info-Tech has identified a set of characteristics that EA principles should possess. Having these characteristics ensures the EA principles are relevant and followed in the organization.

      Approach focused EA principles are focused on the approach, i.e. how the enterprise is built, transformed, and operated, as apposed to what needs to be built, which is defined by both functional and non-functional requirements.
      Business relevant Create EA principles specific to the organization. Tie EA principles to the organization’s priorities and strategic aspirations.
      Long lasting Build EA principles that will withstand the test of time.
      Prescriptive Inform and direct decision making with EA principles that are actionable. Avoid truisms, general statements, and observations.
      Verifiable If compliance can’t be verified, the principle is less likely to be followed.
      Easily digestible EA principles must be clearly understood by everyone in IT and by business stakeholders. EA principles aren’t a secret manuscript of the EA team. EA principles should be succinct; wordy principles are hard to understand and remember.
      Followed Successful EA principles represent a collection of beliefs shared among enterprise stakeholders. EA principles must be continuously “preached” to all stakeholders to achieve and maintain buy-in.

      In organizations where formal policy enforcement works well, EA principles should be enforced through appropriate governance processes.

      Review ten universal EA principles to determine if your organization wishes to adopt them

      1. Enterprise value focus We aim to provide maximum long-term benefits to the enterprise as a whole while optimizing total costs of ownership and risks.
      2. Fit for purpose We maintain capability levels and create solutions that are fit for purpose without over-engineering them.
      3. Simplicity We choose the simplest solutions and aim to reduce operational complexity of the enterprise.
      4. Reuse › buy › build We maximize reuse of existing assets. If we can’t reuse, we procure externally. As a last resort, we build custom solutions.
      5. Managed data We handle data creation, modification, and use enterprise-wide in compliance with our data governance policy.
      6. Controlled technical diversity We control the variety of technology platforms we use.
      7. Managed security We manage security enterprise-wide in compliance with our security governance policy.
      8. Compliance to laws and regulations We operate in compliance with all applicable laws and regulations.
      9. Innovation We seek innovative ways to use technology for business advantage.
      10. Customer centricity We deliver best experiences to our customers with our services and products.

      3.2.4 Create a set of EA principles for your organization

      2 hours

      Input: Info-Tech’s ten universal EA principles, Identified promises of value

      Output: A defined set of EA principles for your organization

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Create a set of EA principles for your organization using the steps below:

      1. Gather the EA strategy creation team, download the EA Principles Template – EA Strategy, and have the identified promises of value opened.
      2. Select one universal principle and relate it to the promises of value by discussing with the EA strategy creation team. If there is a relation, record “Yes” in the template on the slide “Select the applicability of 10 universally accepted EA principles.” See example below:
        • Universal principle: Enterprise value focus – We aim to provide maximum long-term benefits to the enterprise as a whole while optimizing total costs of ownership and risks.
        • Related promise of value example: Increase the number of investments that have a direct tie with corporate strategy.
      3. Continue the process in step 2 until all ten universal EA principles have been examined. If there is a universal principle that is unrelated to a promise of value, discuss with the team whether the principle still needs to be included. If the principle is not included, record “No” in the template on the slide “Select the applicability of 10 universally accepted EA principles.”
      4. If there are any promises of value that are not captured by the universally accepted EA principles, the team may choose to create new principles. Create the new principles in the format below and record them in the template.
        • Name: The name of the principle, in a few words.
        • Statement: A sentence that expands on the “Name” section and explains what the principle achieves.

      Download the EA Principles Template – EA Strategy to document this step.

      Organizational stakeholders are more likely to follow EA principles when a rationale and an implication are provided

      After defining the set of EA principles, ensure they are all expanded upon with a rationale and implications. The rationale and implications ensure principles are more likely to be followed because they communicate why the principles are important and how they are to be used.

      Name
      • The name of the EA principle, in a few words.
      Statement
      • A sentence that expands on the “Name” section and explains what the principle achieves.
      Rationale
      • Describes the business benefits and reasoning for establishing the principle.
      • Explicitly links the principle to business/IT vision, mission, priorities, goals, or strategic aspirations (strategic themes).
      Implications
      • Describe when and how the principle is to be applied.
      • Communicate this section with “must” sentences.
      • Refer to domain-specific policies that provide detailed, domain-specific direction on how to apply the principle.

      3.2.5 Add the rationale and implications to the principles that have been created

      2 hours

      Input: Identified set of EA principles

      Output: EA principles that have rationale and implications

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Add the rationale and implication of each EA principle that your organization has selected using the following steps:

      1. Gather the EA strategy creation team and open the EA Principles Template – EA Strategy.
      2. Examine the EA Principles Template – EA Strategy. Look for the detailed descriptions of all the applicable EA universal principles, and discuss with the team whether the pre-populated rationale and implications need to be changed.
      3. Make sure all the rationale and implication sections of the applicable universal EA principles have been examined. Record the changes on the slide devoted to each principle in the template.
      4. Examine any new principles created outside of the universal EA principles. Create the rationale and implication sections for each of those principles. Use the slide “Review the rationale and implications for the applicable universal principles” in the EA Principles Template – EA Strategy to assist with this step.

      Download the EA Principles Template – EA Strategy to document this step.

      3.2.6 Operationalize the EA principles to ensure they are used when decisions are being made

      1-2 hours

      Input: Defined set of EA principles

      Output: EA principles are successfully operationalized

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin to operationalize the EA principles by reviewing the proposed principles with business and technology leadership to secure their approval.

      1. Publish the list of principles, their rationale, and their implications.
      2. Include the principles in any existing policies that guide decision making for the use of technology within the business.
      3. Provide existing governance bodies with the authority to enforce adherence to principles, and communicate the waiver process.
      4. Ensure that project-level teams are aware of the principles and have at least one champion guiding the decisions of the team.

      Review a use case for the utilization of EA principles – Sample

      After operationalizing the EA principles for your organization, the organization can now use those principles to guide and inform its IT investment decisions. Below is an example of a scenario where EA principles were used to guide and inform an IT investment decision.

      Organization wants to provision an application but it needs to decide how to do so, and it considers the relevant EA principles:

      • Reuse › buy › build
      • Managed security
      • Innovation

      The organization has decided to go with a specialized vendor, even though it normally prefers to reuse existing components. The vendor has experience in this domain, understands the data security implications, and can help the organization mitigate risk. Lastly, the vendor is known for providing new solutions on a regular basis and is a market leader, making it more likely to provide the organization with innovative solutions.

      An oil and gas company created EA fundamentals to guide the EA function

      CASE STUDY

      Industry: Oil & Gas
      Source: Info-Tech

      Challenge

      As an enterprise architecture function starting from ground zero, the organization did not have the EA fundamentals in place to guide the EA function. Further, the organization also did not possess an EA function scope to define the boundaries of the EA function.

      Due to the lack of EA scope, the EA function did not know which part of the organization to provide contributions toward. A lack of EA fundamentals caused confusion regarding the future direction of the EA function.

      Solution

      Info-Tech worked with the EA team to define the different components of the EA fundamentals. This included EA vision and mission statements, EA goals and objectives, and EA principles.

      Additionally, Info-Tech worked with the EA team to define the EA function scope.

      These EA strategy components were created by examining the needs of the business. The components were aligned with the identified needs of the EA stakeholders.

      Results

      The defined EA function scope helped set out the responsibilities of the enterprise architecture function to the organization.

      The EA vision and mission statements and EA goals and objectives were used to guide the direction of the EA function. These fundamentals helped the EA function improve its maturity and deliver on its promises.

      The EA principles were used in IT review boards to guide the decisions on IT investments in the organization.

      3.2.7 Discuss the need for a classical methodology and/or a combination including Agility practices

      1 hour

      Input: Existing methodologies

      Output: Decisions about need of agility, ceremonies, and protocols to be used

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Add the rationale and implication of adopting an Agile methodology and/or a combination with a traditional methodology.

      1. Is there an EA methodology adopted by the organization? Is there a classical one, or is it purely Agile?
      2. What would need to happen to address the business goals of the organization (e.g. is there a need to be more agile?)? Do you need to have more decisions centralized (e.g. to adopt certain standards, security controls)?
      3. Where on the decentralization continuum does your organization need to be?
      4. What role would Enterprise Architects have (would they need to be part of existing ceremonies? Would they need to blend traditional and agile processes?)?
      5. If a customized methodology is required, identify this as an item to be included as part of the EA roadmap (can be run as a Agile Enterprise Operating Model workshop).

      Design an Enterprise Architecture Strategy

      Phase 4

      Design the EA Services

      Phase 1

      • 1.1 Explore a general EA strategy approach
      • 1.2 Introduce Agile EA architecture

      Phase 2

      • 2.1 Define the business and technology drivers
      • 2.2 Define your value proposition

      Phase 3

      • 3.1 Realize the importance of EA fundamentals
      • 3.2 Finalize the EA fundamentals

      Phase 4

      • 4.1 Select relevant EA services
      • 4.2 Finalize the set of services and secure approval

      This phase will walk you through the following activities:

      • Select relevant EA services
      • Finalize the set of services and secure approval

      This phase involves the following participants:

      • CIO
      • EA Team
      • IT Leaders
      • Business Leaders

      Step 4.1

      Select Relevant EA Services

      Activities
      • 4.1.1 Select the EA services relevant to your organization
      • 4.1.2 Identify if your organization needs additional services outside of the recommended list
      • 4.1.3 Complete all of the service catalog fields for each service to show the organization how each can be consumed

      This step will walk you through the following activities:

      • Communicate a definition of EA services.
      • Link services to the previously identified EA contributions.

      This step involves the following participants:

      • CIO
      • EA Team
      • IT Leaders
      • Business Leaders

      Outcomes of this step

      • A defined set of services the EA function will provide.
      • An EA service catalog that demonstrates to the organization how each provided service can be accessed and consumed.

      Design the EA Services

      Step 3.1 Step 3.2

      The definition of EA services will allow the group to communicate how they can add value to EA stakeholders

      Enterprise architecture services are a set of activities the enterprise architecture function provides for the organization. EA services are important because the services themselves provide a set of benefits for the organization.

      Enterprise Architecture Services

      • A means of delivering value to the business by facilitating outcomes service consumers want to achieve.
      • EA services are defined from the business perspective using business language.
      • EA services are designed to enable required business activities.

      Viewing the EA function from a service perspective resolves the following pains:

      • Business users don’t know how EA can assist them.
      • Business users don’t know how to request access to a service with multiple sources of information available.
      • EA has no way of managing expectations for their users, which tend to inflate.
      • EA does not have a holistic view of all the services they need to provide.

      Link EA services to the previously identified EA contributions

      Previously identified EA contributions can be linked to EA services, which helps the EA function identify a set of EA services that are important to business stakeholders. Further, linking the EA contributions to EA services can define for the EA function the services they need to provide.

      Demonstrate EA service value by linking them to EA contributions

      1. EA stakeholders generate drivers
      2. Drivers have pains that obstruct them
      3. Pains are alleviated by EA contributions
      4. EA contributions help define the EA services needed

        • EA Contributions
          Example EA contribution: Business capability mapping shows the business capabilities of the organization and the technology that supports those capabilities in the current and target state. This provides a view for the set of investments that are needed by the organization, which can then be prioritized.

          • EA Services
            Example EA service: Target-state business capability mapping

      4.1.1 Select the EA services relevant to your organization

      2 hours

      Input: Previously identified EA contributions from the EA value proposition

      Output: A set of EA services selected for the organization from Info-Tech’s defined set of EA services

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Begin the selection of EA services relevant to your organization by following the steps below:

      1. Gather the EA strategy creation team, and the list of identified EA contributions that the team formulated during Phase 2.
      2. Open the EA Service Planning Tool, select one sub-service, and read its definition.
      3. Based on the definition of the sub-service, refer back to the identified list of EA contributions and check if there is an identified EA contribution that matches the service.
        • If the EA service definitions matches one of the identified EA contributions, then that EA service is relevant to the organization. If there is no match, then the EA service may not be relevant to the organization.
      4. Highlight the sub-service if it is relevant. Add a checkmark beside the EA contribution if it is addressed by a sub-service.
      5. Select the next sub-service and repeat steps 2-4. Continue down the list of sub-services in the EA Service Planning Tool until all sub-services have been examined.

      Download the EA Service Planning Tool to assist with this activity.

      4.1.2 Identify if your organization needs additional services outside of the recommended list

      2 hours

      Input: Expertise from the EA strategy creation team, Previously defined EA contributions

      Output: A defined set of EA services outside the list Info-Tech has recommended

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Identify if services outside of the recommended list in the EA Service Planning Tool are relevant to your organization by using the steps below:

      1. Gather the EA strategy creation team and the list of EA contributions with checkmarks for contributions addressed by EA services.
      2. Take the list of unaddressed EA contributions and select one EA contribution in the list. Assess whether an EA service is required to address the EA contribution. Ask the group the following:
        • Can the EA practice provide the service now?
        • Does providing this EA service line up with the previously defined EA function scope and EA fundamentals?
      3. Decide if a service needs to be provided for that contribution. If yes, give the service a name and a definition.
      4. Then, decide if the service fits into one of the service categories in the EA Service Planning Tool. If there is no fit, create another service category. Define the new service category as well.
      5. Continue to the next unaddressed EA contribution and repeat steps 2-4. Repeat this process until all unaddressed EA contributions have been assessed.

      Download the EA Service Planning Tool to assist with this activity.

      Create the EA service catalog to demonstrate to the organization how each service can be accessed and used

      The EA service catalog is an important communicator to the business. It shifts the technology-oriented view of EA to services that show direct benefit to the business. It is a tool that communicates and provides clarity to the business about the EA services that are available and how those services can assist them.

      Define the services to show value Define the service catalog to show how to use those services
      Already defined
      • EA service categories
      • The services needed by the EA stakeholders in each EA service category
      Need to define
      • Should EA deliver this service?
      • Service triggers
      • Service provider
      • Service requestor

      Info-Tech Insight

      The EA group must provide the organization with a list of services it will provide to demonstrate value. This will help the team manage expectations and the workload while giving organizational stakeholders a clear understanding of how to engage EA and what lies outside of EA’s involvement.

      4.1.3 Complete all the service catalog fields for each service to show the organization how each can be consumed

      4 hours

      Input: Expertise from the EA strategy creation team

      Output: Service details for each EA service in your organization

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Complete the details for each relevant EA service in the EA Service Planning Tool by using the following steps:

      1. Gather the EA strategy creation team, and open the EA Service Planning Tool.
      2. Select one of the services you have defined as relevant and begin the process of defining the service. Define the following fields:
        • Should EA deliver this service? Should the EA team provide this service? (Yes/No)
        • Service trigger: What trigger will signal the need for the service?
        • Service provider: Who in the EA team will provide the service?
        • Service requestor: Who outside of the EA team has requested this service?
      3. Have the EA strategy creation team discuss and define each of the fields for the service above. Record the decisions in the corresponding columns of the EA Service Planning Tool.
      4. Select the next required EA service, and repeat steps 2 and 3. Repeat the process until all required EA services have their details defined.

      Download the EA Service Planning Tool to assist with this activity.

      Step 4.2

      Finalize the Set of Services and Secure Approval

      Activities
      • 4.2.1 Secure approval for your organization’s EA strategy
      • 4.2.2 Map the EA contributions to business goals
      • 4.2.3 Quantify the EA effectiveness
      • 4.2.4 Determine the role of the architect in the Agile ceremonies of the organization

      This step will walk you through the following activities:

      • Present the EA strategy to stakeholders.
      • Determine service details for each EA service in your organization.

      This step involves the following participants:

      • CIO
      • EA Team
      • IT Leaders
      • Business Leaders

      Outcomes of this step

      • Secured approval for your organization’s EA strategy.
      • Measure effectiveness of EA contributions.

      Design the EA Services

      Step 4.1 Step 4.2

      Present the EA strategy to stakeholders to secure approval of the finalized EA strategy

      For the EA strategy to be successfully executed, it must be approved by the EA stakeholders. Securing their approval will increase the likelihood of success in the execution of the EA operating model.

      Outputs that make up the EA strategy —› Present outputs to EA strategy stakeholders
      • Business and technology drivers
      • EA function value proposition

      • EA vision statement
      • EA mission statement
      • EA goals and objectives
      • EA scope
      • EA principles

      • EA function services
      • Identified and prioritized EA stakeholders.








      • The checkmark symbol represents the outputs this blueprint assists with creating.

      4.2.1 Secure approval of your organization’s EA strategy

      1 hour

      Input: Completed EA Function Strategy Template, Expertise from EA strategy creation team

      Output: Approval of the EA strategy

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team, Key EA stakeholders

      Use the following steps to assist with securing approval for your organization’s EA strategy:

      1. Call a meeting between the EA strategy creation team and the identified key EA stakeholders. Key stakeholders were defined in activity 2.1.1.
      2. Open the completed EA Function Strategy Template. Use it to help you discuss the merits of the EA strategy with the key stakeholders.
      3. Discuss with the stakeholders any concerns and modifications they wish to make to the strategy. If detailed questions are asked, refer to the other templates created as a part of this blueprint. Record those concerns and address them at a later time.
      4. After presenting the EA strategy, ask the stakeholders for approval. If stakeholders do not approve, refer back to the concerns documented in step 3 and inquire if addressing the concerns will result in approval.
      5. If applicable, address stakeholder concerns with the EA strategy.
      6. Once EA strategy has been approved, publish the EA strategy to ensure there is a mutual understanding of what the EA function will provide to the organization. Move on to Info-Tech’s Define an EA Operating Model blueprint to begin executing upon the EA strategy.

      Use the EA Function Strategy Template to assist with this activity.

      4.2.2 Map the EA contributions to the business goals

      3 hours

      Input: Expertise from EA strategy creation team

      Output: Service details for each EA service in your organization

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Map EA contributions/services to the goals of the organization.

      1. Start from the business goals of the organization.
      2. Determine Business and IT drivers.
      3. Identify EA contributions that help achieve the business goals.

      Download the EA Service Planning Tool to assist with this activity.

      Trace EA drivers to business goals (sample)

      A model connecting 'Enterprise Architecture' with 'Corporate Goals' through 'EA Contributions'.

      4.2.3 Quantify the EA effectiveness

      1 hour

      Input: Expertise from EA strategy creation team

      Output: Defined KPIs (SMART)

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Use SMART key performance indicators (KPIs) to measure EA contributions vis-à-vis business goals.

      Measure the EA strategy effectiveness by tracking the benefits it provides to the corporate business goals

      The success of the EA function spans across three main dimensions:

      • The delivery of EA-enabled business outcomes that are most important to the enterprise.
      • The alignment between the business and IT from a planning perspective.
      • Improvements in the corporate business goals due to EA contributions (standardization, rationalization, reuse, etc.).
      Corporate Business GoalsEA ContributionsMeasurements
      • Reduction in operating costs
      • Decrease in regulatory compliance infractions
      • Increased revenue from existing channels
      • Increased revenue from new channels
      • Faster time to business value
      • Improved business agility
      • Reduction in enterprise risk exposure
      • Alignment of IT investments to business strategy
      • Achievement of business results directly linked to IT involvement
      • Application and platform rationalization
      • Standards in place
      • Flexible architecture
      • Better integration
      • Higher organizational satisfaction with technology-enabled services and solutions
      • Cost reductions based on application and platform rationalization
      • Standard based solutions
      • Time reduction for integration
      • Service reused
      • Stakeholder satisfaction with EA services
      • Increase customer satisfaction
      • Rework minimized
      • Lower cost of integration
      • Risk reduction
      • Faster time to market
      • Better scalability, etc.

      The oil and gas company began the EA strategy creation by crafting an EA value proposition

      CASE STUDY

      Industry: Oil & Gas
      Source: Info-Tech

      Challenge

      The oil and gas corporation faced a great challenge in communicating the role of enterprise architecture to the organization. Although it has the mandate from the CIO to create the EA function, there was no function in existence. Thus, few people in the organization understood EA.

      Because of this lack of understanding, the EA function was often undermined. The EA function was seen as an order taker that provided some services to the organization.

      Solution

      First, Info-Tech worked with the enterprise architecture team to define the EA stakeholders in the organization.

      Second, Info-Tech interviewed those stakeholders to identify their needs. The needs were analyzed and pains that would obstruct addressing those needs were identified.

      Lastly, Info-Tech worked with the team to identify common EA contributions that would solve those pains.

      Results

      Through this process, Info-Tech helped the team at the oil and gas company create a document that could communicate the value of EA. Specifically, the document could articulate the issues obstructing each stakeholder from achieving their needs and how enterprise architecture could solve them.

      With this value proposition, EA was able to demonstrate value to important stakeholders and set itself up for success in its future endeavors.

      The oil and gas company defined EA services to provide and communicate value to the organization

      CASE STUDY

      Industry: Oil & Gas
      Source: Info-Tech

      Challenge

      As a brand new enterprise architecture function, the EA function at the oil and gas corporation did not have a set of defined EA services. Because of this lack of EA services, the organization did not know what contributions EA could provide.

      Further, without the definition of EA services, the EA function did not set out explicit expectations to the business. This caused expectations from the business to be different from those of the EA function, resulting in friction.

      Solution

      Info-Tech worked with the EA function at the oil and gas corporation to define a set of EA services the function could provide.

      The Info-Tech team, along with the organization, assessed the business and technology needs of the stakeholder. Those needs acted as the basis for the EA function to create their initial services.

      Additionally, Info-Tech worked with the team to define the service details (e.g. service benefits, service requestor, service provider) to communicate how to provide services to the business.

      Results

      The defined EA services led the EA function to communicate what it could provide for the business. As well, the defined services clarified the level of expectation for the business.

      The EA team was able to successfully service the business on future projects, adding value through their expertise and knowledge of the organization’s systems. Because of the demonstrated value, EA has been given greater responsibility throughout the organization.

      4.2.4 Determine the role of the architect in the Agile ceremonies of the organization

      1 hour

      Input: Expertise from EA strategy creation team

      Output: Participation in Agile Pre- and Post-PI, Architect Syncs, etc.

      Materials: Note-taking materials, Whiteboard or flip chart, markers

      Participants: EA strategy creation team

      Document the involvement of the enterprise architect in your organization’s Agile ceremonies.

      1. Document the Agile ceremonial used in the organization (based on SAFe or other Agile approaches).
      2. Determine ceremonies the System Architect will participate in.
      3. Determine ceremonies the Solution Architect will participate in
      4. Determine ceremonies the Enterprise Architect will participate in.
      5. Determine Architect Syncs, etc.

      Note: Roles and responsibilities can be further defined as part of the Agile Enterprise Operating Model.

      The EA role relative to agility

      The enterprise architecture role relative to agility specifies the architecture roles as well as the agile protocols they will participate in.
      This statement will guide every architect’s participation in planning meetings, pre- and post-PI, syncs, etc. Use simple and concise terminology; speak loudly and clearly.

      A strong EA role statement relative to agility has the following characteristics:

      • Describes what different architect roles do to achieve the vision of the organization
      • In an agile way
      • Compelling
      • Easy to grasp
      • Sharply focused
      • Specific
      • Concise

      Sample EA mission relative to agility

      • Create strategies that provide guardrails for the organization, provide standards, reusable assets, accelerators, and other decisions at the enterprise level that support agility.
      • Participate in pre-PI and post-PI planning activities, architect syncs, etc.

      A clear statement can include additional details surrounding the Enterprise Architect role relative to agility

      Likewise, below is a sample of connecting keywords together to form an enterprise architect role statement, relative to agility.

      Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture in an agile way.

      Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.

      Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.

      Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.

      Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture and provide guidance as well as accelerators.

      Target enterprise structure in an agile way – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:

      • Business capabilities and processes (business architecture)
      • Data, application, and technology assets that enable business capabilities and processes (technology architecture)
      • Architecture principles
      • Standards and reusable assets
      • Continuous exploration, integration, and deployment

      Move to the enterprise architecture operating model blueprint to execute your EA strategy

      Once approved, move on to Info-Tech’s Define an EA Operating Model blueprint to begin executing on the EA strategy.

      Enterprise architecture strategy

      This blueprint focuses on setting up an enterprise architecture function, with the goal of maximizing the likelihood of EA success. The blueprint puts into place the components that will align the EA function with the needs of the stakeholders, guide the decision making of the EA function, and define the services EA can provide to the organization.

      Agile enterprise architecture operating model

      An EA operating model helps you design and organize the EA function, ensuring adherence to architectural standards and delivery of EA services. This blueprint acts on the EA strategy by creating methods to engage, govern, and develop architecture as a part of the larger organization.

      Research contributors and experts

      Photo of Milena Litoiu, Senior Director Research and Advisory, Enterprise Architecture Milena Litoiu
      Senior Director Research and Advisory, Enterprise Architecture
      • Milena Litoiu is a Principal/Senior Manager of Enterprise Architecture. She is Master Certified with The Open Group and she sits on global architecture certification boards.
      • Other certifications include SABSA, CRISC, and Scaled Agile Framework. She started as a certified IT Architect at IBM and has over 25 years experience in this field.
      • Milena teaches enterprise architecture at the University of Toronto and led the development of the Enterprise Architecture Certificate (a course on EA fundamentals, one on EA development and Governance, and one on Trends going forward).
      • She has a Masters in Engineering, an executive MBA, and extensive experience in enterprise architecture as well as methodologies and tools.
      Photo of Lan Nguyen, IT Executive, Mentor, Managing Partner at CIOs Beyond Borders Group Lan Nguyen
      IT Executive, Mentor, Managing Partner at CIOs Beyond Borders Group
      • Lan Nguyen has a wealth of experience driving the EA strategy and the digital transformation success at the City of Toronto.
      • Lan is a university lecturer on topics like strategic leadership in the digital enterprise.
      • Lan is a Managing Partner at CIOs Beyond Borders Group.
      • Lan specializes in Partnership Development; Governance; Strategic Planning, Business Development; Government Relations; Business Relationship Management; Leadership Development; Organizational Agility and Change Management; Talent Management; Managed Services; Digital Transformation; Strategic Management of Enterprise IT; Shared Services; Service Quality Improvement, Portfolio Management; Community Development; and Social Enterprise.


      Photo of Dirk Coetsee, Director Research and Advisory, Enterprise Architecture, Data & Analytics Dirk Coetsee
      Director Research and Advisory, Enterprise Architecture, Data & Analytics
      • Dirk Coetsee is a Research & Advisory Director in the Data & Analytics practice. Dirk has over 25 years of experience in data management and architecture within a wide range of industries, especially Financial Services, Manufacturing, and Retail.
      • Dirk spearheaded data architecture at several organizations and was involved in enterprise data architecture, data governance, and data quality and analytics. He architected many operational data stores of ranging complexity and transaction volumes and was part of major enterprise data warehouse initiatives. Lately, he was part of projects that implemented big data, enterprise service bus, and micro services architectures. Dirk has an in-depth knowledge of industry models within the financial and retail spaces.
      • Dirk holds a BSc (Hons) in Operational Research and an MBA with specialization in Financial Services from the University of Pretoria, South Africa.
      Photo of Andy Neill, AVP, Enterprise Architecture, Data and Analytics Andy Neill
      AVP, Enterprise Architecture, Data and Analytics
      • Andy is AVP Data and Analytics and Chief Enterprise Architect at Info-Tech Research Group. Previous roles include leading the data architecture practice for Loblaw Companies Ltd, Shoppers Drug Mart and 360 Insights in Canada as well as leading architecture practices at Siemens consultancy, BBC, NHS, Ordnance Survey, and Houses of Parliament and Commons in the UK.
      • His responsibilities at Info-Tech include leading the data and analytics and enterprise architecture research practices and guiding the future of research and client engagement in that space.
      • Andy is the Product Owner for the Technical Counselor seat offering at Info-Tech, which gives world-class holistic support to our senior technical members.
      • He is also a instructor and content creator for the University of Toronto in the field of Enterprise Architecture.


      Photo of Wayne Filin-Matthews, Chief Enterprise Architect, ICMG Winner of Global Chief Enterprise Architect of the Year 2019 Wayne Filin-Matthews
      Chief Enterprise Architect, ICMG Winner of Global Chief Enterprise Architect of the Year 2019
      • Wayne is currently the EA Discipline Lead/Chief Enterprise Architect – Global Digital Transformation Office, COE at Dell Technologies.
      • He is a distinguished Motivator & Tech Lead as well as an influencer.
      • Wayne has led multiple Enterprise Architecture practices at the global level and has valuable contributions in this space managing and growing Enterprise Architecture and CTO practices across strategy, execution, and adoption parts of the IT lifecycle.
      Photo of Graham Smith, Experienced lead Enterprise Architect and Independent Consultant Graham Smith
      Experienced lead Enterprise Architect and Independent Consultant
      • Graham is an experienced lead enterprise architect specializing in digital and data transformation, with over 33 years of experience, spanning financial markets, media, information, insurance, and telecommunications sectors. Graham has successfully established and led large teams across India, China, Australia, Americas, Japan, and the UK.
      • He is currently working as an independent consultant in digital and data-led transformation and his work spans established businesses and start-ups alike.

      Thanks also go to all experts who contributed to previous versions of this document:

      • Zachary Curry, Director, Enterprise Architecture and Innovation, FMC Technologies
      • Pam Doucette, Director of Enterprise Architecture, Tufts Health Plan
      • Joe Evers, Consulting Principal, JcEvers Consulting Corp
      • Cameron Fairbairn, Enterprise Architect, Agriculture Financial Services Corporation (AFSC)
      • Michael Fulton, Chief Digital Officer & Senior IT Strategy & Architecture Consultant at CC and C Solutions
      • Tom Graves, Principal Consultant, Tetradian Consulting
      • (JB) Brahmaiah Jarugumilli, Consultant, Federal Aviation Administration – Enterprise Services Center
      • Huw Morgan, IT Research Executive, Enterprise Architect
      • Serge Parisien, Manager, Enterprise Architecture, Canada Mortgage & Housing Corporation

      Additional interviews were conducted but are not listed due to privacy and confidentiality requirements.

      Bibliography

      “Agile Manifesto for Software Development,” Ward Cunningham, 2001. Accessed July 2021.

      “ArchiMate 3.1 Specification.” The Open Group, n.d. Accessed July 2021.

      “Are Your IT Strategy and Business Strategy Aligned?” 5Q Partners, 8 Jan. 2015. Accessed Oct. 2016.

      Bowen, Fillmore. “How agile companies create and sustain high ROI.” IBM. Accessed Oct. 2016.

      Burns, Peter, et al. Building Value through Enterprise Architecture: A Global Study. Booz & Co. 2009. Web. Nov. 2016.

      “Demonstrating the Value of Enterprise Architecture in Delivering Business Capabilities.” Cisco, 2008. Web. Oct. 2016.

      “Disciplined Agile.” Disciplined Agile Consortium, n.d. Web.

      Fowler, Martin. “Building Effective software.” MartinFowler.com. Accessed July 2021.

      Fowler, Martin. “Agile Software Guide.” MartinFowler.com, 1 Aug. 2019.

      Accessed July 2021.

      Haughey, Duncan. “SMART Goals.” Project Smart, 2014. Accessed July 2021.

      Kern, Matthew. “20 Enterprise Architecture Practices.” LinkedIn, 3 March 2016. Accessed Nov. 2016.

      Lahanas, Stephen. “Infrastructure Architecture, Defined.” IT Architecture Journal, Sept. 2014. Accessed July 2021.

      Lean IX website, Accessed July 2021.

      Litoiu, Milena. Course material from Information Technology 2690: Foundations of Enterprise Architecture, 2021, University of Toronto.

      Mocker, M., J.W. Ross, and C.M. Beath. “How Companies Use Digital Technologies to Enhance Customer Findings.” MIT CISR Working Paper No. 434, Feb. 2019. Qtd in Mayor, Tracy. “MIT expert recaps 30-plus years of enterprise architecture.” MIT Sloan, 10 Aug. 2020. Web.

      “Open Agile ArchitectureTM.” The Open Group, 2020. Accessed July 2021.

      “Organizational Design Framework – The Transformation Model.” The Center for Organizational Design, n.d. Accessed 1 Aug. 2020.

      Ross, Jeanne W. et al. Enterprise Architecture as Strategy: Creating a Foundation for Business Execution. Harvard Business School Press, 2006.

      Rouse, Margaret. “Enterprise Architecture (EA).” SearchCIO, June 2007. Accessed Nov. 2016.

      “SAFe 5 for Lean Enterprises.” Scaled Agile Framework, Scaled Agile, Inc. Accessed 2021.

      “Security Architecture.” Technopedia, updated 20 Dec. 2016. Accessed July 2021.

      “Software Engineering Institute.” Carnegie Mellon University, n.d. Web.

      “TOGAF 9.1.” The Open Group, 2011. Accessed Oct. 2016.

      “TOGAF 9.2.” The Open Group, 2018. Accessed July 2021.

      Thompson, Rachel. “Stakeholder Analysis: Winning Support for Your Projects.” MindTools, n.d. Accessed July 2021.

      Wendt, Jerome M. “Redefining ‘SMB’, ‘SME’ and ‘Large Enterprise.’” DCIG, 25 Mar. 2011. Accessed July 2021.

      Wilkinson, Jim. “Business Drivers.” The Strategic CFO, 23 July 2013. Accessed July 2021.

      Zachman, John. “Conceptual, Logical, Physical: It is Simple.” Zachman International, 2011. Accessed July 2021.

      Create a Transparent and Defensible IT Budget

      • Buy Link or Shortcode: {j2store}291|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $29,682 Average $ Saved
      • member rating average days saved: 12 Average Days Saved
      • Parent Category Name: Cost & Budget Management
      • Parent Category Link: /cost-and-budget-management
      • IT struggles to gain budget approval year after year, largely driven by a few key factors:
        • For a long time, IT has been viewed as a cost center whose efficiency needs to be increasingly optimized over time. IT’s relationship to strategy is not yet understood or established in many organizations.
        • IT is one of the biggest areas of cost for many organizations. Often, executives don’t understand or even believe that all that IT spending is necessary to advance the organization’s objectives, let alone keep it up and running.

      Our Advice

      Critical Insight

      Internal and external obstacles beyond IT’s control make these challenges with gaining IT budget approval even harder to overcome:

      • Economic pressures can quickly drive IT’s budgetary focus from strategic back to tactical.
      • Corporate-driven categorizations of expenditure, plus disconnected approval mechanisms for capital vs. operational spend, hide key interdependencies and other aspects of IT’s financial reality.
      • Connecting the dots between IT activities and business benefits rarely forms a straight line.

      Impact and Result

      • CIOs need a straightforward way to create and present an approval-ready budget.
        • Info-Tech recognizes that connecting the dots to demonstrate value is key to budgetary approval.
        • Info-Tech also recognizes that key stakeholders require different perspectives on the IT budget.
        • This blueprint provides a framework, method, and templated exemplars for creating and presenting an IT budget to stakeholders that will speed up the approval process and ensure more of it is approved.

      Create a Transparent and Defensible IT Budget Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Create a Transparent and Defensible IT Budget Storyboard – A step-by-step guide to developing a proposed IT budget that’s sensitive to stakeholder perspectives and ready to approve.

      This deck applies Info-Tech’s proven ITFM Cost Model to the IT budgeting process and offers five phases that cover the purpose of your IT budget and what it means to your stakeholders, key budgeting resources, forecasting, selecting and fine-tuning your budget message, and delivering your IT budget executive presentation for approval.

      • Create a Transparent and Defensible IT Budget Storyboard

      2. IT Cost Forecasting and Budgeting Workbook – A structured Excel tool that allows you to forecast your IT budget for next fiscal year across four key stakeholder views, analyze it in the context of past expenditure, and generate high-impact visualizations.

      This Excel workbook offers a step-by-step approach for mapping your historical and forecasted IT expenditure and creating visualizations you can use to populate your IT budget executive presentation.

      • IT Cost Forecasting and Budgeting Workbook

      3. Sample: IT Cost Forecasting and Budgeting Workbook – A completed IT Cost Forecasting & Budgeting Workbook to review and use as an example.

      This sample workbook offers a completed example of the “IT Cost Forecasting and Budgeting Workbook” that accompanies the Create a Transparent & Defensible IT Budget blueprint.

      • Sample: IT Cost Forecasting and Budgeting Workbook

      4. IT Budget Executive Presentation – A PowerPoint template and full example for pulling together your proposed IT budget presentation.

      This presentation template offers a recommended structure for presenting your proposed IT budget for next fiscal year to your executive stakeholders for approval. 

      [infographic]

      Workshop: Create a Transparent and Defensible IT Budget

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Get into budget-starting position

      The Purpose

      Understand your IT budget in the context of your organization and key stakeholders, as well as gather your budgeting data and review previous years’ financial performance.

      Key Benefits Achieved

      Understand your organization’s budget process and culture.

      Understand your stakeholders’ priorities and perspectives regarding your IT budget.

      Gain insight into your historical IT expenditure.

      Set next fiscal year’s IT budget targets.

      Activities

      1.1 Review budget purpose. 

      1.2 Understand stakeholders and approvers.

      1.3 Gather your data.

      1.4 Map and review historical financial performance.

      1.5 Rationalize last year’s variances and set next year's budget targets.

      Outputs

      Budget process and culture assessment.

      Stakeholder alignment assessment and pre-selling strategy.

      Data prepared for next steps.

      Mapped historical expenditure.

      Next fiscal year’s budget targets.

      2 Forecast project CapEx

      The Purpose

      Develop a forecast of next fiscal year’s proposed capital IT expenditure driven by your organization’s strategic projects.

      Key Benefits Achieved

      Develop project CapEx forecast according to the four different stakeholder views of Info-Tech’s ITFM Cost Model.

      Ensure that no business projects that have IT implications (and their true costs) are missed.

      Activities

      2.1 Review the ITFM cost model

      2.2 List projects.

      2.3 Review project proposals and costs.

      2.4 Map and tally total project CapEx.

      2.5 Develop and/or confirm project-business alignment, ROI, and cost-benefit statements.

      Outputs

      Confirmed ITFM cost mdel.

      A list of projects.

      Confirmed list of project proposals and costs.

      Forecasted project-based capital expenditure mapped against the four views of the ITFM Cost Model.

      Projects financials in line.

      3 Forecast non-project CapEx and OpEx

      The Purpose

      Develop a forecast of next fiscal year’s proposed “business as usual” non-project capital and operating IT expenditure.

      Key Benefits Achieved

      Develop non-project CapEx and non-project OpEx forecasts according to the four different stakeholder views of Info-Tech’s ITFM Cost Model.

      Make “business as usual” costs fully transparent and rationalized.

      Activities

      3.1 Review non-project capital and costs. 

      3.2 Review non-project operations and costs.

      3.3 Map and tally total non-project CapEx and OpEx.

      3.4 Develop and/or confirm proposed expenditure rationales.

      Outputs

      Confirmation of non-project capital and costs.

      Confirmation of non-project operations and costs.

      Forecasted non-project-based capital expenditure and operating expenditure against the four views of the ITFM Cost Model.

      Proposed expenditure rationales.

      4 Finalize budget and develop presentation

      The Purpose

      Aggregate and sanity-check your forecasts, harden your rationales, and plan/develop the content for your IT budget executive presentation.

      Key Benefits Achieved

      Create a finalized proposed IT budget for next fiscal year that offers different views on your budget for different stakeholders.

      Select content for your IT budget executive presentation that will resonate with your stakeholders and streamline approval.

      Activities

      4.1 Aggregate forecast totals and sanity check.

      4.2 Generate graphical outputs and select content to include in presentation.

      4.3 Fine-tune rationales.

      4.4 Develop presentation and write commentary.

      Outputs

      Final proposed IT budget for next fiscal year.

      Graphic outputs selected for presentation.

      Rationales for budget.

      Content for IT Budget Executive Presentation.

      5 Next steps and wrap-up (offsite)

      The Purpose

      Finalize and polish the IT budget executive presentation.

      Key Benefits Achieved

      An approval-ready presentation that showcases your business-aligned proposed IT budget backed up with rigorous rationales.

      Activities

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Outputs

      Completed IT Budget Executive Presentation.

      Review scheduled.

      Further reading

      Create a Transparent and Defensible IT Budget

      Build in approvability from the start.

      EXECUTIVE BRIEF

      Analyst Perspective

      A budget’s approvability is about transparency and rationale, not the size of the numbers.

      Jennifer Perrier.

      It’s that time of year again – budgeting. Most organizations invest a lot of time and effort in a capital project selection process, tack a few percentage points onto last year’s OpEx, do a round of trimming, and call it a day. However, if you want to improve IT financial transparency and get your business stakeholders and the CFO to see the true value of IT, you need to do more than this.

      Yourcrea IT budget is more than a once-a-year administrative exercise. It’s an opportunity to educate, create partnerships, eliminate nasty surprises, and build trust. The key to doing these things rests in offering a range of budget perspectives that engage and make sense to your stakeholders, as well as providing iron-clad rationales that tie directly to organizational objectives.

      The work of setting and managing a budget never stops – it’s a series of interactions, conversations, and decisions that happen throughout the year. If you take this approach to budgeting, you’ll greatly enhance your chances of creating and presenting a defensible annual budget that gets approved the first time around.

      Jennifer Perrier
      Principal Research Director
      IT Financial Management Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Common Obstacles

      Info-Tech’s Approach

      IT struggles to gain budget approval year after year, largely driven by a few key factors:

      • For a long time, IT has been viewed as a cost center whose efficiency needs to be increasingly optimized over time. IT’s relationship to strategy is not yet understood or established in many organizations.
      • IT is one of the biggest areas of cost for many organizations. Often, executives don’t understand, or even believe, that all that IT spending is necessary to advance the organization’s objectives, let alone keep it running.

      Internal and external obstacles beyond IT’s control make these challenges even harder to overcome:

      • Economic pressures can quickly drive IT’s budgetary focus from strategic back to tactical.
      • Corporate-driven categorizations of expenditure, plus disconnected approval mechanisms for capital vs. operational spend, hide key interdependencies and other aspects of IT’s financial reality.
      • Connecting the dots between IT activities and business benefits rarely forms a straight line.

      CIOs need a straightforward way to create and present an approval-ready budget.

      • Info-Tech recognizes that connecting the dots to demonstrate value is key to budgetary approval.
      • Info-Tech also recognizes that key stakeholders require different perspectives on the IT budget.
      • This blueprint provides a framework, method, and templated exemplars for creating and presenting an IT budget to stakeholders. It will speed the approval process and ensure more of it is approved.

      Info-Tech Insight
      CIOs need a straightforward way to create and present an approval-ready IT budget that demonstrates the value IT is delivering to the business and speaks directly to different stakeholder priorities.

      IT struggles to get budgets approved due to low transparency and failure to engage

      Capability challenges

      Administrative challenges

      Operating challenges

      Visibility challenges

      Relationship challenges

      IT is seen as a cost center, not an enabler or driver of business strategy.

      IT leaders are not seen as business leaders.

      Economic pressures drive knee-jerk redirection of IT’s budgetary focus from strategic initiatives back to operational tactics.

      The vast majority of IT’s
      real-life expenditure is in the form of operating expenses i.e. keeping the lights on.

      Most business leaders don’t know how many IT resources their business units are really consuming.

      Other departments in the organization see IT as a competitor for funding, not a business partner.

      Lack of transparency

      IT and the business aren’t speaking the same language.

      IT leaders don’t have sufficient access to information about, or involvement in, business decisions and objectives.

      Outmoded finance department expenditure categorizations don’t accommodate IT’s real cost categories.

      IT absorbs unplanned spend because business leaders don’t realize or consider the impact of their decisions on IT.

      The business doesn’t understand what IT is, what it does, or what it can offer.

      IT and the business don’t have meaningful conversations about IT costs, opportunities, or investments.

      Defining and demonstrating the value of IT and its investments isn’t straightforward.

      IT leaders may not have the financial literacy or acumen needed to translate IT activities and needs into business terms.

      CapEx and OpEx approval and tracking mechanisms are handled separately when, in reality, they’re highly interdependent.

      IT activities usually have an indirect relationship with revenue, making value calculations more complicated.

      Much of IT, especially infrastructure, is invisible to the business and is only noticed if it’s not working.

      The relationship between IT spending and how it supports achievement of business objectives is not clear.

      Reflect on the numbers…

      The image contains a screenshot of five graphs. The graphs depict Cost and budget management, Cost optimization, Business value, perception of improvement, and intensity of business frustration.

      To move forward, first you need to get unstuck

      Today’s IT budgeting challenges have been growing for a long time. Overcoming these challenges means untangling yourself from the grip of the root causes.

      Principle 1:
      IT and the business are fighting diverging forces. Technology has changed monumentally, while financial management hasn’t changed much at all.

      Principle 2:
      Different stakeholders have different perspectives on your IT budget. Learn and acknowledge what’s important to them so that you can potentially deliver it.

      Principle 3:
      Connecting the dots to clearly demonstrate IT’s value to the organization is the key to budgetary approval. But those connected dots don’t always result in a straight line.

      The three principles above are all about IT’s changing relationship to the business. IT leaders need a systematic and repeatable approach to budgeting that addresses these principles by:

      • Clearly illustrating the alignment between the IT budget and business objectives.
      • Showing stakeholders the overall value that IT investment will bring them.
      • Demonstrating where IT is already realizing efficiencies and economies of scale.
      • Gaining consensus on the IT budget from all parties affected by it.

      “The culture of the organization will drive your success with IT financial management.”

      – Dave Kish, Practice Lead, IT Financial Management Practice, Info-Tech Research Group

      Info-Tech’s approach

      CIOs need a straightforward way to convince approval-granting CFOs, CEOs, boards, and committees to spend money on IT to advance the organization’s strategies.

      IT budget approval cycle

      The image contains a screenshot of the IT budget approval cycle.

      The Info-Tech difference:

      This blueprint provides a framework, method, and templated exemplars for building and presenting your IT budget to different stakeholders. These will speed the approval process and ensure that a higher percentage of your proposed spend is approved.

      Info-Tech’s methodology for how to create a transparent and defensible it budget

      1. Lay Your Foundation

      2. Get Into Budget-Starting Position

      3. Develop Your Forecasts

      4. Build Your Proposed Budget

      5. Create and Deliver Your Budget Presentation

      Phase steps

      1. Understand budget purpose
      2. Know your stakeholders
      3. Continuously pre-sell your budget
      1. Gather your data
      2. Review historical performance
      3. Set budget goals
      1. Develop alternate scenarios
      2. Develop project CapEx forecasts
      3. Develop non-project CapEx and OpEx forecasts
      1. Aggregate your forecasts
      2. Stress-test your forecasts
      3. Challenge and perfect your rationales
      1. Plan your presentation content
      2. Build your budget presentation
      3. Present, finalize, and submit your budget

      Phase outcomes

      An understanding of your stakeholders and what your IT budget means to them.

      Information and goals for planning next fiscal year’s IT budget.

      Completed forecasts for project and non-project CapEx and OpEx.

      A final IT budget for proposal including scenario-based alternatives.

      An IT budget presentation.

      Insight summary

      Overarching insight: Create a transparent and defensible IT budget

      CIOs need a straightforward way to create and present an approval-ready IT budget that demonstrates the value IT is delivering to the business and speaks directly to different stakeholder priorities.

      Phase 1 insight: Lay your foundation

      IT needs to step back and look at it’s budget-creation process by first understanding exactly what a budget is intended to do and learning what the IT budget means to IT’s various business stakeholders.

      Phase 2 Insight: Get into budget-starting position

      Presenting your proposed IT budget in the context of past IT expenditure demonstrates a pattern of spend behavior that is fundamental to next year’s expenditure rationale.

      Phase 3 insight: Develop your forecasts

      Forecasting costs according to a range of views, including CapEx vs. OpEx and project vs. non-project, and then positioning it according to different stakeholder perspectives, is key to creating a transparent budget.

      Phase 4 insight: Build your proposed budget

      Fine-tuning and hardening the rationales behind every aspect of your proposed budget is one of the most important steps for facilitating the budgetary approval process and increasing the amount of your budget that is ultimately approved.

      Phase 5 insight: Create and deliver your budget presentation

      Selecting the right content to present to your various stakeholders at the right level of granularity ensures that they see their priorities reflected in IT’s budget, driving their interest and engagement in IT financial concerns.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      IT Cost Forecasting and Budgeting Workbook

      This Excel tool allows you to capture and work through all elements of your IT forecasting from the perspective of multiple key stakeholders and generates compelling visuals to choose from to populate your final executive presentation.

      The image contains a screenshot of the IT Cost Forecasting and Budgeting Workbook.

      Also download this completed sample:

      Sample: IT Cost Forecasting and Budgeting Workbook

      Key deliverable

      IT Budget Executive Presentation Template

      Phase 5: Create a focused presentation for your proposed IT budget that will engage your audience and facilitate approval.

      The image contains a screenshot of the IT Budget Executive Presentation Template.

      Blueprint benefits

      IT benefits

      Business benefits

      • Improve IT’s overall financial management capability.
      • Streamline the administration of annual IT budget development.
      • Legitimize the true purpose and value of IT operations and associated expenditure.
      • Create visibility on the part of both IT and the business into IT’s mandate, what needs to be in place, and what it costs to fund it.
      • Foster better relationships with business stakeholders by demonstrating IT’s business and financial competency, working in partnership with business leaders on IT investment decisions, and building mutual trust.
      • Better understand the different types of expenditure occurring in IT, including project CapEx, non-project CapEx, and non-project OpEx.
      • Gain insight into the relationship between one-time CapEx on ongoing OpEx and its ramifications.
      • See business priorities and concerns clearly reflected in IT’s budget down to the business-unit level.
      • Receive thorough return on investment calculations and cost-benefit analyses for all aspects of IT expenditure.
      • Understand the direct relationship between IT expenditure and the depth, breadth, and quality of IT service delivery to the business.

      Measure the value of this blueprint

      Ease budgetary approval and improve its accuracy.

      Near-term goals

      • Percentage of budget approved: Target 95%
      • Percentage of IT-driven projects approved: Target 100%
      • Number of iterations/re-drafts required to proposed budget: One iteration

      Long-term goal

      • Variance in budget vs. actuals: Actuals less than budget and within 2%

      In Phases 1 and 2 of this blueprint, we will help you understand what your approvers are looking for and gather the right data and information.

      In Phase 3, we will help you forecast your IT costs it terms of four stakeholder views so you can craft a more meaningful IT budget narrative.

      In Phases 4 and 5, we will help you build a targeted presentation for your proposed IT budget.

      Value you will receive:

      1. Increased forecast accuracy through using a sound cost-forecasting methodology.
      2. Improved budget accuracy by applying more thorough and transparent techniques.
      3. Increased budget transparency and completeness by soliciting input earlier and validating budgeting information.
      4. Stronger alignment between IT and enterprise goals through building a better understanding of the business values and using language they understand.
      5. A more compelling budget presentation by offering targeted, engaging, and rationalized information.
      6. A faster budgeting rework process by addressing business stakeholder concerns the first time.

      An analogy…

      “A budget isn’t like a horse and cart – you can’t get in front of it or behind it like that. It’s more like a river…

      When developing an annual budget, you have a good idea of what the OpEx will be – last year’s with an annual bump. You know what that boat is like and if the river can handle it.

      But sometimes you want to float bigger boats, like capital projects. But these boats don’t start at the same place at the same time. Some are full of holes. And does your river even have the capacity to handle a boat of that size?

      Some organizations force project charters by a certain date and only these are included in the following year’s budget. The project doesn’t start until 8-12 months later and the charter goes stale. The river just can’t float all these boats! It’s a failed model. You have to have a great governance processes and clear prioritization so that you can dynamically approve and get boats on the river throughout the year.”

      – Mark Roman, Managing Partner, Executive Services,
      Info-Tech Research Group and Former Higher Education CIO

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      Phase 1: Lay Your Foundation

      Phase 2: Get Into Budget-Starting Position

      Phase 3: Develop Your Forecasts

      Phase 4: Build Your Proposed Budget

      Phase 5: Create and Deliver Your Budget Presentation

      Call #1: Discuss the IT budget, processes, and stakeholders in the context of your unique organization.

      Call #2: Review data requirements for transparent budgeting.

      Call #3: Set budget goals and process improvement metrics.

      Call #4: Review project CapEx forecasts.

      Call #5: Review non-project CapEx and OpEx forecasts.

      Call #6: Review proposed budget logic and rationales.

      Call #7: Identify presentation inclusions and exclusions.

      Call #8: Review final budget presentation.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4 Day 5

      Get into budget-starting position

      Forecast project CapEx

      Forecast non-project CapEx and OpEx

      Finalize budget and develop presentation

      Next Steps and
      Wrap-Up (offsite)

      Activities

      1.1 Review budget purpose.

      1.2 Understand stakeholders and approvers.

      1.3 Gather your data.

      1.4 Map and review historical financial performance.

      1.5 Rationalize last year’s variances.

      1.5 Set next year’s budget targets.

      2.1 Review the ITFM Cost Model.

      2.2 List projects.

      2.3 Review project proposals and costs.

      2.4 Map and tally total project CapEx.

      2.5 Develop and/or confirm project-business alignment, ROI, and cost-benefit statements.

      3.1 Review non-project capital and costs.

      3.2 Review non-project operations and costs.

      3.3 Map and tally total non-project CapEx and OpEx.

      3.4 Develop and/or confirm proposed expenditure rationales.

      4.1 Aggregate forecast totals and sanity check.

      4.2 Generate graphical outputs and select content to include in presentation.

      4.3 Fine-tune rationales.

      4.4 Develop presentation and write commentary.

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. Budget process and culture assessment.
      2. Stakeholder alignment assessment and pre-selling strategy.
      3. Mapped historical expenditure.
      4. Next fiscal year’s budget targets.
      1. Forecasted project-based capital expenditure mapped against the four views of the ITFM Cost Model.
      1. Forecasted non-project-based capital expenditure and operating expenditure against the four views of the ITFM Cost Model.
      1. Final proposed IT budget for next fiscal year.
      2. Plan and build content for IT Budget Executive Presentation.
      1. Completed IT Budget Executive Presentation.

      Phase 1

      Lay Your Foundation

      Lay Your
      Foundation

      Get Into Budget-Starting Position

      Develop Your
      Forecasts

      Build Your
      Proposed Budget

      Create and Deliver Your Presentation

      1.1 Understand what your budget is
      and does

      1.2 Know your stakeholders

      1.3 Continuously pre-sell your budget

      2.1 Assemble your resources

      2.2 Understand the four views of the ITFM Cost Model

      2.3 Review last year’s budget vs.
      actuals and five-year historical trends

      2.4 Set your high-level goals

      3.1 Develop assumptions and
      alternative scenarios

      3.2 Forecast your project CapEx

      3.3 Forecast your non-project CapEx and OpEx

      4.1 Aggregate your numbers

      4.2 Stress test your forecasts

      4.3 Challenge and perfect your
      rationales

      5.1 Plan your content

      5.2 Build your presentation

      5.3 Present to stakeholders

      5.4 Make final adjustments and submit your IT budget

      This phase will walk you through the following activities:

      • Seeing your budget as a living governance tool
      • Understanding the point of view of different stakeholders
      • Gaining tactics for setting future IT spend expectations

      This phase involves the following participants:

      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Lay Your Foundation

      Before starting any process, you need to understand exactly why you’re doing it.

      This phase is about understanding the what, why, and who of your IT budget.

      • Understand what your budget is and does. A budget isn’t just an annual administrative event – it’s an important governance tool. Understand exactly what a budget is and your budgetary accountabilities as an IT leader.
      • Know your stakeholders. The CFO, CEO, and CXOs in your organization have their own priorities, interests, and professional mandates. Get to know what their objectives are and what IT’s budget means to them.
      • Continuously pre-sell your budget. Identifying, creating, and capitalizing on opportunities to discuss your budget well in advance of its formal presentation will get influential stakeholders and approvers on side, foster collaborations, and avoid unpleasant surprises on all fronts.

      “IT finance is more than budgeting. It’s about building trust and credibility in where we’re spending money, how we’re spending money. It’s about relationships. It’s about financial responsibility, financial accountability. I rely on my entire leadership team to all understand what their spend is. We are a steward of other people’s money.”

      – Rick Hopfer, CIO, Hawaii Medical Service Association

      What does your budget actually do?

      A budget is not just a painful administrative exercise that you go through once a year.

      Most people know what a budget is, but it’s important to understand its true purpose and how it’s used in your organization before you engage in any activity or dialogue about it.

      In strictly objective terms:

      • A budget is a calculated estimate of income vs. expenditure for a period in the future, often one year. Basically, it’s an educated guess about how much money will come into a business entity or unit and how much money will go out of it.
      • A balanced budget is where income and expenditure amounts are equal.
      • The goal in most organizations is for the income component of the budget to match or exceed the expenditure component.
        If it doesn’t, this results in a deficit that may lead to debt.

      Simply put, a budget’s fundamental purpose is to plan and communicate how an organization will avoid deficit and debt and remain financially viable while meeting its various accountabilities and responsibilities to its internal and external stakeholders.

      “CFOs are not thinking that they want to shut down IT spend. Nobody wants to do that. I always looked at things in terms of revenue streams – where the cash inflow is coming from, where it’s going to, and if I can align my cash outflows to my revenue stream. Where I always got suspicious as a CFO is if somebody can’t articulate spending in terms of a revenue stream. I think that’s how most CFOs operate.”

      – Carol Carr, Technical Counselor,
      Info-Tech Research Group and Former CFO

      Put your IT budget in context

      Your IT budget is just one of several budgets across your organization that, when combined, create an organization-wide budget. In this context, IT’s in a tough spot.

      It’s a competition: The various units in your organization are competing for the biggest piece they can get of the limited projected income pie. It’s a zero-sum game. The organization’s strategic and operational priorities will determine how this projected income is divvied up.

      Direct-to-revenue units win: Business units that directly generate revenue often get bigger relative percentages of the organizational budget since they’re integral to bringing in the projected income part of the budget that allows the expenditure across all business units to happen in the first place.

      Indirect-to-revenue units lose: Unlike sales units, for example, IT’s relationship to projected income tends to be indirect, which means that IT must connect a lot more dots to illustrate its positive impact on projected income generation.

      In financial jargon, IT really is a cost center: This indirect relationship to revenue also explains why the focus of IT budget conversations is usually on the expenditure side of the equation, meaning it doesn’t have a clear positive impact on income.

      Contextual metrics like IT spend as a percentage of revenue, IT OpEx as a percentage of organizational OpEx, and IT spend per organizational employee are important baseline metrics to track around your budget, internally benchmark over time, and share, in order to illustrate exactly where IT fits into the broader organizational picture.

      Budgeting isn’t a once-a-year thing

      Yet, many organizations treat it like a “one and done” point of annual administration. This is a mistake that misses out on the real benefits of budgeting.

      Many organizations have an annual budgeting and planning event that takes place during the back half of the fiscal year. This is where all formal documentation around planned projects and proposed spend for the upcoming year is consolidated, culminating in final presentation, adjustment, and approval. It’s basically a consolidation and ranking of organization-wide priorities at the highest level.

      If things are running well, this culmination point in the overall budget development and management process is just a formality, not the beginning, middle, and end of the real work. Ideally:

      • Budgets are actually used: The whole organization uses budgets as tools to actively manage day-to-day operations and guide decision making throughout the year in alignment with priorities as opposed to something that’s put on a shelf or becomes obsolete within a few months.
      • Interdependencies are evident: No discrete area of spend focus is an island – it’s connected directly or indirectly with other areas of spend, both within IT and across the organization. For example, one server interacts with multiple business applications, IT and business processes, multiple IT staff, and even vendors or external managed service providers. Cost-related decisions about that one server – maintain, repurpose, consolidate, replace, discard – will drive other areas of spend up or down.
      • There are no surprises: While this does happen, your budget presentation isn’t a great time to bring up a new point of significant spend for the first time. The items in next year’s proposed budget should be priorities that are already known, vetted, supported, and funded.

      "A well developed and presented budget should be the numeric manifestation of your IT strategy that’s well communicated and understood by your peers. When done right, budgets should merely affirm what’s already been understood and should get approved with minimal pushback.“

      – Patrick Gray, TechRepublic, 2020

      Understand your budgetary responsibilities as the IT leader

      It’s in your job description. For some stakeholders, it’s the most important part of it.

      While not a contract per se, your IT budget is an objective and transparent statement made in good faith that shows:

      • You know what it takes to keep the organization viable.
      • You understand the organization’s accountabilities and responsibilities as well as those of its leaders.
      • You’re willing and able to do your part to meet these accountabilities and responsibilities.
      • You know what your part of this equation is, as well as what parts should and must be played by others.

      When it comes to your budget (and all things financial), your job is to be ethical, careful, and wise:

      1. Be honest. Business ethics matter.
      2. Be as accurate as possible. Your expenditure predictions won’t be perfect, but they need to be best-effort and defensible.
      3. Respect the other players. They have their own roles, motivations, and mandates. Accept and respect these by being a supporter of their success instead of an obstacle to them achieving it.
      4. Connect the dots to income. Always keep the demonstration of business value in your sights. Often, IT can’t draw a straight line to income, but demonstrating how IT expenditure supports and benefits future, current, and past (but still relevant) business goals and strategies, which in turn affect income, is the best course.
      5. Provide alternatives. There are only so many financial levers your organization can pull. An action on one lever will have wanted and unwanted consequences on another. Aim to put financial discussions in terms of risk-focused “what if” stories and let your business partners decide if those risks are satisfactory.

      Budgeting processes tend to be similar – it’s budgeting cultures that drive differences

      The basic rules of good budgeting are the same everywhere. Bad budgeting processes, however, are usually caused by cultural factors and can be changed.

      What’s the same everywhere…

      What’s unchangeable…

      What’s changeable…

      For right or wrong, most budgeting processes follow these general steps:

      There are usually only three things about an organization’s budgeting process that are untouchable and can’t be changed:

      Budgeting processes are rarely questioned. It never occurs to most people to challenge this system, even if it doesn’t work. Who wants to challenge the CFO? No one.

      Review your organization’s budgeting culture to discover the negotiable and non-negotiable constraints. Specifically, look at these potentially-negotiable factors if they’re obstacles to IT budgeting success:

      1. Capital project vetting and selection for the next fiscal year starts three-to-six months before the end of the current fiscal year.
      2. Operational expenditure, including salaries, is looked at later with much less formality and scrutiny with an aim to cut.
      3. Each business unit does a budget presentation and makes directed amendments (usually trimming).
      4. The approved budget numbers are plugged into a standard, sub-optimal budget template provided by Finance.
      1. The legal and regulatory mandates that govern financial funding, accounting, and reporting practices. These are often specific to industries and spend types.
      2. The accounting rules your organization follows, such as GAAP, or IFRS. These too may be legally mandated for government entities and publicly-traded companies.
      3. Hard limits on the projected available income the CFO has to distribute.
      • Timeframes and deadlines
      • Order of operations
      • Areas of focus (CapEx vs. OpEx)
      • Funding sources and ownership
      • Review/approval mechanisms
      • Templates and tools

      1.1 Review your budgeting process and culture

      1 hour

      1. Review the following components of your budget process using the questions provided for each as a guideline.
        1. Legal and regulatory mandates. What are the external rules that govern how we do financial tracking and reporting? How do they manifest in our processes?
        2. Accounting rules used. What rules does our finance department use and why? Do these rules allow for more meaningful representations of IT spend? Are there policies or practices in place that don’t appear to be backed by any external standards?
        3. Timeframes and deadlines. Are we starting the budgeting process too late? Do we have enough time to do proper due diligence? Will expenditures approved now be out of date when we go to execute? Are there mechanisms to update spend plans mid-cycle?
        4. Order of operations. What areas of spend do we always look at first, such as CapEx? Are there any benefits to changing the order in which we do things, such as examining OpEx first?
        5. Areas of focus. Is CapEx taking up most of our budgeting cycle time? Are we spending enough time examining OpEx? Is IT getting enough time from the CFO compared to other units?
        6. Funding sources and ownership. Is IT footing most of the technology bills? Are business unit leaders fronting any technology business case pitches? Is IT appropriately included in business case development? Is there any benefit to implementing show-back or charge-back?
        7. Review/approval mechanisms. Are strategies and priorities used to rank proposed spend clear and well communicated? Are spend approvers objective in their decision making? Do different approvers apply the same standards and tools?
        8. Templates and tools. Are the ones provided by Finance, the PMO, and other groups sufficient to document what we need to document? Are they accessible and easy to use? Are they automated and integrated so we only have to enter data once?
      2. On the slide following these activity instructions, rate how effective each of the above is on a scale of 1-10 (where 10 is very effective) in supporting the budgeting process. Note specific areas of challenge and opportunity for change.

      1.1 Review your budgeting process and culture

      Input Output Materials Participants
      • Organizational knowledge of typical budgeting processes
      • Copies of budgeting policies, procedures, and tools
      • Rated assessment of your organization’s budget process and culture, as well as major areas of challenge and opportunity for change
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Budget process and culture assessment

      Document the outcomes of your assessment. Examples are provided below.

      Budgeting area of assessment

      Rating

      1 = very ineffective

      10 = very effective

      Challenges

      Opportunities for change

      Legal and regulatory mandates

      7

      Significant regulation but compliance steps not clear or supported within departments.

      Create, communicate, and train management on compliance procedures and align the financial management tools accordingly.

      Accounting rules

      6

      IT not very familiar with them.

      Learn more about them and their provisions to see if IT spend can be better represented.

      Timeframes and deadlines

      5

      Finalize capital project plans for next fiscal four months before end of current fiscal.

      Explore flexible funding models that allow changes to budget closer to project execution.

      Order of operations

      3

      Setting CapEx before OpEx leads to paring of necessary OpEx based on CapEx commitments.

      Establish OpEx first as a baseline and then top up to target budget with CapEx.

      Areas of focus

      6

      Lack of focus on OpEx means incremental budgeting – we don’t know what’s in there.

      Perform zero-based budgeting on OpEx every few years to re-rationalize this spend.

      Funding sources and ownership

      4

      IT absorbing unplanned mid-cycle spend due to impact of unknown business actions.

      Implement a show-back mechanism to change behavior or as precursor to limited charge-back.

      Review/approval mechanisms

      8

      CFO is fair and objective with information presented but could demand more evidence.

      Improve business sponsorship/fronting of new initiative business cases and IT partnership.

      Templates and tools

      2

      Finance budget template largely irrelevant and unreflective of IT: only two relevant categories.

      Adjust account buckets over a period of time, starting with SW/HW and cloud breakouts.

      Receptive audiences make communication a lot easier

      To successfully communicate anything, you need to be heard and understood.

      The key to being heard and understood is first to hear and understand the perspective of the people with whom you’re trying to communicate – your stakeholders. This means asking some questions:

      • What context are they operating in?
      • What are their goals and responsibilities?
      • What are their pressures and stresses?
      • How do they deal with novelty and uncertainty?
      • How do they best take in information and learn?

      The next step of this blueprint shows the perspectives of IT’s key stakeholders and how they’re best able to absorb and accept the important information contained in your IT budget. You will:

      • Learn a process for discovering these stakeholders’ IT budget information needs within the context of your organization’s industry, goals, culture, organizational structure, personalities, opportunities, and constraints.
      • Document key objectives and messages when communicating with these various key stakeholders.

      There are certain principles, mandates, and priorities that drive your stakeholders; they’ll want to see these reflected in you, your work, and your budget.

      Your IT budget means different things to different stakeholders

      Info-Tech’s ITFM Cost Model lays out what matters most from various points of view.

      The image contains a screenshot of Info-Tech's ITFM Cost Model.

      The CFO: Understand their role

      The CFO is the first person that comes to mind in dealing with budgets. They’re personally and professionally on the line if anything runs amiss with the corporate purse.

      What are the CFO’s role and responsibilities?

      • Tracking cash flow and balancing income with expenditures.
      • Ensuring fiscal reporting and legal/regulatory compliance.
      • Working with the CEO to ensure financial-strategic alignment.
      • Working with business unit heads to set aligned budgets.
      • Seeing the big picture.

      What’s important to the CFO?

      • Costs
      • Benefits
      • Value
      • Analysis
      • Compliance
      • Risk Management
      • Strategic alignment
      • Control
      • Efficiency
      • Effectiveness
      • Reason
      • Rationale
      • Clarity
      • Objectivity
      • Return on investment

      “Often, the CFO sees IT requests as overhead rather than a need. And they hate increasing overhead.”

      – Larry Clark, Executive Counselor, Info-Tech Research Group and Former CIO

      The CFO carries big responsibilities focused on mitigating organizational risks. It’s not their job to be generous or flexible when so much is at stake. While the CEO appears higher on the organizational chart than the CFO, in many ways the CFO’s accountabilities and responsibilities are on par with, and in some cases greater than, those of the CEO.

      The CFO: What they want from the IT budget

      What they need should look familiar, so do your homework and be an open book.

      Your CFO’s IT budget to-do list:

      Remember to:

      • A review of the previous year financial performance. This demonstrates to the CFO your awareness, savvy, and overall competence in the financial management realm. This is also your opportunity to start laying out the real-life context within which IT has been operating. Information to show includes:
        • Budget vs. actuals, including an overview of factors that led to major variances.
        • Percentage difference in proposed budget versus previous year’s budget, and major contributing factors to those differences (i.e. unanticipated projects, changes, or events).
      • Presentation of information according to Finance’s existing categories. This makes it as easy as possible for them to plug your numbers into their system.
      • Separate views of overall workforce vs. overall vendor spending. This is a traditional view.
      • Separate views of capital expenditure (CapEx) and operating expenditure (OpEx). This also includes information on expected lifespan of proposed new capital assets to inform depreciation/amortization decisions.
      • Explanation of anticipated sources of funding. Specifically, indicate whether the funding required is a brand-new net increase or a reallocation from the existing pool.
      • Details (upon request). Have these available for every aspect of your proposed budget.
      • Avoid being flashy. Exclude proposed expenditures with a lot of bells and whistles that don’t directly tie to concrete business objectives.
      • Be a conservationist. Show how you plan to re-use or extend assets that you already have.
      • Act like a business leader. Demonstrate your understanding of near-term (12-month) realities, priorities, and goals.
      • Think like them. Present reliable and defensible calculations of benefits versus risks as well as projected ROI for major areas of new or different spending.

      The CFO: Budget challenges and opportunities

      Budget season is a great time to start changing the conversation and building trust.

      Potential challenges

      Low trust

      Poor financial literacy and historical sloppiness among business unit leaders means that a CFO may come into budget conversations with skepticism. This can put them on the offensive and put you on the defensive. You have to prove yourself.

      Competition

      You’re not the only department the CFO is dealing with. Everyone is competing for their piece of the pie, and some business unit leaders are persistent. A good CFO will stay out of the politics and not be swayed by sweet talk, but it can be an exhausting experience for them.

      Mismatched buckets

      IT’s spend classes and categories probably won’t match what’s in Finance’s budget template or general ledger. Annual budgeting isn’t the best time to bring this up. Respect Finance’s categories, but plan to tackle permanent changes at a less busy time.

      Potential opportunities

      Build confidence

      Engaging in the budgeting process is your best chance to demonstrate your knowledge about the business and your financial acumen. The more that the CFO sees that you get it and are taking it seriously, the more confidence and trust they’ll have in you.

      Educate

      The CFO will not know as much as you about the role technology could and should play in the organization. Introduce new language around technology focused on capabilities and benefits. This will start to shift the conversation away from costs and toward value.

      Initiate alignment

      An important governance objective is to change the way IT expenditure is categorized and tracked to better reveal and understand what’s really happening. This process should be done gradually over time, but definitely communicate what you want to do and why.

      The CXO: Understand their role

      CXOs are a diverse group who lead a range of business functions including admin, operations, HR, legal, production, sales and service, and marketing, to name a few.

      What are the CXO’s role and responsibilities?

      Like you, the CXO’s job is to help the organization realize its goals and objectives. How each CXO does this is specific to the domain they lead. Variations in roles and responsibilities typically revolve around:

      • Law and regulation. Some functions have compliance as a core mandate, including legal, HR, finance, and corporate risk groups.
      • Finance and efficiency. Other functions prioritize time, money, and process such as finance, sales, customer service, marketing, production, operations, and logistics units.
      • Quality. These functions prioritize consistency, reliability, relationship, and brand such as production, customer service, and marketing.

      What’s important to the CXO?

      • Staffing
      • Skills
      • Reporting
      • Funding
      • Planning
      • Performance
      • Predictability
      • Customers
      • Visibility
      • Inclusion
      • Collaboration
      • Reliability
      • Information
      • Knowledge
      • Acknowledgement

      Disagreement is common between business-function leaders – they have different primary focus areas, and conflict and misalignment are natural by-products of that fact. It’s also hard to make someone care as much about your priorities as you do. Focus your efforts on sharing and partnering, not converting.

      The CXO: What they want from the IT budget

      Focus on their unique part of the organization and show that you see them.

      Your CXO’s IT budget to-do list:

      Remember to:

      • A review of the previous year’s IT expenditure on the business function. This includes:
        • Budget vs. actuals (if available) for the business function, and overview of any situations or factors that led to major variances.
        • Percentage difference in proposed budget for that business function vs. the previous year’s spend, and major contributing factors to those differences, i.e. unanticipated projects, changes, or events.
        • Last year’s IT expenditure per business function employee vs. proposed IT expenditure per business function employee (if available). This is a good metric to use going forward as it’s a fair comparative internal benchmark.
      • Separate views of proposed IT workforce vs. proposed IT vendor spending for the business function. Do a specific breakout of proposed expenditure for the major applications that business unit explicitly uses.
      • Separate views of proposed IT capital expenditure (CapEx) and proposed IT operating expenditure (OpEx) for the business function. Show breakdowns for each capital project,
        as well as summaries for their core applications and portion of shared IT services.
      • Celebrate any collaborative wins from last year. You want to reinforce that working together is in both of your best interests and you’d like to keep it going.
      • Get to the apps fast. Apps are visible, concrete, and relatable – this is what the CXO cares about. Core IT infrastructure, on the other hand, is technobabble about something that’s invisible, boring, and disengaging for most CXOs.
      • Focus on the business function’s actual technology needs and consumption. Show them where they stand in relation to others. This will get their attention and serve as an opportunity to provide some education.

      The CXO: Budget challenges and opportunities

      Seek out your common ground and be the solution for their real problems.

      Potential challenges

      Different priorities

      Other business unit leaders will have bigger concerns than your IT budget. They have their own budget to figure out plus other in-flight issues. The head of sales, for instance, is going to be more concerned with hitting sales goals for this fiscal year than planning for next.

      Perceived irrelevance

      Some business unit leaders may be completely unaware of how they use IT, how much they use, and how they could use it more or differently to improve their performance. They may have a learning curve to tackle before they can start to see your relationship as collaborative.

      Bad track record

      If a business unit has had friction with IT in the past or has historically been underserved, they may be hesitant to let you in, may be married to their own solutions, or perhaps do not know how to express what they need.

      Potential opportunities

      Start collaborating

      You and other business unit leaders have a lot in common. You all share the objective of helping the organization succeed. Focus in on your shared concerns and how you can make progress on them together before digging into your unique challenges.

      Practice perspective taking

      Be genuinely curious about the business unit, how it works, and how they overcome obstacles. See the organization from their point of view. For now, keep your technologies completely out of the discussion – that will come later on.

      Build relationships

      You only need to solve one problem for a business unit to change how they think of you. Just one. Find that one thing that will make a real difference – ideally small but impactful – and work it into your budget.

      The CEO: Understand their role

      A CEO sets the tone for an organization, from its overall direction and priorities to its values and culture. What’s possible and what’s not is usually determined by them.

      What are the CEO’s role and responsibilities?

      • Assemble an effective team of executives and advisors.
      • Establish, communicate, and exemplify the organizations core values.
      • Study the ecosystem within which the organization exists.
      • Identify and evaluate opportunities.
      • Set long-term directions, priorities, goals, and strategies.
      • Ensure ongoing organizational performance, profitability, and growth.
      • Connect the inside organization to the outside world.
      • Make the big decisions no one else can make.

      What’s important to the CEO?

      • Strategy
      • Leadership
      • Vision
      • Values
      • Goals
      • Priorities
      • Performance
      • Metrics
      • Accountability
      • Stakeholders
      • Results
      • Insight
      • Growth
      • Cohesion
      • Context

      Unlike the CFO and CXOs, the CEO is responsible for seeing the big picture. That means they’re operating in the realm of big problems and big ideas – they need to stay out of the weeds. IT is just one piece of that big picture, and your problems and ideas are sometimes small in comparison. Use any time you get with them wisely.

      The CEO: What they want from the IT budget

      The CEO wants what the CFO wants, but at a higher level and with longer-term vision.

      Your CEO’s IT budget to-do list:

      Remember to:

      • A review of the previous year’s financial performance. In addition to last year’s budget vs. actuals vs. proposed budget and any rationales for variances, the CEO’s interest is in seeing numbers in terms of strategic delivery. Focus on performance against last year’s goals and concrete benefits realized.
      • A review of initiatives undertaken to optimize/reduce operating costs. Note overall gains with a specific look at initiatives that had a substantial positive financial impact.
      • A specific summary of the cost landscape for new strategic or capital projects. Ideally, these projects have already been committed to at the executive level. A more fine-tuned analysis of anticipated costs and variables may be required, including high-level projects with long-term impact on operational expenditure. Categorize these expenditures as investments in innovation, growth, or keeping the lights on.
      • Details (upon request). Have these available for every aspect of your proposed budget.
      • Be brief. Hopefully, the CEO is already well versed on the strategic spend plans. Stay high-level, reserve the deep dive for your documentation, and let the CEO decide if they want to hash anything out in more detail.
      • Be strategic. If you can’t tie it to a strategic objective, don’t showcase it.
      • Use performance language. This means citing goals, metrics, and progress made against them.
      • Ensure the CFO can translate. You may not get a direct audience with the CEO – the CFO may be your proxy for that. Ensure that everything is crystal clear so that the CFO can summarize your budget on your behalf.

      The CEO: Budget challenges and opportunities

      Strategically address the big issues, but don’t count on their direct assistance.

      Potential challenges

      Lack of interest

      Your CEO may just not be enthusiastic about technology. For them, IT is strictly a cost center operating on the margins. If they don’t have a strategic vision that includes technology, IT’s budget will always be about efficiency and cost control and not investment.

      Deep hierarchy

      The executive-level CIO role isn’t yet pervasive in every industry. There may be one or more non-IT senior management layers between IT and the office of the CEO, as well as other bureaucratic hurdles, which prohibit your direct access.

      Uncertainty

      What’s happening on the outside will affect what needs to be done on the inside. The CEO has to assess and respond quickly, changing priorities and plans in an instant. An indecisive CEO that’s built an inflexible organization will make it difficult to pivot as needed.

      Potential opportunities

      Grow competency

      Sometimes, IT just needs to wait it out. The biggest shifts in technology interest often come with an outright change in the organization’s leadership. In the meantime, fine-tune your operational excellence, brush up on business skills, and draft out your best ideas on paper.

      Build partnerships

      Other business-function executives may need to be IT’s voice. Investment proposals may be more compelling coming from them anyway. Behind-the-scenes partnerships and high-profile champions are something you want regardless of your degree of CEO access.

      Bake in resilience

      Regardless of who’s at the helm, systematic investment in agile and flexible solutions that can be readily scaled, decoupled, redeployed, or decommissioned is a good strategy. Use recent crises to help make the strategic case for a more resilient posture.

      What about the CIO view on the IT budget?

      IT leaders tend to approach budgeting from an IT services perspective. After all, that’s how their departments are typically organized.

      The CFO expense view, CXO business view, and CEO innovation view represent IT’s stakeholders. The CIO service view, however, represents you, the IT budget creator. This means that the CIO service view plays a slightly different role in developing your IT budget communications.

      An IT team effort…

      A logical starting point

      A supporting view

      Most budget drafts start with internal IT management discussion. These managers are differentially responsible for apps dev and maintenance, service desk and user support, networks and data center, security, data and analytics, and so forth.

      These common organizational units and their managers tend to represent discrete IT service verticals. This means the CIO service view is a natural structural starting point for your budget-building process. Stakeholder views of your budget will be derived from this first view.

      You probably don’t want to lead your budget presentation with IT’s perspective – it won’t make sense to your stakeholders. Instead, select certain impactful pieces of your view to drop in where they provide valued information and augment the IT budget story.

      Things to bring forward…

      Things to hold back…

      • All major application costs
      • Security/compliance costs
      • Strategic project costs
      • End-user support and enablement costs
      • Data and BI initiative costs
      • Minor applications costs
      • Day-to-day network and data center costs
      • Other infrastructure costs
      • IT management and administration costs

      1.2 Assess your stakeholders

      1 hour

      1. Use the “Stakeholder alignment assessment” template slide following this one to document the outcomes of this activity.
      2. As an IT management team, identify your key budget stakeholders and specifically those in an approval position.
      3. Use the information provided in this blueprint about various stakeholder responsibilities, areas of focus, and what’s typically important to them to determine each key stakeholder’s needs regarding the information contained in your IT budget. Note their stated needs, any idiosyncrasies, and IT’s current relationship status with the stakeholder (positive, neutral, or negative).
      4. Assess previous years’ IT budgets to determine how well they targeted each different stakeholder’s needs. Note any gaps or areas for future improvement.
      5. Develop a high-level list of items or elements to stop, start, or continue during your next budgeting cycle.
      Input Output
      • Organizational awareness of key stakeholders and budget approvers
      • Previous years’ budgets
      • Assessment of key stakeholder needs and a list of potential changes or additions to the IT budget/budget process
      Materials Participants
      • Whiteboard/flip charts
      • Stakeholder alignment assessment template (following slide)
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Stakeholder alignment assessment

      Document the outcomes of your assessment below. Examples are provided below.

      Stakeholder

      Relationship status

      Understanding of needs

      Budget changes/additions

      CFO

      Positive

      Wants at least 30% of budget to be CapEx. Needs more detail concerning benefits and tracking of realization.

      Do more detailed breakouts of CapEx vs. OpEx as 30% CapEx not realistic – pre-meet. Talk to Enterprise PMO about improving project benefits statement template.

      VP of Sales

      Negative

      Only concerned with hitting sales targets. Needs to respond/act quickly based on reliable data.

      Break out sales consumption of IT resources in detail focusing on CRM and SFA tool costs. Propose business intelligence enhancement project.

      Director of Marketing

      Neutral

      Multiple manual processes – would benefit from increased automation of campaign management and social media posting.

      Break out marketing consumption of IT resources and publicly share/compare to generate awareness/support for tech investment. Work together to build ROI statements

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Positive/Neutral/Negative]

      [Insert text]

      [Insert text]

      Set your IT budget pre-selling strategy

      Pre-selling is all about ongoing communication with your stakeholders. This is the most game-changing thing you can do to advance a proposed IT budget’s success.

      When IT works well, nobody notices. When it doesn’t, the persistent criticism about IT not delivering value will pop up, translating directly into less funding. Cut this off at the pass with an ongoing communications strategy based on facts, transparency, and perspective taking.

      1. Know your channels
      2. Identify all the communication channels you can leverage including meetings, committees, reporting cycles, and bulletins. Set up new channels if they don’t exist.

      3. Identify partners
      4. Nothing’s better than having a team of supporters when pitch day comes. Quietly get them on board early and be direct about the role each of you will play.

      5. Always be prepared
      6. Have information and materials about proposed initiatives at-the-ready. You never know when you’ll get your chance. But if your facts are still fuzzy, do more homework first.

      7. Don’t be annoying
      8. Talking about IT all the time will turn people off. Plan chats that don’t mention IT at all. Ask questions about their world and really listen. Empathy’s a powerful tool.

      9. Communicate IT initiatives at launch
      10. Describe what you will be doing and how it will benefit the business in language that makes sense to the beneficiaries of the initiative.

      11. Communicate IT successes
      12. Carry the same narrative forward through to the end and tell the whole story. Include comments from stakeholders and beneficiaries about the value they’re receiving.

      Pre-selling with partners

      The thing with pre-selling to partners is not to take a selling approach. Take a collaborative approach instead.

      A partner is an influencer, advocate, or beneficiary of the expenditure or investment you’re proposing. Partners can:

      • Advise you on real business impacts.
      • Voice their support for your funding request.
      • Present the initial business case for funding approval themselves.
      • Agree to fund all or part of an initiative from their own budget.

      When partners agree to pitch or fund an initiative, IT can lose control of it. Make sure you set specific expectations about what IT will help with or do on an ongoing basis, such as:

      • Calculating the upfront and ongoing technology maintenance/support costs of the initiative.
      • Leading the technology vetting and selection process, including negotiating with vendors, setting service-level agreements, and finalizing contracts.
      • Implementing selected technologies and training users.
      • Maintaining and managing the technology, including usage metering.
      • Making sure the bills get paid.

      A collaborative approach tends to result in a higher level of commitment than a selling approach.

      Put yourself in their shoes using their language. Asking “How will this affect you?” focuses on what’s in it for them.

      Example:

      CIO: “We’re thinking of investing in technology that marketing can use to automate posting content to social media. Is that something you could use?”

      CMO: “Yes, we currently pay two employees to post on Facebook and Twitter, so if it could make that more efficient, then there would be cost savings there.”

      Pre-selling with approvers

      The key here is to avoid surprises and ensure the big questions are answered well in advance of decision day.

      An approver is the CFO, CEO, board, council, or committee that formally commits funding support to a program or initiative. Approvers can:

      • Point out factors that could derail realization of intended benefits.
      • Know that a formal request is coming and factor it into their planning.
      • Connect your idea with others to create synergies and efficiencies.
      • Become active advocates.

      When approvers cool to an idea, it’s hard to warm them up again. Gradually socializing an idea well in advance of the formal pitch gives you the chance to isolate and address those cooling factors while they’re still minor. Things you can address if you get an early start with future approvers include:

      • Identify and prepare for administrative, regulatory, or bureaucratic hurdles.
      • Incorporate approvers’ insights about organizational realities and context.
      • Further reduce the technical jargon in your language.
      • Fine tune the relevance and specificity of your business benefits statements.
      • Get a better sense of the most compelling elements to focus on.

      Blindsiding approvers with a major request at a budget presentation could trigger an emotional response, not the rational and objective one you want.

      Make approvers part of the solution by soliciting their advice and setting their expectations well in advance.

      Example:

      CIO: “The underwriting team and I think there’s a way to cut new policyholder approval turnaround from 8 to 10 days down to 3 or 4 using an online intake form. Do you see any obstacles?”

      CFO: “How do the agents feel about it? They submit to underwriting differently and might not want to change. They’d all need to agree on it. Exactly how does this impact sales?”

      1.3 Set your budget pre-selling strategy

      1 hour

      1. Use the “Stakeholder pre-selling strategy” template slide following this instruction slide to document the outcomes of this activity.
      2. Carry forward your previously-generated stakeholder alignment assessment from Step 1.2. As a management team, discuss the following for each stakeholder:
        1. Forums and methods of contact and interaction.
        2. Frequency of interaction.
        3. Content or topics typically addressed during interactions.
      3. Discuss what the outcomes of an ideal interaction would look like with each stakeholder.
      4. List opportunities to change or improve the nature of interactions and specific actions you plan to take.
      InputOutput
      • Stakeholder Alignment Assessment (in-deck template)
      • Stakeholder Pre-selling Strategy
      MaterialsParticipants
      • Stakeholder Pre-selling Strategy (in-deck template)
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Stakeholder pre-selling strategy

      Document the outcomes of your discussion. Examples are provided below.

      Stakeholder

      Current interactions

      Opportunities and actions

      Forum

      Frequency

      Content

      CFO

      One-on-one meeting

      Monthly

      IT expenditure updates and tracking toward budgeted amount.

      Increase one-on-one meeting to weekly. Alternate focus – retrospective update one week, future-looking case development the next. Invite one business unit head to future-looking sessions to discuss their IT needs.

      VP of Sales

      Executive meeting

      Quarterly

      General business update - dominates.

      Set up bi-weekly one-on-one meeting – initially focus on what sales does/needs, not tech. Later, when the relationship has stabilized, bring data that shows Sales’ consumption of IT resources.

      Director of Marketing

      Executive meeting

      Quarterly

      General business update - quiet.

      Set up monthly one-on-one meeting. Temporarily embed BA to better discover/understand staff processes and needs.

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      [Name/Title]

      [Insert text]

      [Insert text]

      [Insert text]

      [Insert text]

      Phase recap: Lay your foundation

      Build in the elements from the start that you need to facilitate budgetary approval.

      You should now have a deeper understanding of the what, why, and who of your IT budget. These elements are foundational to streamlining the budget process, getting aligned with peers and the executive, and increasing your chances of winning budgetary approval in the end.

      In this phase, you have:

      • Reviewed what your budget is and does. Your budget is an important governance and communication tool that reflects organizational priorities and objectives and IT’s understanding of them.
      • Taken a closer look at your stakeholders. The CFO, CEO, and CXOs in your organization have accountabilities of their own to meet and need IT and its budget to help them succeed.
      • Developed a strategy for continuously pre-selling your budget. Identifying opportunities and approaches for building relationships, collaborating, and talking meaningfully about IT and IT expenditure throughout the year is one of the leading things you can do to get on the same page and pave the way for budget approval.

      “Many departments have mostly labor for their costs. They’re not buying a million and a half or two million dollars’ worth of software every year or fixing things that break. They don’t share IT’s operations mindset and I think they get frustrated.”

      – Matt Johnson, IT Director Governance and Business Solutions, Milwaukee County

      Phase 2

      Get Into Budget-Starting Position

      Lay Your
      Foundation

      Get Into Budget-Starting Position

      Develop Your
      Forecasts

      Build Your
      Proposed Budget

      Create and Deliver Your Presentation

      1.1 Understand what your budget is
      and does

      1.2 Know your stakeholders

      1.3 Continuously pre-sell your budget

      2.1 Assemble your resources

      2.2 Understand the four views of the ITFM Cost Model

      2.3 Review last year’s budget vs.
      actuals and five-year historical trends

      2.4 Set your high-level goals

      3.1 Develop assumptions and
      alternative scenarios

      3.2 Forecast your project CapEx

      3.3 Forecast your non-project CapEx and OpEx

      4.1 Aggregate your numbers

      4.2 Stress test your forecasts

      4.3 Challenge and perfect your
      rationales

      5.1 Plan your content

      5.2 Build your presentation

      5.3 Present to stakeholders

      5.4 Make final adjustments and submit your IT budget

      This phase will walk you through the following activities:

      • Putting together your budget team and gather your data.
      • Selecting which views of the ITFM Cost Model you’ll use.
      • Mapping and analyzing IT’s historical expenditure.
      • Setting goals and metrics for the next budgetary cycle.

      This phase involves the following participants:

      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Get into budget-starting position

      Now’s the time to pull together your budgeting resources and decision-making reference points.

      This phase is about clarifying your context and defining your boundaries.

      • Assemble your resources. This includes the people, data, and other information you’ll need to maximize insight into future spend requirements.
      • Understand the four views of the IT Cost Model. Firm up your understanding of the CFO expense view, CIO service view, CXO business view, and CEO innovation view and decide which ones you’ll use in your analysis and forecasting.
      • Review last year’s budget versus actuals. You need last year’s context to inform next year’s numbers as well as demonstrate any cost efficiencies you successfully executed.
      • Review five-year historical trends. This long-term context gives stakeholders and approvers important information about where IT fits into the business big picture and reminds them how you got to where you are today.
      • Set your high-level goals. You need to decide if you’re increasing, decreasing, or holding steady on your budget and whether you can realistically meet any mandates you’ve been handed on this front. Set a target as a reference point to guide your decisions and flag areas where you might need to have some tough conversations.

      “A lot of the preparation is education for our IT managers so that they understand what’s in their budgets and all the moving parts. They can actually help you keep it within bounds.”

      – Trisha Goya, Director, IT Governance & Administration, Hawaii Medical Service Association

      Gather your budget-building team

      In addition to your CFO, CXOs, and CEO, there are other people who will provide important information, insight, and skill in identifying IT budget priorities and costs.

      Role

      Skill set

      Responsibilities

      IT Finance Lead

      • Financial acumen, specifically with cost forecasting and budgeting.
      • Understanding of actual IT costs and service-based costing methods.

      IT finance personnel will guide the building of cost forecasting methodologies for operating and capital costs, help manage IT cash flows, help identify cost reduction options, and work directly with the finance department to ensure they get what they need.

      IT Domain Managers

      • Knowledge of services and their outputs.
      • Understanding of cost drivers for the services they manage.

      They will be active participants in budgeting for their specific domains, act as a second set of eyes, assist with and manage their domain budgets, and engage with stakeholders.

      Project Managers

      • Knowledge of project requirements.
      • Project budgeting.
      • Understanding of project IT-specific costs.

      Project managers will assist in capital and operational forecasting and will review project budgets to ensure accuracy. They will also assist in forecasting the operational impacts of capital projects.

      As the head of IT, your role is as the budgeting team lead. You understand both the business and IT strategies, and have relationships with key business partners. Your primary responsibilities are to guide and approve all budget components and act as a liaison between finance, business units, and IT.

      Set expectations with your budgeting team

      Be clear on your goals and ensure everyone has what they need to succeed.

      Your responsibilities and accountabilities.

      • Budget team lead.
      • Strategic direction.
      • Primary liaison with business stakeholders.
      • Pre-presentation approver and final decision maker.

      Goals and requirements.

      • Idea generation for investment and cost optimization.
      • Cost prioritization and rationale.
      • Skills requirements and sourcing options.
      • Risk assessment and operational impact.
      • Data format and level of granularity.

      Budgeting fundamentals.

      • Review of key finance concepts – CapEx, OpEx, cashflow, income, depreciation, etc.
      • What a budget is, and its component parts.
      • How the budget will be used by IT and the organization.
      • How to calculate cost forecasts.

      Their responsibilities and accountabilities.

      • Data/information collection.
      • Operational knowledge of their services, projects, and staff.
      • Cost forecast development for their respective domains/projects.
      • Review and sanity checking of their peers’ cost forecasts.

      Timeframes and deadlines.

      • Budgeting stages/phases and their deliverables.
      • Internal IT deadlines.
      • External business deadlines.
      • Goals and cadence of future working sessions and meetings.

      Available resources.

      • Internal and external sources of data and information.
      • Tools and templates for tracking information and performing calculations.
      • Individuals who can provide finance concept guidance and support.
      • Repositories for in-progress and final work.

      2.1 Brief and mobilize your IT budgeting team

      2 hours

      1. Download the IT Cost Forecasting and Budgeting Workbook
      2. Organize a meeting with your IT department management team, team leaders, and project managers.
      3. Review their general financial management accountabilities and responsibilities.
      4. Discuss the purpose and context of the budgeting exercise, different budget components, and the organization’s milestones/deadlines.
      5. Identify specific tasks and activities that each member of the team must complete in support of the budgeting exercise.
      6. Set up additional checkpoints, working sessions, or meetings that will take you through to final budget submission.
      7. Document your budget team members, responsibilities, deliverables, and due dates on the “Planning Variables” tab in the IT Cost Forecasting & Budgeting Workbook.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • The organization’s budgeting process and procedures
      • Assignment of IT budgeting team responsibilities
      • A budgeting schedule
      MaterialsParticipants
      • IT Cost Forecasting and Budgeting Workbook
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Leverage the ITFM Cost Model

      Each of the four views breaks down IT costs into a different array of categories so you and your stakeholders can see expenditure in a way that’s meaningful for them.

      You may decide not to use all four views based on your goals, audience, and available time. However, let’s start with how you can use the first two views, the CFO expense view and the CIO service view.

      The image contains a screenshot of the CFO expense view.

      The CFO expense view is fairly traditional – workforce and vendor. However, Info-Tech’s approach breaks down the vendor software and hardware buckets into on-premises and cloud. Making this distinction is increasingly critical given key differences in CapEx vs. OpEx treatment.

      Forecasting this view is mandatory

      These two views provide information that will help you optimize IT costs. They’re designed to allow the CFO and CIO to find a common language that will allow them to collaboratively make decisions about managing IT expenditure effectively.

      The image contains a screenshot of the CIO service view.

      The CIO service view is your view, i.e. it’s how IT tends to organize and manage itself and is often the logical starting point for expenditure planning and analysis. Sub-categories in this view, such as security and data & BI, can also resonate strongly with business stakeholders and their priorities.

      Forecasting this view is recommended

      Extend your dialogue to the business

      Applying the business optimization views of the ITFM Cost Model can bring a level of sophistication to your IT cost analysis and forecasting efforts.

      Some views take a bit more work to map out, but they can be powerful tools for communicating the value of IT to the business. Let’s look at the last two views, the CXO business view and the CEO innovation view.

      The CXO business view looks at IT expenditure business unit by business unit so that each can understand their true consumption of IT resources. This view relies on having a fair and reliable cost allocation formula, such as one based on relative headcount, so it runs the risk of inaccuracy.

      Forecasting this view is recommended

      The image contains a screenshot of the CXO business view.

      These two views provide information that will help you optimize IT support to the business. These views also have a collaborative goal in mind, enabling IT to talk about IT spend in terms that will promote transparency and engage business stakeholders.

      The CEO innovation view is one of the hardest to analyze and forecast since a single spend item may apply to innovation, growth, and keeping the lights on. However, if you have an audience with the CEO and they want IT to play a more strategic or innovative role, then this view is worth mapping.

      Forecasting this view is optional

      The image contains a screenshot of the CEO innovation view.

      2.2 Select the ITFM Cost Model views you plan to complete based on your goals

      30 minutes

      The IT Cost Forecasting and Budgeting Workbook contains standalone sections for each view, as well as rows for each lowest-tier sub-category in a view, so each view can be analyzed and forecasted independently.

      1. Review Info-Tech’s ITFM Cost Model and the expenditure categories and sub-categories each view contains.
      2. Revisit your stakeholder analysis for the budgeting exercise. Plan to:
        1. Complete the CFO expense view regardless.
        2. Complete the CIO service view – consider doing this one first for forecasting purposes as it may be most familiar to you and serve as an easier entry point into the forecasting process.
        3. Complete the CXO business view – consider doing this only for select business units if you have the objective of enhancing awareness of their true consumption of IT resources or if you have (or plan to have) a show-back/chargeback mechanism.
        4. Complete the CEO innovation view only if your data allows it and there’s a compelling reason to discuss the strategic or innovative role of IT in the organization.
      Input Output
      • Stakeholder analysis
      • Info-Tech’s ITFM Cost Model
      • Decision on which views in the ITFM Cost Model you’ll use for historical expenditure analysis and forecasting purposes
      Materials Participants
      • Info-Tech’s ITFM Cost Model
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Gather your budget-building data

      Your data not only forms the content of your budget but also serves as the supporting evidence for the decisions you’ve made.

      Ensure you have the following data and information available to you and your budgeting team before diving in:

      Past data

      • Last fiscal year’s budget.
      • Actuals for the past five fiscal years.
      • Pre-set capital depreciation/amortization amounts to be applied to next fiscal year’s budget.

      Current data

      • Current-year IT positions and salaries.
      • Active vendor contracts with payment schedules and amounts (including active multi-year agreements).
      • Cost projections for remainder of any projects that are committed or in-progress, including projected OpEx for ongoing maintenance and support.

      Future data

      • Estimated market value for any IT positions to be filled next year (both backfill of current vacancies and proposed net-new positions).
      • Pricing data on proposed vendor purchases or contracts.
      • Cost estimates for any capital/strategic projects that are being proposed but not yet committed, including resulting maintenance/support OpEx.
      • Any known pending credits to be received or applied in the next fiscal year.

      If you’re just getting started building a repeatable budgeting process, treat it like any other project, complete with a formal plan/ charter and a central repository for all related data, information, and in-progress and final documents.

      Once you’ve identified a repeatable approach that works for you, transition the budgeting project to a regular operational process complete with policies, procedures, and tools.

      Review last year’s budget vs. actuals

      This is the starting point for building your high-level rationale around what you’re proposing for next fiscal year.

      But first, some quick definitions:

      • Budgeted: What you planned to spend when you started the fiscal year.
      • Actual: What you ended up spending in real life by the end of the fiscal year.
      • Variance: The difference between budgeted expenditure and actual expenditure.

      For last fiscal year, pinpoint the following metrics and information:

      Budgeted and actual IT expenditure overall and by major cost category.

      Categories will include workforce (employees/contractors) and vendors (hardware, software, contracted services) at a minimum.

      Actual IT expenditure as a percentage of organizational revenue.

      This is a widely-used benchmark that your CFO will expect to see.

      The known and likely drivers behind budgeted vs. actual variances.

      Your rationales will affect your perceived credibility. Be straightforward, avoid defending or making excuses, and just show the facts.

      Ask your CFO what they consider acceptable variance thresholds for different cost categories to guide your variance analysis, such as 1% for overall IT expenditure.

      Actual IT CapEx and OpEx.

      CapEx is often more variable than OpEx over time. Separate them so you can see the real trends for each. Consider:

      • Sub-dividing CapEx by strategic projects and non-strategic “business as usual” spend (e.g. laptops, network maintenance gear).
      • Showing overall CapEx and OpEx as percentages of their organization-wide counterparts if that information is available.

      Next, review your five-year historical expenditure trends

      The longer-term pattern of IT expenditure can help you craft a narrative about the overarching story of IT.

      For the previous five fiscal years, focus on the following:

      Actual IT expenditure as a percentage of organizational revenue.

      Again, for historical years 2-5, you can break this down into granular cost categories like workforce, software, and infrastructure like you did for last fiscal year. Avoid getting bogged down and focusing on the past – you ultimately want to redirect stakeholders to the future.

      Percentage expenditure increase/decrease year to year.

      You may choose to show overall IT expenditure amounts, breakdowns by CapEx and OpEx, as well as high-level cost categories.

      As you go back in time, some data may not be available to you, may be unreliable or incomplete, or employ the same cost categories you’re using today. Use your judgement on the level of granularity you want to and can apply when going back two to five years in the past.

      So, what’s the trend? Consider these questions:

      • Is the year-over-year trend on a steady trajectory or are there notable dips and spikes?
      • Are there any one-time capital projects that significantly inflated CapEx and overall spend in a given year or that forced maintenance-and support-oriented OpEx commitments in subsequent years?
      • Does there seem to be an overall change in the CapEx-to-OpEx ratio due to factors like increased use of cloud services, outsourcing, or contract-based staff?

      Take a close look at financial data showcasing the cost-control measures you’ve taken

      Your CFO will look for evidence that you’re gaining efficiencies by controlling costs, which is often a prerequisite for them approving any new funding requests.

      Your objective here is threefold:

      1. Demonstrate IT’s track record of fiscal responsibility and responsiveness to business priorities.
      2. Acknowledge and celebrate your IT-as-cost-center efficiency gains to clear the way for more strategic discussions.
      3. Identify areas where you can potentially source and reallocate recouped funds to bolster other initiatives or business cases for net-new spend.

      This step is about establishing credibility, demonstrating IT value, building trust, and showing the CFO you’re on their team.

      Do the following:

      • List any specific cost-control initiatives and their initial objectives and targets.
      • Identify any changes made to those targets and your approaches due to changing conditions, with rationales for the decisions made. For example:
        • Mid-year, the business decided to allow approximately half the workforce to work from home on a permanent basis.
        • As a result, remote-worker demand on the service desk remained high and actually increased in some areas. You were unable to reduce service desk staff headcount as originally planned.
        • You’re now exploring ways to streamline ticket intake and assignment to increase throughput and speed resolution.
      • Report on completed cost-control initiatives first, including targets, actuals, and related impacts. Include select feedback from business stakeholders and users about the impact of your cost-control measure on them.
      • For in-progress initiatives, report progress made to-date, benefits realized to date, and plans for continuation next fiscal year.

      “Eliminate the things you don’t need. People will give you what you need when you need it if you’re being responsible with what you already have.”

      – Angela Hintz, VP of PMO & Integrated Services,
      Blue Cross and Blue Shield of Louisiana

      2.3 Review your historical IT expenditure

      8 hours

      1. Download the IT Cost Forecasting and Budgeting Workbook.
      2. On Tab 1, “Historical Events & Projects,” note the cost-driving and cost-saving events that occurred last fiscal year that drove any variance between budgeted and actual expenditure. Describe the nature of their impact and current status (ongoing, resolved – temporary impact, or resolved – permanent impact).
      3. Also on Tab 1, “Historical Events & Projects”, summarize the work done on capital or strategic projects, expenditures, and status (in progress, deferred, canceled, or complete).
      4. On Tab 2, “Historical Expenditure”:
        1. Enter the budgeted and actuals data for last fiscal year in columns D-H for the views of the ITFM Cost Model you’re opted to do, i.e. CFO expense view, CIO service view, CXO business view, and CEO innovation view.
        2. Enter a brief rationale for any notable budgeted-versus-actuals variances or other interesting items in column K.
        3. Enter actuals data for the remaining past five fiscal years in columns L-O. Year-over-year comparative metrics will be calculated for you.
        4. Enter FTEs by business function in columns R-AA, rows 34-43.
          Expenditure per FTE and year-over year comparative metrics will be
          calculated for you.
      5. Using Tabs 2, “Historical Expenditure” and 3, “Historical Analysis”, review and analyze the resulting data sets and graphs to identify overall patterns, specifically notable increases or decreases in a particular category of expenditure or where rationales are repeated across categories or views (these are significant).
      6. Finally, flag any data points that help demonstrate achievement of, or progress toward, any cost-control measures you implemented.

      2.3 Review your historical IT expenditure

      InputOutputMaterialsParticipants
      • Budgeted data for the previous fiscal year and actuals data for the previous five fiscal years
      • Mapped budgeted for last fiscal year, mapped actuals for the past five fiscal years, and variance metrics and rationales
      • IT Cost Forecasting and Budgeting Workbook
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Pull historical trends into a present-day context when setting your high-level goals

      What’s happening to your organization and the ecosystem within which it’s operating right now? Review current business concerns, priorities, and strategies.

      Knowing what happened in the past can provide good insights and give you a chance to show stakeholders your money-management track record. However, what stakeholders really care about is “now” and “next”. For them, it’s all about current business context.

      Ask these questions about your current context to assess the relevance of your historical trend data:

      What’s the state of
      the economy and how is
      it affecting your organization?

      What are the
      organization’s stated
      strategic goals and objectives?

      What has the business
      explicitly communicated
      about finance-related targets?

      What’s the business
      executive’s attitude on
      budget increase requests?

      Some industries are very sensitive to economic cycles, causing wild budget fluctuations year to year. This uncertainty can reduce the volume of spend you automatically carry over one year to the next, making past spend patterns less relevant to your current budgeting effort.

      These can change year to year as well, and often manifest on the CapEx side in the form of strategic projects selected. Since this is so variable, using previous years’ CapEx to determine next fiscal’s CapEx isn’t always useful except in regard to multi-year, ongoing capital projects.

      Do your best to honor mandates. However, if cuts are suggested that could jeopardize core service delivery, tread cautiously, and pick your battles. You may be able to halt new capital spend to generate cuts, but these projects may get approved anyway, with IT expected to make cuts to OpEx.

      If the CFO and others rail against even the most necessary inflation-driven increases, you’ll need to take a conservative approach, focus on cost-saving initiatives, and plan to redirect last year’s expenditures instead of pursuing net-new spend.

      Set metrics and targets for some broader budget effectiveness improvement efforts

      Budget goalsetting isn’t limited to CapEx and OpEx targets. There are several effectiveness metrics to track overall improvement in your budgeting process.

      Step back and think about other budget and expenditure goals you have.
      Do you want to:

      • Better align the budget with organizational objectives?
      • Increase cost forecasting accuracy?
      • Increase budget transparency and completeness?
      • Improve the effectiveness of your budget presentation?
      • Reduce the amount of budget rework?
      • Increase the percentage of the budget that’s approved?
      • Reduce variance between what was budgeted and actuals?

      Establish appropriate metrics and targets that will allow you to define success, track progress, and communicate achievement on these higher-level goals.

      Check out some example metrics in the table below.

      Budgeting metric

      Improvement driver

      Current value

      Future target

      Percentage of spend directly tied to an organizational goal.

      Better alignment via increased communication and partnership with the business.

      72%

      90%

      Number of changes to budget prior to final acceptance.

      Better accuracy and transparency via use of zero-based budgeting and enhanced stakeholder views.

      8

      2

      Percentage variance between budgeted vs. actuals.

      Improved forecasting through better understanding of business plans and in-cycle show-back.

      +4%

      +/-2%

      Percentage of budget approved after first presentation.

      Improved business rationales and direct mapping of expenditure to org priorities.

      76%

      95%

      Percentage of IT-driven project budget approved.

      More rigor around benefits, ROI calculation, and quantifying value delivered.

      80%

      100%

      Set your high-level OpEx budget targets

      The high-level targets you set now don’t need to be perfect. Think of them as reference points or guardrails to sanity-check the cost forecasting exercise to come.

      First things first: Zero-based or incremental for OpEx?

      Set your OpEx targets

      Incremental budgeting is the addition of a few percentage onto next year’s budget, assuming the previous year’s OpEx is all re-occurring. The percentage often aligns with rates of inflation.

      • Most organizations take this approach because it’s faster and easier.
      • However, incremental budgeting is less accurate. Non-recurring items are often overlooked and get included in the forecast, resulting in budget bloat. Also, redundant or wasteful items can be entirely missed, undermining any cost optimization efforts.

      Zero-based budgeting involves rebuilding your budget from scratch, i.e. zero. It doesn’t assume that any of last year’s costs are recurring or consistent year to year.

      • This approach is harder because all relevant historical spend data needs to be collected and reviewed, which not only takes time but the data you need may be unlocatable.
      • Every item needs to be re-examined, re-justified, and tied to an asset, service, or project, which means it’s a far more comprehensive and accurate approach.

      Pick a range of percentage change based on your business context and past spend.

      • If economic prospects are negative, start with a 0-3% increase to balance inflation with potential cuts. Don’t set concrete reduction targets at this point, to avoid tunnel vision in the forecasting exercise.
      • If economic prospects are positive, target 3-5% increases for stable scenarios and 6-10% increases for growth scenarios.
      • If CapEx from previous-year projects is switching to steady-state OpEx, then account for these bumps in OpEx.
      • If the benefits from any previous-year efficiency measures will be realized next fiscal year, then account for these as OpEx reductions.

      If cost-cutting or optimization is a priority, then a zero-based approach is the right decision. If doing this every year is too onerous, plan to do it for your OpEx at least every few years to examine what’s actually in there, clean house, and re-set.

      Set your high-level CapEx budget targets

      A lot of IT CapEx is conceived in business projects, so your proposed expenditure here may not be up to you. Exercise as much influence as you can.

      First things first: Is it project CapEx, or “business as usual” CapEx?

      Project CapEx is tied to one-time strategic projects requiring investment in new assets.

      • This CapEx will probably be variable year to year, going up or down depending on the organization’s circumstances or goals.
      • This area of spend is driven largely by the business and not IT. Plan to set project CapEx targets in close partnership with the business and function as a steward of these funds instead of as an owner.

      User-driven “business as usual” CapEx manifests via changes (often increases) in organizational headcount due to growth.

      • Costs here focus on end-user hardware like desktops, laptops, and peripherals.
      • Any new capital software acquisitions you have planned will also be affected in terms of number of licenses required.
      • Get reliable estimates of department-by-department hiring plans for next fiscal year to better account for these in your budget.

      Network/data center-driven “business-as-usual” CapEx is about core infrastructure maintenance.

      • Costs here focus on the purchase of network and data center hardware and other equipment to maintain existing infrastructure services and performance.
      • Increased outsourcing often drives down this area of “business as usual” CapEx by reducing the purchase of new on-premises solutions and eliminating network and data center maintenance requirements.

      Unanticipated hiring and the need to buy end-user hardware is cited as a top cause of budget grief by IT leaders – get ahead of this. Project CapEx, however, is usually determined via business-based capital project approval mechanisms well in advance. And don’t forget to factor in pre-established capital asset depreciation amounts generated by all the above!

      2.4 Set your high-level IT budget targets and metrics

      8 hours

      1. Download the IT Cost Forecasting and Budgeting Workbook to document the outcomes of this activity.
      2. Review the context in which your organization is currently operating and expects to operate in the next fiscal year. Specifically, look at:
        1. The state of the economy.
        2. Stated goals, objectives, and targets.
        3. The executive’s point of view on budget increase requests.
        Document your factors, assessment, rationale, and considerations in the “Business Context Assessment” table on the “Planning Variables” tab in the IT Cost Forecasting and Budgeting Workbook.
      3. Based on the business context, anticipated flips of former CapEx to OpEx, and realization of previous years’ efficiency measures, set a general non-project OpEx target as a percentage increase or decrease for next fiscal year to serve as a guideline in the cost forecasting guideline. Document this in the “Budget Targets & Metrics” table on the “Planning Variables” tab in the IT Cost Forecasting and Budgeting Workbook. sed on known capital projects, changes in headcount, typical “business as usual” equipment expenditure, and pre-established capital asset depreciation amounts, set general project CapEx and non-project CapEx targets. Document these in the “Budget Targets & Metrics” table on the “Planning Variables” tab in the IT Cost Forecasting and Budgeting Workbook.
      4. Finally, set your overarching IT budget process success metrics. Also document these in the “Budget Targets & Metrics” table on the “Planning Variables” tab in the IT Cost Forecasting and Budgeting Workbook.

      Download the IT Cost Forecasting and Budgeting Workbook

      2.4 Set your high-level IT budget targets and metrics

      InputOutputMaterialsParticipants
      • Knowledge of current business context and probable context next fiscal year
      • Analysis of historical IT expenditure patterns
      • High-level project CapEx and non-project CapEx and OpEx targets for the next fiscal year
      • IT budget process success metrics
      • IT Cost Forecasting and Budgeting Workbook
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Phase recap: Get into budget-starting position

      Now you’re ready to do the deep dive into forecasting your IT budget for next year.

      In this phase, you clarified your business context and defined your budgetary goals, including:

      • Assembling your resources. You’ve built and organized your IT budgeting team, as well as gathered the data and information you’ll need to do your historical expenditure analysis and future forecasting
      • Understanding the four views of the IT Cost Model. You’ve become familiar with the four views of the model and have selected which ones you’ll map for historical analysis and forecasting purposes.
      • Reviewing last year’s budget versus actuals and five-year historical trends. You now have the critical rationale-building context to inform next year’s numbers and demonstrate any cost efficiencies you’ve successfully executed.
      • Setting your high-level goals. You’ve established high-level targets for project and non-project CapEx and OpEx, as well as set some IT budget process improvement goals.

      “We only have one dollar but five things. Help us understand how to spend that dollar.”

      – Trisha Goya, Director, IT Governance & Administration, Hawaii Medical Service Association

      Phase 3

      Develop Your Forecasts

      Lay Your
      Foundation

      Get Into Budget-Starting Position

      Develop Your
      Forecasts

      Build Your
      Proposed Budget

      Create and Deliver Your Presentation

      1.1 Understand what your budget is
      and does

      1.2 Know your stakeholders

      1.3 Continuously pre-sell your budget

      2.1 Assemble your resources

      2.2 Understand the four views of the ITFM Cost Model

      2.3 Review last year’s budget vs.
      actuals and five-year historical trends

      2.4 Set your high-level goals

      3.1 Develop assumptions and
      alternative scenarios

      3.2 Forecast your project CapEx

      3.3 Forecast your non-project CapEx and OpEx

      4.1 Aggregate your numbers

      4.2 Stress test your forecasts

      4.3 Challenge and perfect your
      rationales

      5.1 Plan your content

      5.2 Build your presentation

      5.3 Present to stakeholders

      5.4 Make final adjustments and submit your IT budget

      This phase will walk you through the following activities:

      • Documenting the assumptions behind your proposed budget and develop alternative scenarios.
      • Forecasting your project CapEx.
      • Forecasting your non-project CapEx and OpEx.

      This phase involves the following participants:

      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Develop your forecasts

      Start making some decisions.

      This phase focuses on putting real numbers on paper based on the research and data you’ve collected. Here, you will:

      • Develop assumptions and alternative scenarios. The assumptions you make are the logical foundation for your decisions, and your primary and alternative scenarios focus your thinking and demonstrate that you’ve thoroughly examined your organization’s current and future context.
      • Forecast your project CapEx costs. These costs are comprised of all the project-related capital expenditures for strategic or capital projects, including in-house labor.
      • Forecast your non-project CapEx and OpEx costs. These costs are the ongoing “business as usual” expenditures incurred via the day-to-day operations of IT and delivery of IT services.

      “Our April forecast is what really sets the bar for what our increase is going to be next fiscal year. We realized that we couldn’t change it later, so we needed to do more upfront to get that forecast right.

      If we know that IT projects have been delayed, if we know we pulled some things forward, if we know that a project isn’t starting until next year, let’s be really clear on those things so that we’re starting from a better forecast because that’s the basis of deciding two percent, three percent, whatever it’s going to be.”

      – Kristen Thurber, IT Director, Office of the CIO, Donaldson Company

      When pinning down assumptions, start with negotiable and non-negotiable constraints

      Assumptions are things you hold to be true. They may not actually be true, but they are your logical foundation and must be shared with stakeholders so they can follow your thinking.

      Start with understanding your constraints. These are either negotiable (adjustable) or non-negotiable (non-adjustable). However, what is non-negotiable for IT may be negotiable for the organization as a whole, such as its strategic objectives. Consider each of the constraints below, determine how it relates to IT expenditure options, and decide if it’s ultimately negotiable or non-negotiable.

      Organizational

      Legal and Regulatory

      IT/Other

      Example:
      • Strategic goals and priorities
      • Financial and market performance
      • Governance style and methods
      • Organizational policies
      • Organizational culture
      • Regulatory compliance and reporting
      • Data residency and privacy laws
      • Vendor contract terms and conditions
      • Health and safety
      • Compensation and collective bargaining
      • IT funding and fund allocation flexibility
      • Staff/skills availability and capacity
      • Business continuity and IT performance requirements
      • Time and timeframes
      You’re in year one of a three-year vendor contract. All contracts are negotiable, but this one isn’t for two years. This contact should be considered a non-negotiable for current budget-planning purposes.

      Identifying your negotiable and non-negotiable constraints is about knowing what levers you can pull. Government entities have more non-negotiable constraints than private companies, which means IT and the organization as a whole have fewer budgetary levers to pull and a lot less flexibility.

      An un-pullable lever and a pullable lever (and how much you can pull it) have one important thing in common – they are all fundamental assumptions that influence your decisions.

      Brainstorm your assumptions even further

      The tricky thing about assumptions is that they’re taken for granted – you don’t always realize you’ve made them. Consider these common assumptions and test them for validity.

      My current employees will still be here 18 months from now.

      My current vendors aren’t going to discontinue the products we have.

      My organization’s executive team will be the same 18 months from now. My current key vendors will be around for years to come.

      My organization’s departments, divisions, and general structure will be the same 18 months from now.

      IT has to be an innovation leader.

      We won’t be involved in any merger/acquisition activity next fiscal year.

      IT has always played the same role here and that won’t change.

      There won’t be a major natural disaster that takes us offline for days or even weeks.

      We must move everything we can to the cloud.

      We won’t be launching any new products or services next fiscal year.

      Most of our IT expenditure has to be CapEx, as usual.

      You won’t put some of these assumptions into your final budget presentation. It’s simply worthwhile knowing what they are so you can challenge them when forecasting.

      Based on your assumptions, define the primary scenario that will frame your budget

      Your primary scenario is the one you believe is most likely to happen and upon which you’ll build your IT cost forecasts.

      Now it’s time to outline your primary scenario.

      • A scenario is created by identifying the variable factors embedded in your assumptions and manipulating them across the range of possibilities. This manipulation of variables will result in different scenarios, some more likely or feasible than others.
      • Your primary scenario is the one you believe is the most feasible and/or likely to happen (i.e. most probable). This is based on:
        • Your understanding of past events and patterns.
        • Your understanding of your organization’s current context.
        • Your understanding of IT’s current context.
        • Your understanding of the organization’s objectives.
        • Your assessment of negotiable and non-negotiable constraints and other assumptions for both IT and the organization.

      A note on probability…

      • A non-negotiable constraint doesn’t have any variables to manipulate. It’s a 100% probability that must be rigidly accommodated and protected in your scenario. An example is a long-standing industry regulation that shows no signs of being updated or altered and must be complied with in its current state.
      • A negotiable constraint has many more variables in play. Your goal is to identify the different potential values of the variables and determine the degree of probability that one value is more likely to be true or feasible than another. An example is that you’re directed to cut costs, but the amount could be as little as 3% or as much as 20%.
      • And then there are the unknowns. These are circumstances, events, or initiatives that inevitably happen, but you can’t predict when, what, or how much. This is what contingency planning and insurance are for. Examples include a natural disaster, a pandemic, a supply chain crisis, or the CEO simply changing their mind. Its safe to assume something is going to happen, so if you’re able to establish a contingency fund or mechanisms that let you respond, then do it.

      What could or will be your organization’s new current state at the end of next fiscal year?

      Next, explore alternative scenarios, even those that may seem a bit outrageous

      Offering alternatives demonstrates that you weighed all the pertinent factors and that you’ve thought broadly about the organization’s future and how best to support it.

      Primary scenario approval can be helped by putting that scenario alongside alternatives that are less attractive due to their cost, priority, or feasibility. Alternative scenarios are created by manipulating or eliminating your negotiable constraints or treating specific unknowns as knowns. Here are some common alternative scenarios.

      The high-cost scenario: Assumes very positive economic prospects. Characterized by more of everything – people and skills, new or more sophisticated technologies, projects, growth, and innovation. Remember to consider the long-term impact on OpEx that higher capital spend may bring in subsequent years.

      Target 10-20% more expenditure than your primary scenario

      The low-cost scenario: Assumes negative economic prospects or cost-control objectives. Characterized by less of everything, specifically capital project investment, other CapEx, and OpEx. Must assume that business service-level expectations will be down-graded and other sacrifices will be made.

      Target 5-15% less expenditure than your primary scenario

      The dark horse scenario: This is a more radical proposition that challenges the status quo. For example, what would the budget look like if all data specialists in the organization were centralized under IT? What if IT ran the corporate PMO? What if the entire IT function was 100% outsourced?

      No specific target

      Case Study

      INDUSTRY: Manufacturing

      SOURCE: Anonymous

      A manufacturing IT Director gets budgetary approval by showing what the business would have to sacrifice to get the cheap option.

      Challenge

      Solution

      Results

      A manufacturing business had been cutting costs endlessly across the organization, but specifically in IT.

      IT was down to the bone. The IT Director had already been doing zero-based budgeting to rationalize all expenditure, stretching asset lifecycles as long as possible, and letting maintenance work slide.

      There were no obvious options left to reduce costs based on what the business wanted to do.

      The IT Director got creative. He put together three complete budgets:

      1. The budget he wanted.
      2. A budget where everything was entirely outsourced and there would be zero in-house IT staff.
      3. A budget that was not as extreme as the second one, but still tilted toward outsourcing.

      In the budget presentation, he led with the “super cheap” budget where IT was 100% outsourced.

      He proceeded to review the things they wouldn’t have under the extreme outsourced scenario, including the losses in service levels that would be necessary to make it happen.

      The executive was shocked by what the IT Director showed them.

      The executive immediately approved the IT Director’s preferred budget. He was able to defend the best budget for the business by showing them what they stood to lose.

      3.1 Document your assumptions and alternative scenarios

      2 hours

      1. Download the IT Cost Forecasting and Budgeting Workbook and document the outcomes of this activity on Tab 9, “Alternative Scenarios.”
      2. As a management team, identify and discuss your non-negotiable and negotiable constraints. Document these in rows 4 and 5 respectively in the Workbook.
      3. Brainstorm, list, and challenge any other assumptions being made by IT or the organization’s executive in terms of what can and cannot be done.
      4. Identify the most likely or feasible scenario (primary) and associated assumptions. You will base your initial forecasting on this scenario.
      5. Identify alternative scenarios. Document each scenario’s name, description, and key assumptions, and major opportunities in columns B-D on Tab 9, “Alternative Scenarios.” You will do any calculations for these scenarios after you have completed the forecast for your primary scenario.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • Knowledge of organization’s context, culture, and operations
      • A list of assumptions that will form the logical foundation of your forecasting decisions
      • Identification of the primary budget scenario and alternatives
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Before diving into actual forecasting, get clear on project and non-project CapEx and OpEx

      Traditional, binary “CapEx vs. OpEx” distinctions don’t seem adequate for showing where expenditure is really going. We’ve added a new facet to help further differentiate one-time project costs from recurring “business as usual” expenses.

      Project CapEx
      Includes all workforce and vendor costs associated with planning and execution of projects largely focused on the acquisition or creation of new capital assets.

      Non-project CapEx
      Includes “business as usual” capital asset acquisition in the interest of managing, maintaining, or supporting ongoing performance of existing infrastructure or services, such as replacement network equipment, end-user hardware (e.g. laptops), or disaster recovery/business continuity redundancies. Also includes ongoing asset depreciation amounts.

      Non-project OpEx
      Includes all recurring, non-CapEx “business as usual” costs such as labor compensation and training, cloud-based software fees, outsourcing costs, managed services fees, subscriptions, and other discretionary spend.

      Depreciation is technically CapEx. However, for practical purposes, most organizations list it under OpEx, which can cause it to get lost in the noise. Here, depreciation is under non-project CapEx to keep its true CapEx nature visible and in the company of other “business as usual” capital purchases that will ultimately join the depreciation ranks.

      Forecast your project CapEx costs

      This process can be simple as far as overall budget forecasting is concerned. If it isn’t simple now, plan to make it simpler next time around.

      What to expect…

      • Ideally, the costs for all projects should have been thoroughly estimated, reviewed, and accepted by a steering committee, your CFO, or other approving entity at the start of the budgeting season, and funding already committed to. In a nutshell, forecasting your project costs should already have been done and will only require plugging in those numbers.
      • If projects have yet to be pitched and rubber stamped, know that your work is cut out for you. Doing things in a rush or without proper due diligence will result in certain costs being missed. This means that you risk going far over budget in terms of actuals next year, or having to borrow from other areas in your budget to cover unplanned or underestimated project costs.

      Key forecasting principles…

      Develop rigorous business cases
      Secure funding approval well in advance
      Tie back costs benefitting business units
      Consider the longer-term OpEx impact

      For more information about putting together sound business cases for different projects and circumstances, see the following Info-Tech blueprints:

      Build a Comprehensive Business Case

      Fund Innovation with a Minimum Viable Business Case

      Reduce Time to Consensus with an Accelerated Business Case

      Apply these project CapEx forecasting tips

      A good project CapEx forecast requires steady legwork, not last-minute fast thinking.

      Tip #1: Don’t surprise your approvers. Springing a capital project on approvers at your formal presentation isn’t a good idea and stands a good chance of rejection, so do whatever you can to lock these costs down well in advance.

      Tip #2: Project costs should be entirely comprised of CapEx if possible. Keep in mind that some of these costs will convert to depreciated non-project CapEx and non-project OpEx as they transition from project costs to ongoing “business as usual” costs, usually in the fiscal year following the year of expenditure. Creating projections for the longer-term impacts of these project CapEx costs on future types of expenditure is a good idea. Remember that a one-time project is not the same thing as a one-time cost.

      Tip #3: Capitalize any employee labor costs on capital projects. This ensures the true costs of projects are not underestimated and that operational staff aren’t being used for free at the expense of their regular duties.

      Tip #4: Capitalizing cloud costs in year one of a formal implementation project is usually acceptable. It’s possible to continue treating cloud costs as CapEx with some vendors via something called reserved instances, but organizations report that this is a lot of work to set up. In the end, most capitalized cloud will convert into non-project OpEx in years two and beyond.

      Tip #5: Build in some leeway. By the time a project is initiated, circumstances may have changed dramatically from when it was first pitched and approved, including business priorities and needs, vendor pricing, and skillset availability. Your costing may become completely out of date. It’s a good practice to work within more general cost ranges than with specific numbers, to give you the flexibility to respond and adapt during actual execution.

      3.2 Forecast your project CapEx

      Time: Depends on size of project portfolio

      1. Download the IT Cost Forecasting and Budgeting Workbook and navigate to Tab 5, “Project CapEx Forecast”. Add more columns as required. Enter the following for all projects:
        • Row 5 – Its name and/or unique identifier.
        • Row 6 – Its known or estimated project start/end dates.
        • Row 7 – Its status (in proposal, committed, or in progress).
      2. Distribute each project’s costs across the categories listed for each view you’ve selected to map. Do not include any OpEx here – it will be mapped separately under non-project OpEx.
      3. Rationalize your values. A running per-project total for each view, as well as totals for all projects combined, are in rows 16, 28, 39, and 43. Ensure these totals match or are very close across all the views you are mapping. If they don’t match, review the views that are lower-end outliers as there’s a good chance something has been overlooked.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • Project proposals and plans, including cost estimations
      • A project CapEx forecast for next fiscal year
      MaterialsParticipants
      • IT Cost Forecasting and Budgeting Workbook
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Forecast your non-project OpEx

      Most of your budget will be non-project OpEx, so plan to spend most of your forecasting effort here.

      What to expect…

      Central to the definition of OpEx is the fact that it’s ongoing. It rarely stops, and tends to steadily increase over time due to factors like inflation, rising vendor prices, growing organizational growth, increases in the salary expectations of employees, and other factors.

      The only certain ways to reduce OpEx are to convert it to capitalizable expenditure, decrease staffing costs, not pursue cloud technologies, or for the organization to simply not grow. For most organizations, none of these approaches are feasible. Smaller scale efficiencies and optimizations can keep OpEx from running amok, but they won’t change its overall upward trajectory over time. Expect it to increase.

      Key forecasting principles…

      Focus on optimization and efficiency.
      Aim for full spend transparency.
      Think about appropriate chargeback options.
      Give it the time it deserves.

      For more information about how to make the most out of your IT OpEx, see the following Info-Tech blueprints:

      Develop Your Cost Optimization Roadmap

      Achieve IT Spend & Staffing Transparency

      Discover the Hidden Costs of Outsourcing

      Apply these non-project OpEx forecasting tips

      A good forecast is in the details, so take a very close look to see what’s really there.

      Tip #1: Consider zero-based budgeting. You don’t have to do this every year, but re-rationalizing your OpEx every few years, or a just a segment of it on a rotational basis, will not only help you readily justify the expenditure but also find waste and inefficiencies you didn’t know existed.

      Tip #2: Capitalize your employee capital project work. While some organizations aren’t allowed to do this, others who can simply don’t bother. Unfortunately, this act can bloat the OpEx side of the equation substantially. Many regular employees spend a significant amount of their time working on capital projects, but this fact is invisible to the business. This is why the business keeps asking why it takes so many people to run IT.

      Tip #3: Break out your cloud vs. on-premises costs. Burying cloud apps costs in a generic software bucket works against any transparency ambitions you may have. If you have anything resembling a cloud strategy, you need to track, report, and plan for these costs separately in order to measure benefits realization. This goes for cloud infrastructure costs, too.

      Tip #4: Spend time on your CIO service view forecast. Completing this view counts as a first step toward service-based costing and is a good starting point for setting up an accurate service catalog. If looking for cost reductions, you’ll want to examine your forecasts in this view as there will likely be service-level reductions you’ll need to propose to hit your cost-cutting goals.

      Tip #5: Budget with consideration for chargeback. chargeback mechanisms for OpEx can be challenging to manage and have political repercussions, but they do shift accountability back to the business, guarantee that the IT bills get paid, and reduce IT’s OpEx burden. Selectively charging business units for applications that only they use may be a good entry point into chargeback. It may also be as far as you want to go with it. Doing the CXO business view forecast will provide insight into your opportunities here.

      Forecast your non-project CapEx

      These costs are often the smallest percentage of overall expenditure but one of the biggest sources of financial grief for IT.

      What to expect…

      • These costs can be hard to predict. Anticipating expenditure on end-user hardware such as laptops depends on knowing how many new staff will be hired by the organization next year. Predicting the need to buy networking hardware depends on knowing if, and when, a critical piece of equipment is going to spontaneously fail. You can never be completely sure.
      • IT often must reallocate funds from other areas of its budget to cover non-project CapEx costs. Unfortunately, keeping the network running and ensuring employees have access to that network is seen exclusively as an IT problem, not a business problem. Plan to change this mindset.

      Key forecasting principles…

      Discuss hiring plans with the business.
      Pay close attention to your asset lifecycles.
      Prepare to advise about depreciation schedules.
      Build in contingency for the unexpected.

      For more information about ensuring IT isn’t left in the lurch when it comes to non-project CapEx, see the following Info-Tech blueprints:

      Manage End-User Devices

      Develop an Availability and Capacity Management Plan

      Modernize the Network

      Apply these non-project CapEx forecasting tips

      A good forecast relies on your ability to accurately predict the future.

      Tip #1: Top up new hire estimations: Talk to every business unit leader about their concrete hiring plans, not their aspirations. Get a number, increase that number by 25% or 20 FTEs (whichever is less), and use this new number to calculate your end-user non-project CapEx.

      Tip #2: Make an arrangement for who’s paying for operational technology (OT) devices and equipment. OT involves specialized devices such as in-the-field sensors, scanners, meters, and other networkable equipment. Historically, operational units have handled this themselves, but this has created security problems and they still rely on IT for support. Sort the financials out now, including whose budget device and equipment purchases appear on, as well as what accommodations IT will need to make in its own budget to support them.

      Tip #3: Evaluate cloud infrastructure and managed services. These can dramatically reduce your non-project CapEx, particularly on the network and data center fronts. However, these solutions aren’t necessarily less expensive and will drive up OpEx, so tread cautiously.

      Tip #4: Definitely do an inventory. If you haven’t invested in IT asset management, put it on your project and budgetary agenda. You can’t manage what you don’t know you have, so asset discovery should be your first order of business. From there, start gathering asset lifecycle information and build in alerting to aid your spend planning.

      Tip #5: Think about retirement: What assets are nearing end of life or the end of their depreciation schedule? What impact is this having on non-project OpEx in terms of maintenance and support? Deciding to retire, replace, or extend an IT operational asset will change your non-project CapEx outlook and will affect costs in other areas.

      Tip #6: Create a contingency fund: You need one to deal with surprises and emergencies, so why wait?

      Document the organization’s projected FTEs by business function

      This data point is usually missing from IT’s budget forecasting data set. Try to get it.

      A powerful metric to share with business stakeholders is expenditure per employee or FTE. It’s powerful because:

      • It’s one of the few metrics that’s intuitively understood by most people
      • It can show changes in IT expenditure over time at both granular and general levels.

      This metric is one of the simplest to calculate. The challenge is in getting your hands on the data in the first place.

      • Most business unit leaders struggle to pin down this number in terms of actuals as they have difficulty determining what an FTE actually is. Does it include contract staff? Part-time staff? Seasonal workers? Volunteers and interns? And if the business unit has high turnover, this number can fluctuate significantly.
      • Encourage your business peers to produce a rational estimate. Unlike the headcount number you’re seeking to forecast for non-project capital expenditure for end-user hardware, this FTE number should strive to be more in the ballpark, as you’re not using it to ensure sufficient funds but comparatively track expenditure year to year.
      • Depending on your industry, employees or FTEs may not be the best measurement. Use what works best for you. Number of unique users is a common one. Other industry-specific examples include per student, per bed, per patient, per account, and per resident.

      Start to build in long-term and short-term forecasting into your budgeting process

      These are growing practices in mature IT organizations that afford significant flexibility.

      Short-term forecasting:

      Long-term forecasting:

      • At Donaldson Company, budgeting is a once-a-year event, but they’ve started formalizing a forecast review three times a year.
      • These mini-forecasts are not as full blown as the annual forecasting process. Rather, they look at specific parts of the budget and update it based on changing realities.

      “It’s a great step in the right direction. We look at
      the current, and then the future. What we’re really pushing is how to keep that outyear spend more in discussion. The biggest thing we’re trying to do when we approve projects is look at what does that approval do to outyear spend? Is it going to increase? Is it going to decrease? Will we be spending more on licensing? On people?”

      – Kristen Thurber, IT Director, Office of the CIO,
      Donaldson Company

      • In 2017, the Hawaii Medical Service Association accepted the fact that they were very challenged with legacy systems. They needed to modernize.
      • They created a multi-year strategic budget -- a five-year investment plan. This plan was a success. They were able to gain approval for a five-year horizon with variable allocations per year, as required.

      “This approach was much better. We now
      have a “guarantee” of funding for five years now – they’ve conceptually agreed. Now we don’t have
      to make that request for new money every time
      if we need more. We can vary the amount every
      year – it doesn’t have to be the same.”

      – Trisha Goya, Director, IT Governance & Administration,
      Hawaii Medical Service Association

      3.4 Forecast your non-project OpEx and CapEx

      Time: Depends on size of vendor portfolio and workforce

      1. Download the IT Cost Forecasting and Budgeting Workbook and navigate to Tab 4, “Business as Usual Forecast”. This tab assumes an incremental budgeting approach. Last year’s actuals have been carried forward for you to build upon.
      2. Enter expected percentage-based cost increases/decreases for next fiscal year for each of the following variables (columns E-I): inflation, vendor pricing, labor costs, service levels, and depreciation. Do this for all sub-categories for the ITFM cost model views you’ve opted to map. Provide rationales for your percentage values in column K.
      3. In columns M and N, enter the anticipated percentage allocation of cost to non-project CapEx versus non-project OpEx.
      4. In column O, rows 29-38, enter the projected FTEs for each business function (if available).
      5. If you choose, make longer-term, high-level forecasts for 2-3 years in the future in columns P-U. Performing longer-term forecasts for at least the CFO expense view categories is recommended.

      Download the IT Cost Forecasting and Budgeting Workbook

      Input Output
      • Last fiscal year’s actuals
      • Knowledge of likely inflation, vendor cost, and salary expectations for next fiscal year
      • Depreciation amounts
      • A non-project OpEx and CapEx forecast for next fiscal year
      Materials Participants
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Case Study

      INDUSTRY: Insurance

      SOURCE: Anonymous

      Challenge

      Solution

      Results

      In his first run at the annual budgeting process, a new CIO received delivery dates from Finance and spent the next three months building the budget for the next fiscal year.

      He discovered that the organization had been underinvesting in IT for a long time. There were platforms without support, no accounting for currency exchange rates on purchases, components that had not be upgraded in 16 years, big cybersecurity risks, and 20 critical incidences a month.

      In his budget, the CIO requested a 22-24% increase in IT expenditure to deal with the critical gaps, and provided a detailed defense of his proposal

      But the new CIO’s team and Finance were frustrated with him. He asked his IT finance leader why. She said she didn’t understand what his direction was and why the budgeting process was taking so long – his predecessor did the budget in only two days. He would add up the contracts, add 10% for inflation, and that’s it.

      Simply put, the organization hadn’t taken budgeting seriously. By doing it right, the new CIO had inadvertently challenged the status quo.

      The CIO ended up under-executing his first budget by 12% but is tracking closer to plan this year. Significantly, he’s been able cut critical incidences from 20 down to only 2-3 per month.

      Some friction persists with the CFO, who sees him as a “big spender,” but he believes that this friction has forced him to be even better.

      Phase recap: Develop your forecasts

      The hard math is done. Now it’s time to step back and craft your final proposed budget and its key messages.

      This phase focused on developing your forecasts and proposed budget for next fiscal year. It included:

      • Developing assumptions and alternative scenarios. These will showcase your understanding of business context as well as what’s most likely to happen (or should happen) next year.
      • Forecasting your project CapEx costs. If these costs weren’t laid out already in formal, approved project proposals or plans, now you know why it’s the better approach for developing a budget.
      • Forecasting your non-project CapEx and OpEx costs. Now you should have more clarity and transparency concerning where these costs are going and exactly why they need to go there.

      “Ninety percent of your projects will get started but a good 10% will never get off the ground because of capacity or the business changes their mind or other priorities are thrown in. There are always these sorts of challenges that come up.”

      – Theresa Hughes, Executive Counselor,
      Info-Tech Research Group
      and Former IT Executive

      Phase 4

      Build Your Proposed Budget

      Lay Your
      Foundation

      Get Into Budget-Starting Position

      Develop Your
      Forecasts

      Build Your
      Proposed Budget

      Create and Deliver Your Presentation

      1.1 Understand what your budget is
      and does

      1.2 Know your stakeholders

      1.3 Continuously pre-sell your budget

      2.1 Assemble your resources

      2.2 Understand the four views of the ITFM Cost Model

      2.3 Review last year’s budget vs.
      actuals and five-year historical trends

      2.4 Set your high-level goals

      3.1 Develop assumptions and
      alternative scenarios

      3.2 Forecast your project CapEx

      3.3 Forecast your non-project CapEx and OpEx

      4.1 Aggregate your numbers

      4.2 Stress test your forecasts

      4.3 Challenge and perfect your
      rationales

      5.1 Plan your content

      5.2 Build your presentation

      5.3 Present to stakeholders

      5.4 Make final adjustments and submit your IT budget

      This phase will walk you through the following activities:

      • Pulling your forecasts together into a comprehensive IT budget for next fiscal year.
      • Double checking your forecasts to ensure they’re accurate.
      • Fine tuning the rationales behind your proposals.

      This phase involves the following participants:

      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Build your proposed budget

      Triple check your numbers and put the finishing touches on your approval-winning rationales.

      This phase is where your analysis and decision making finally come together into a coherent budget proposal. Key steps include:

      • Aggregating your numbers. This step involves pulling together your project CapEx, non-project CapEx, and non-project OpEx forecasts into a comprehensive whole and sanity-checking your expenditure-type ratios.
      • Stress-testing your forecasts. Do some detailed checks to ensure everything’s accounted for and you haven’t overlooked any significant information or factors that could affect your forecasted costs.
      • Challenging and perfecting your rationales. Your ability to present hard evidence and rational explanations in support of your proposed budget is often the difference between a yes or a no. Look at your proposals from different stakeholder perspectives and ask yourself, “Would I say yes to this if I were them?”

      “We don’t buy servers and licenses because we want to. We buy them because we have to. IT doesn’t need those servers out at our data center provider, network connections, et cetera. Only a fraction of these costs are to support us in the IT department. IT doesn’t have control over these costs because we’re not the consumers.”

      – Matt Johnson, IT Director Governance and Business Solutions, Milwaukee County

      Great rationales do more than set you up for streamlined budgetary approval

      Rationales build credibility and trust in your business capabilities. They can also help stop the same conversations happening year after year.

      Any item in your proposed budget can send you down a rabbit hole if not thoroughly defensible.

      You probably won’t need to defend every item, but it’s best to be prepared to do so. Ask yourself:

      • What areas of spend does the CFO come back to year after year? Is it some aspect of OpEx, such as workforce costs or cloud software fees? Is it the relationship between proposed project spend and business benefits? Provide detailed and transparent rationales for these items to start re-directing long-term conversations to more strategic issues.
      • What areas of spend seem to be recurring points of conflict with business unit leaders? Is it surprise spend that comes from business decisions that didn’t include IT? Is it business-unit leaders railing against chargeback? Have frank, information-sharing conversations focused on business applications, service-level requirements, and true IT costs to support them.
      • What’s on the CEO’s mind? Are they focused on entering a new overseas market, which will require capital investment? Are they interested in the potential of a new technology because competitors are adopting it? It may not be the same focus as last year, so ensure you have fresh rationales that show how IT will help deliver on these business goals.

      “Budgets get out of control when one department fails to care for the implications of change within another department's budget. This wastes time, reduces accuracy and causes conflict.”

      – Tara Kinney, Atomic Revenue, LLC.

      Rationalizing costs depends on the intention of the spend

      Not all spending serves the same purpose. Some types require deeper or different justifications than others.

      For the business, there are two main purposes for spend:

      1. Spending that drives revenues or the customer experience. Think in terms of return on investment (ROI), i.e. when will the expenditure pay for itself via the revenue gains it helps create?
      2. Spending that mitigates and manages risk. Think in terms of cost-benefit, i.e. what are the costs of doing something versus doing nothing at all?
      Source: Kris Blackmon, NetSuite Brainyard.

      “Approval came down to ROI and the ability to show benefits realization for years one, two, and three through five.”

      – Duane Cooney, Executive Counselor, Info-Tech Research Group, and Former Healthcare CIO

      Regardless of its ultimate purpose, all expenditure needs statements of assumptions, obstacles, and likelihood of goals being realized behind it.

      • What are the assumptions that went into the calculation?
      • Is the spend new or a reallocation (and from where)?
      • What’s the likelihood of realizing returns or benefits?
      • What are potential obstacles to realizing returns or benefits?

      Rationales aren’t only for capital projects – they can and should be applied to all proposed OpEx and CapEx. Business project rationales tend to drive revenue and the customer experience, demanding ROI calculations. Internal IT-projects and non-project expenditure are often focused on mitigating and managing risk, requiring cost-benefit analysis.

      First, make sure your numbers add up

      There are a lot of numbers flying around during a budgeting process. Now’s the time to get out of the weeds, look at the big picture, and ensure everything lines up.

      Overall

      Non-Project OpEx

      Non-Project CapEx

      Project CapEx

      • Is your proposed budget consistent with previous IT expenditure patterns?
      • Did you account for major known anomalies or events?
      • Is your final total in line with your CFO’s communicated targets and expectations?
      • Are your alternative scenarios realistic and reflective of viable economic contexts that your organization could find itself in in the near term?
      • Are the OpEx-to-CapEx ratios sensible?
      • Does it pass your gut check?
      • Did you research and verify market rates for employees and skill sets?
      • Did you research and verify likely vendor pricing and potential increases?
      • Are cost categories with variances greater than +5% backed up by defensible IT hiring plans or documented operational growth or improvement initiatives?
      • Have you accounted for the absorption of previous capital project costs into day-to-day management, maintenance, and support operations?
      • Do you have accurate depreciation amounts and timeframes for their discontinuation?
      • Are any variances driven by confirmed business plans to increase headcount, necessitating purchase of end-user hardware and on-premises software licenses?
      • Are any variances due to net-new planned/contingency purchases or the retirement of depreciable on-premises equipment?
      • Is funding for all capital projects represented reliable, i.e. has it been approved?
      • Are all in-progress, proposed, or committed project CapEx costs backed up with reliable estimates and full project documentation?
      • Do capital project costs include the capitalizable costs of employees working on those projects, and were these amounts deducted from non-project OpEx?
      • Have you estimated the longer-term OpEx impact of your current capital projects?

      4.1 Aggregate your proposed budget numbers and stress test your forecasts

      2 hours

      1. Download the IT Cost Forecasting and Budgeting Workbook for this activity. If you have been using it thus far, the Workbook will have calculated your numbers for you across the four views of the ITFM Cost Model on Tab 7, “Proposed Budget”, including:
        1. Forecasted non-project OpEx, non-project CapEx (including depreciation values), project CapEx, and total values.
        2. Numerical and percentage variances from the previous year.
      2. Test and finalize your forecasts by applying the questions on the previous slide.
      3. Flag cost categories where large variances from the previous year or large numbers in general appear – you will need to ensure your rationales for these variances are rigorous in the next step.
      4. Make amendments if needed to Tabs 4, “Business as Usual Forecast” and 5, “Project CapEx Forecast” in the IT Cost Forecasting and Budgeting Workbook.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutputMaterialsParticipants
      • Final drafts of all IT cost forecasts
      • A final proposed IT budget
      • IT Cost Forecasting and Budgeting Workbook
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Case Study

      INDUSTRY: Healthcare

      SOURCE: Anonymous

      Challenge

      Solution

      Results

      A senior nursing systems director needed the CIO’s help. She wanted to get a project off the ground, but it wasn’t getting priority or funding.

      Nurses were burning out. Many were staying one to two hours late per shift to catch up on patient notes. Their EHR platform had two problematic workflows, each taking up to about 15 minutes per nurse per patient to complete. These workflows were complex, of no value, and just not getting done. She needed a few million dollars to make the fix.

      The CIO worked with the director to do the math. In only a few hours, they realized that the savings from rewriting the workflows would allow them to hire over 500 full-time nurses.

      The benefits realized would not only help reduce nurse workload and generate savings, but also increase the amount of time spent with patients and number of patients seen overall. They redid the math several times to ensure they were right.

      The senior nursing systems director presented to her peers and leadership, and eventually to the Board of Directors. The Board immediately saw the benefits and promoted the project to first on the list ahead of all other projects.

      This collaborative approach to generating project benefits statements helped the CIO gain trust and pave the way for future budgets.

      The strength of your rationales will determine how readily your budget is approved

      When proposing expenditure, you need to thoroughly consider the organization’s goals, its governance culture, and the overall feasibility of what’s being asked.

      First, recall what budgets are really about.

      The completeness, accuracy, and granularity of your numbers and thorough ROI calculations for projects are essential. They will serve you well in getting the CFO’s attention. However, the numbers will only get you halfway there. Despite what some people think, the work in setting a budget is more about the what, how, and why – that is, the rationale – than about the how much.

      Next, revisit Phase 1 of this blueprint and review:

      • Your organization’s budgeting culture and processes.
      • The typical accountabilities, priorities, challenges, opportunities, and expectations associated with your CFO, CEO, and CXO IT budget stakeholders.
      • Your budgetary mandate as the head of IT.

      Then, look at each component of your proposed budget through each of these three rationale-building lenses.

      Business goals
      What are the organization’s strategic priorities?

      Governance culture
      How constrained is the decision-making process?

      Feasibility
      Can we make it happen?

      Linking proposed spend to strategic goals isn’t just for strategic project CapEx

      Tie in your “business as usual” non-project OpEx and CapEx, as well.

      Business goals

      What are the organization’s strategic priorities?

      Context

      This is all about external factors, namely the broader economic, political, and industry contexts in which the organization operates.

      Lifecycle position

      The stage the organization is at in terms of growth, stability, or decline will drive decisions, priorities, and the ability to spend or invest.

      Opportunities

      Context and lifecycle position determine opportunities, which are often defined in terms of potential cost savings
      or ROI.

      Tie every element in your proposed budget to an organizational goal.

      Non-project OpEx

      • Remember that OpEx is what comes from the realization of past strategic goals. If that past goal is still valid, then the OpEx that keeps that goal alive is, too.
      • Business viability and continuity are often unexpressed goals. OpEx directly supports these goals.
      • Periodically apply zero-based budgeting to OpEx to re-rationalize and identify waste.

      Non-project CapEx

      • Know the impact of any business growth goals on future headcount – this is essential to rationalize laptop/desktop and other end-user hardware spend.
      • Position infrastructure equipment spend in terms of having sufficient capacity to support growth goals as well as ensuring network/system reliability and continuity.
      • Leverage depreciation schedules as backup.

      Project CapEx

      • Challenge business-driven CapEx projects if they don’t directly support stated goals.
      • Ideally, the goal-supporting rationales for software, hardware, and workforce CapEx have been laid out in an already-approved project proposal. Refer to these plans.
      • If pitching a capital project at the last minute, especially an IT-driven one, expect a “no” regardless of how well it ties to goals.

      Your governance culture will determine what you need to show and when you show it

      The rigor of your rationales is entirely driven by “how things are done around here.”

      Governance Culture

      How rigorous/ constrained
      is decision-making?

      Risk tolerance

      This is the organization’s willingness to be flexible, take chances, make change, and innovate. It is often driven by legal and regulatory mandates.

      Control

      Control manifests in the number and nature of rules and how authority and accountability are centralized or distributed in the organization.

      Speed to action

      How quickly decisions are made and executed upon is determined by the amount of consultation and number of approval steps.

      Ensure all parts of your proposed budget align with what’s tolerated and allowed.

      Non-project OpEx

      • Don’t hide OpEx. If it’s a dirty word, put it front and center to start normalizing it.
      • As with business goals, position OpEx as necessary for business continuity and risk mitigation, as well as the thing that keeps long-term strategic goals alive.
      • Focus on efficiency and cost control, both in terms of past and future initiatives, regardless of the governance culture.

      Non-project CapEx

      • Treat non-project CapEx in the same way as you would non-project OpEx.
      • IT must make purchases quickly in this area of spend, but drawn-out procurement processes can make this impossible. Consider including a separate proposal to establish a policy that gives IT the control to make end-user and network/data center equipment purchases faster and easier.

      Project CapEx

      • If your organization is risk-averse, highly centralized, or slow to act, don’t expect IT to win approval for innovative capital projects. Let the business make any pitches and have IT serve in a supporting role.
      • Capital projects are often committed to 6-12 months in advance and can’t be completed within a fiscal year. Nudge the organization toward longer-term, flexible funding.

      No matter which way your goals and culture lean, ground all your rationales in reality

      Objective, unapologetic facts are your strongest rationale-building tool.

      Feasibility

      Can we do it, and what sacrifices will we have to make?

      Funding

      The ultimate determinant of feasibility is the availability, quantity, and reliability of funding next fiscal year and over the long term to support investment.

      Capabilities

      Success hinges on both the availability and accessibility of required skills and knowledge to execute on a spend plan in the required timeframe.

      Risk

      Risk is not just about obstacles to success and what could happen if you do something – it’s also about what could happen if you do nothing at all.

      Vet every part of your proposed budget to ensure what you’re asking for is both realistic and possible.

      Non-project OpEx

      • Point out your operational waste-reduction and efficiency-gaining efforts in hard, numerical terms.
      • Clearly demonstrate that OpEx cannot be reduced without sacrifices on the business side, specifically in terms of service levels.
      • Define OpEx impacts for all CapEx proposals to ensure funding commitments include long-term maintenance and support.

      Non-project CapEx

      • This is a common source of surprise budget overage, and IT often sacrifices parts of its OpEx budget to cover it. Shed light on this problem and define IT’s boundaries.
      • A core infrastructure equipment contingency fund and a policy mandating business units pay for unbudgeted end-user tech due to unplanned or uncommunicated headcount increases are worth pursuing.

      Project CapEx

      • Be sure IT is involved with every capital project proposal that has a technological implication (which is usually all of them).
      • Specifically, IT should take on responsibility for tech vendor evaluation and negotiation. Never leave this up to the business.
      • Ensure IT gains funding for supporting any technologies acquired via a capital planning process, including hiring if necessary.

      Double-check to ensure your bases are covered

      Detailed data and information checklist:

      • I have the following data and information for each item of proposed expenditure:
      • Sponsors, owners, and/or managers from IT and the business.
      • CapEx and OpEx costs broken down by workforce (employees/contract) and vendor (software, hardware, services) at a minimum for both last fiscal year (if continuing spend) and next fiscal year to demonstrate any changes.
      • Projected annual costs for the above, extending two to five years into the future, with dates when new spending will start, known depreciations will end, and CapEx will transition to OpEx.
      • Descriptions of any tradeoffs or potential obstacles.
      • Lifespan information for new, proposed assets informing depreciation scheduling.
      • Sources of funding (especially if new, transferred, or changed).
      • Copies of any research used to inform any of the above.

      High-level rationale checklist:

      • I have done the following thinking and analysis for each item of proposed expenditure:
      • Considered it in the context of my organization’s broader operating environment and the constraints and opportunities this creates.
      • Tied it – directly or indirectly – to the achievement or sustainment of current or past (but still relevant) organizational goals.
      • Understood my organization’s tolerances, how things get done, and whether I can win any battles that I need to fight given these realities.
      • Worked with business unit leaders to fully understand their plans and how IT can support them.
      • Obtained current, verifiable data and information and have a good idea if, when, and how this information may change next year.
      • Assessed benefits, risks, dependencies, and overall feasibility, as well as created ROI statements where needed.
      • Stuck to the facts and am confident they can speak for themselves.

      For more on creating detailed business cases for projects and investments, see Info-Tech’s comprehensive blueprint, Build a Comprehensive Business Case.

      4.2 Challenge and perfect your rationales

      2 hours

      1. Based on your analysis in Phase 1, review your organization’s current and near-term business goals (context, lifecycle position, opportunities), governance culture (risk tolerance, control, speed to action), and feasibility (funding, capabilities, risk) to understand what’s possible, what’s not, and your general boundaries.
      2. Review your proposed budget in its current form and flag items that may be difficult or impossible to sell, given the above.
      3. Systematically go through each item in you proposed budget and apply the detailed data and information and high-level rationale checklists on the previous slide to ensure you have considered it from every angle and have all the information you need to defend it.
      4. Track down any additional information needed to fill gaps and fine-tune your budget based on any discoveries, including eliminating or adding elements if needed.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • Final drafts of all IT cost forecasts, including rationales
      • Fully rationalized proposed IT budget for next fiscal year
      MaterialsParticipants
      • IT Cost Forecasting and Budgeting Workbook
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Phase recap: Build your proposed budget

      You can officially say your proposed IT budget is done. Now for the communications part.

      This phase is where everything came together into a coherent budget proposal. You were able to:

      • Aggregate your numbers. This involved pulling for project and non-project CapEx and OpEx forecasts into a single proposed IT budget total.
      • Stress-test your forecasts. Here, you ensured that all your numbers were accurate and made sense.
      • Challenge and perfect your rationales. Finally, you made sure you have all your evidence in place and can defend every component in your proposed IT budget regardless of who’s looking at it.

      “Current OpEx is about supporting and aligning with past business strategies. That’s alignment. If the business wants to give up on those past business strategies, that’s up to them.”

      – Darin Stahl, Distinguished Analyst and Research Fellow, Info-Tech Research Group

      Phase 5

      Create and Deliver Your Presentation

      Lay Your
      Foundation

      Get Into Budget-Starting Position

      Develop Your
      Forecasts

      Build Your
      Proposed Budget

      Create and Deliver Your Presentation

      1.1 Understand what your budget is
      and does

      1.2 Know your stakeholders

      1.3 Continuously pre-sell your budget

      2.1 Assemble your resources

      2.2 Understand the four views of the ITFM Cost Model

      2.3 Review last year’s budget vs.
      actuals and five-year historical trends

      2.4 Set your high-level goals

      3.1 Develop assumptions and
      alternative scenarios

      3.2 Forecast your project CapEx

      3.3 Forecast your non-project CapEx and OpEx

      4.1 Aggregate your numbers

      4.2 Stress test your forecasts

      4.3 Challenge and perfect your
      rationales

      5.1 Plan your content

      5.2 Build your presentation

      5.3 Present to stakeholders

      5.4 Make final adjustments and submit your IT budget

      This phase will walk you through the following activities:

      • Planning the content you’ll include in your budget presentation.
      • Pulling together your formal presentation.
      • Presenting, finalizing, and submitting your budget.

      This phase involves the following participants:

      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Create and deliver your presentation

      Pull it all together into something you can show your approvers and stakeholders and win IT budgetary approval.

      This phase focuses on developing your final proposed budget presentation for delivery to your various stakeholders. Here you will:

      • Plan your final content. Decide the narrative you want to tell and select the visualizations and words you want to include in your presentation (or presentations) depending on the makeup of your target audience.
      • Build your presentation. Pull together all the key elements in a PowerPoint template in a way that best tells the IT budget story.
      • Present to stakeholders. Deliver your IT budgetary message.
      • Make final adjustments and submit your budget. Address any questions, make final changes, and deconstruct your budget into the account categories mandated by your Finance Department to plug into the budget template they’ve provided.

      “I could have put the numbers together in a week. The process of talking through what the divisions need and spending time with them is more time consuming than the budget itself.”

      – Jay Gnuse, IT Director, Chief Industries

      The content you select to present depends on your objectives and constraints

      Info-Tech classifies potential content according to three basic types: mandatory, recommended, and optional. What’s the difference?

      Mandatory: Just about every CFO or approving body will expect to see this information. Often high level in nature, it includes:

      • A review of last year’s performance.
      • A comparison of proposed budget totals to last year’s actuals.
      • A breakdown of CapEx vs. OpEx.
      • A breakdown of proposed expenditure according to traditional workforce and vendor costs.

      Recommended: This information builds on the mandatory elements, providing more depth and detail. Inclusion of recommended content depends on:

      • Availability of the information.
      • Relevance to a current strategic focus or overarching initiative in the organization.
      • Known business interest in the topic, or the topic’s ability to generate interest in IT budgetary concerns in general.

      Optional: This is very detailed information that provides alternative views and serves as reinforcement of your key messages. Consider including it if:

      • You need to bring fuller transparency to a murky IT spending situation.
      • Your audience is open to it, i.e. it wouldn’t be seen as irrelevant, wasting their time, or a cause of discord.
      • You have ample time during your presentation to dive into it.

      Deciding what to include or exclude depends 100% on your target audience. What will fulfill their basic information needs as well as increase their engagement in IT financial issues?

      Revisit your assumptions and alternative scenarios first

      These represent the contextual framework for your proposal and explain why you made the decisions you did.

      Stating your assumptions and presenting at least two alternative scenarios helps in the following ways:

      1. Identifies the factors you considered when setting budget targets and proposing specific expenditures, and shows that you know what the important factors are.
      2. Lays the logical foundation for all the rationales you will be presenting.
      3. Demonstrates that you’ve thought broadly about the future of the organization and how IT is best able to support that future organization regardless of its state and circumstances.

      Your assumptions and alternative scenarios may not appear back-to-back in your presentation, yet they’re intimately connected in that every unique scenario is based on adjustments to your core assumptions. These tweaks – and the resulting scenarios – reflect the different degrees of probability that a variable is likely to land on a certain value (i.e. an alternative assumption).

      Your primary scenario is the one you believe is most likely to happen and is represented by the complete budget you’re recommending and presenting.

      Target timeframe for presentation: 2 minutes

      Key objectives: Setting context, demonstrating breadth of thought.

      Potential content for section:

      • List of assumptions for the budget being presented (primary target scenario).
      • Two or more alternative scenarios.

      “Things get cut when the business
      doesn’t know what something is,
      doesn’t recognize it, doesn’t understand it. There needs to be an education.”

      – Angie Reynolds, Principal Research Director, ITFM Practice,
      Info-Tech Research Group,

      Select your assumptions and scenarios

      See Tabs “Planning Variables” and 9, “Alternative Scenarios” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Core assumptions

      Primary target scenario

      Alternative scenarios

      Full alternative scenario budgets

      List

      Slide

      Slide

      Budget

      Mandatory: This is a listing of both internal and external factors that are most likely to affect the challenges and opportunities your organization will have and how it can and will operate. This includes negotiable and non-negotiable internal and external constraints, stated priorities, and the expression of known risk factors.

      Mandatory: Emanating from your core assumptions, this scenario is a high-level statement of goals, initial budget targets, and proposed budget based on your core assumptions.

      Recommended: Two alternatives are typical, with one higher spend and one lower spend than your target. The state of the economy and funding availability are the assumptions usually tweaked. More radical scenarios, like the cost and implications of completely outsourcing IT, can also be explored.

      Optional: This is a lot of work, but some IT leaders do it if an alternative scenario is a strong contender or is necessary to show that a proposed direction from the business is costly or not feasible.

      The image contains screenshots of tab Planning Variables and Alternative Scenarios.

      The first major section of your presentation will be a retrospective

      Plan to kick things off with a review of last year’s results, factors that affected what transpired, and longer-term historical IT expenditure trends.

      This retrospective on IT expenditure is important for three reasons:

      1. Clarifying definitions and the different categories of IT expenditure.
      2. Showing your stakeholders how, and how well you aligned IT expenditure with business objectives.
      3. Setting stakeholder expectations about what next year’s budget will look like based on past patterns.

      You probably won’t have a lot of time for this section, so everything you select to share should pack a punch and perform double duty by introducing concepts you’ll need your stakeholders to have internalized when you present next year’s budget details.

      Target timeframe for presentation: 7 minutes

      Key objectives: Definitions, alignment, expectations-setting.

      Potential content for section:

      • Last fiscal year budgeted vs. actuals
      • Expenditure by type
      • Major capital projects completed
      • Top vendor spend
      • Drivers of last year’s expenditures and efficiencies
      • Last fiscal year in in detail (expense view, service view, business view, innovation view)
      • Expenditure trends for the past five years

      “If they don’t know the consequences of their actions, how are they ever going to change their actions?”

      – Angela Hintz, VP of PMO & Integrated Services,
      Blue Cross and Blue Shield of Louisiana

      Start at the highest level

      See Tabs 1 “Historical Events & Projects,” 3 “Historical Analysis,” and 6 “Vendor Worksheet” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Total budgeted vs. total actuals

      Graph

      Mandatory: Demonstrates the variance between what you budgeted for last year and what was actually spent. Explaining causes of variance is key.

      l actuals by expenditure type

      Graph

      Mandatory: Provides a comparative breakdown of last year’s expenditure by non-project OpEx, non-project CapEx, and project CapEx. This offers an opportunity to explain different types of IT expenditure and why they’re the relative size they are.

      Major capital projects completed

      List

      Mandatory: Illustrates progress made toward strategically important objectives.

      Top vendors

      List

      Recommended: A list of vendors that incurred the highest costs, including their relative portion of overall expenditure. These are usually business software vendors, i.e. tools your stakeholders use every day. The number of vendors shown is up to you.

      The image contains screenshots from Tabs 1, 3, and 6 of the IT Cost Forecasting and Budgeting Workbook.

      Describe drivers of costs and savings

      See Tab 1, “Historical Events & Projects” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Cost drivers

      List

      Mandatory: A list of major events, circumstances, business decisions, or non-negotiable factors that necessitated expenditure. Be sure to focus on the unplanned or unexpected situations that caused upward variance.

      Savings drivers

      List

      Mandatory: A list of key initiatives pursued, or circumstances that resulted in efficiencies or savings. Include any deferred or canceled projects.

      The image contains screenshots from Tab 1 of the IT Cost Forecasting and Budgeting Workbook.

      Also calculate and list the magnitude of costs incurred or savings realized in hard financial terms so that the full impact of these events is truly understood by your stakeholders.

      “What is that ongoing cost?
      If we brought in a new platform, what
      does that do to our operating costs?”

      – Kristen Thurber, IT Director, Office of the CIO, Donaldson Company

      End with longer-term five-year trends

      See Tab 3 “Historical Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      IT actual expenditure
      year over year

      Graph

      Mandatory: This is crucial for showing overall IT expenditure patterns, particularly percentage changes up or down year to year, and what the drivers of those changes were.

      IT actuals as a % of organizational revenue

      Graph

      Mandatory: You need to set the stage for the proposed percentage of organizational revenue to come. The CFO will be looking for consistency and an overall decreasing pattern over time.

      IT expenditure per FTE year over year

      Graph

      Optional: This can be a powerful metric as it’s simple and easily to understand.

      The image contains screenshots from Tab 3 of the IT Cost Forecasting and Budgeting Workbook.

      The historical analysis you can do is endless. You can generate many more cuts of the data or go back even further – it’s up to you.

      Keep in mind that you won’t have a lot of time during your presentation, so stick to the high-level, high-impact graphs that demonstrate overarching trends or themes.

      Show different views of the details

      See Tab 3 “Historical Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Budgeted vs. actuals CFO expense view

      Graph

      Mandatory: Showing different types of workforce expenditure compared to different types of vendor expenditure will be important to the CFO.

      Budgeted vs. actuals CIO services view

      Graph

      Optional: Showing the expenditure of some IT services will clarify the true total costs of delivering and supporting these services if misunderstandings exist.

      Budgeted vs. actuals CXO business view

      Graph

      Optional: A good way to show true consumption levels and the relative IT haves and have-nots. Potentially political, so consider sharing one-on-one with relevant business unit leaders instead of doing a big public reveal.

      Budgeted vs. actual CEO innovation view

      Graph

      Optional: Clarifies how much the organization is investing in innovation or growth versus keeping the lights on. Of most interest to the CEO and possibly the CFO, and good for starting conversations about how well funding is aligned with strategic directions.

      The image contains screenshots from Tab 3 of the IT Cost Forecasting and Budgeting Workbook.

      5.1a Select your retrospective content

      30 minutes

      1. Open your copy of the IT Cost Forecasting and Budgeting Workbook.
      2. From Tabs 1, “Historical Events & Projects, 3 “Historical Analysis”, and 6, “Vendor Worksheet,” select the visual outputs (graphs and lists) you plan to include in the retrospective section of your presentation. Consider the following when determining what to include or exclude:
        1. Fundamentals: Elements such as budgeted vs. actual, distribution across expenditure types, and drivers of variance are mandatory.
        2. Key clarifications: What expectations need to be set or common misunderstandings cleared up? Strategically insert visuals that introduce and explain important concepts early.
        3. Your time allowance. Plan for a maximum of seven minutes for every half hour of total presentation time.
      3. Note what you plan to include in your presentation and set aside.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • Data and graphs from the completed IT Cost Forecasting and Budgeting Workbook
      • Selected content and visuals for the historical/ retrospective section of the IT Budget Executive Presentation
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Next, transition from past expenditure to your proposal for the future

      Build a logical bridge between what happened in the past to what’s coming up next year using a comparative approach and feature major highlights.

      This transitional phase between the past and the future is important for the following reasons:

      1. It illustrates any consistent patterns of IT expenditure that may exist and be relevant in the near term.
      2. It sets the stage for explaining any deviations from historical patterns that you’re about to propose.
      3. It grounds proposed IT expenditure within the context of commitments made in previous years.

      Consider this the essential core of your presentation – this is the key message and what your audience came to hear.

      Target timeframe for presentation: 10 minutes

      Key objectives: Transition, reveal proposed budget.

      Potential content for section:

      • Last year’s actuals vs. next year’s proposed.
      • Next year’s proposed budget in context of the past five years’ year-over-year actuals.
      • Last year’s actual expenditure type distribution vs. next year’s proposed budget distribution.
      • Major projects to be started next year.

      “The companies...that invest the most in IT aren’t necessarily the best performers.
      On average, the most successful small and medium companies are more frugal when it comes to
      company spend on IT (as long as they do it judiciously).”

      – Source: Techvera, 2023

      Compare next year to last year

      See Tab 8, “Proposed Budget Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Last year’s total actuals vs. next year’s total forecast

      Proposed budget in context: Year-over-year expenditure

      Last year’s actuals vs. next year’s proposed by expenditure type

      Last year’s expenditure per FTE vs. next year’s proposed

      Graph

      Graph

      Graph

      Graph

      Mandatory: This is the most important graph for connecting the past with the future and is also the first meaningful view your audience will have of your proposed budget for next year.

      Mandatory: Here, you will continue the long-term view introduced in your historical data by adding on next year’s projections to your existing five-year historical trend. The percentage change from last year to next year will be the focus.

      Recommended: A double-comparative breakdown of last year vs. next year by non-project OpEx, non-project CapEx, and project CapEx illustrates where major events, decisions, and changes are having their impact.

      Optional: This graph is particularly useful in demonstrating the success of cost-control if the actual proposed budget is higher that the previous year but the IT cost per employee has gone down.

      The image contains screenshots from Tab 8 of the IT Cost Forecasting and Budgeting Workbook.

      Select business projects to profile

      See Tab 5, “Project CapEx Forecast” in your IT Cost Forecasting and Budgeting Workbook for the data and information to create these outputs.

      Major project profile

      Slide

      Mandatory: Focus on projects for which funding is already committed and lean toward those that are strategic or clearly support business goal attainment. How many you profile is up to you, but three to five is suggested.

      Minor project overview

      List

      Optional: List other projects on IT’s agenda to communicate the scope of IT’s project-related responsibilities and required expenditure to be successful. Include in-progress projects that will be completed next year and net-new projects on the roster.

      The image contains screenshots from Tab 5 of the IT Cost Forecasting and Budgeting Workbook.

      You can’t profile every project on the list, but it’s important that your stakeholders see their priorities clearly reflected in your budget; projects are the best way to do this.

      If you’ve successfully pre-sold your budget and partnered with business-unit leaders to define IT initiatives, your stakeholders should already be very familiar with the project summaries you put in front of them in your presentation.

      5.1b Select your transitional past-to-future content

      30 minutes

      1. Open your copy of the IT Cost Forecasting and Budgeting Workbook.
      2. From Tabs 5, “Project CapEx Forecast” and 7, “Proposed Budget Analysis”, select the visual outputs (graphs and lists) you plan to include in the transitional section of your presentation. Consider the following when determining what to include or exclude:
        1. Shift from CapEx to OpEx: If this has been a point of contention or confusion with your CFO in the past, or if your organization has actively committed to greater cloud or outsourcing intensity, you’ll want to show this year-to-year shift in expenditure type.
        2. Strategic priorities: Profile major capital projects that reflect stakeholder priorities. If your audience is already very familiar with these projects, you may be able to skip detailed profiles and simply list them.
        3. Your time allowance. Plan for a maximum of 10 minutes for every half hour of total presentation time.
      3. Note what you plan to include in your presentation and set aside.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • Data and graphs from the completed IT Cost Forecasting and Budgeting Workbook
      • Selected content and visuals for the past-to-future transitional section of the IT Budget Executive Presentation
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Finally, carefully select detailed drill-downs that add clarity and depth to your proposed budget

      The graphs you select here will be specific to your audience and any particular message you need to send.

      This detailed phase of your presentation is important because it allows you to:

      1. Highlight specific areas of IT expenditure that often get buried under generalities.
      2. View your proposed budget from different perspectives that are most meaningful to your audience, such as traditional workforce vs. vendor allocations, expenditure by IT service, business-unit consumption, and the allocation of funds to innovation and growth versus daily IT operations.
      3. Get stakeholder attention. For example, laying out exactly how much money will be spent next year in support of the Sales Department compared to other units will get the VP of Sales’ attention…and everyone else’s, for that matter. This kind of transparency is invaluable for enabling meaningful conversations and thoughtful decision-making about IT spend.

      Target timeframe for presentation: 7 minutes, but this phase of the presentation may naturally segue into the final Q&A.

      Key objectives: Transparency, dialogue, buy-in.

      Potential content for section:

      • Allocation across workforce vs. vendors
      • Top vendors by expenditure
      • Allocation across on-premises vs. cloud
      • Allocation across core IT services
      • Allocation across core business units
      • Allocation across business focus area

      “A budget is a quantified version of
      your service-level agreements.”

      – Darin Stahl, Distinguished Analysis & Research Fellow,
      Info-Tech Research Group,

      Start with the expense view details

      See Tab 8, “Proposed Budget Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Proposed budget: Workforce and vendors by expenditure type

      Graph

      Mandatory: This is the traditional CFO’s view, so definitely show it. The compelling twist here is showing it by expenditure type, i.e. non-project OpEx, non-project CapEx, and project CapEx.

      Proposed budget: Cloud vs. on-premises vendor expenditure

      Graph

      Optional: If this is a point of contention or if an active transition to cloud solutions is underway, then show it.

      Top vendors

      Graph

      Recommended: As with last year’s actuals, showing who the top vendors are slated to be next year speaks volumes to stakeholders about exactly where much of their money is going.

      If you have a diverse audience with diverse interests, be very selective – you don’t want to bore them with things they don’t care about.

      The image contains screenshots from Tab 8 of the IT Cost Forecasting and Budgeting Workbook.

      Offer choice details on the other views

      See Tab 8, “Proposed Budget Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.

      Proposed budget: IT services by expenditure type

      Graph

      Optional: Business unit leaders will be most interested in the application services. Proposed expenditure on security and data and BI services may be of particular interest given business priorities. Don’t linger on infrastructure spend unless chargeback is in play.

      Proposed budget: Business units by expenditure type

      Graph

      Optional: The purpose of this data is to show varying business units where they stand in terms of consumption. It may be more appropriate to show this graph in a one-on-one meeting or other context.

      Proposed budget: Business focus by expenditure type

      Graph

      Optional: The CEO will care most about this data. If they’re not in the room, then consider bypassing it and discuss it separately with the CFO.

      Inclusion of these graphs really depends on the makeup of your audience. It’s a good decision to show all of them to your CFO at some point before the formal presentation. Consider getting their advice on what to include and exclude.

      The image contains screenshots from Tab 8 of the IT Cost Forecasting and Budgeting Workbook.

      5.1c Select next year’s expenditure sub-category details

      30 minutes

      1. Open your copy of the IT Cost Forecasting and Budgeting Workbook.
      2. From Tab 8, “Proposed Budget Analysis,” select the visual outputs (graphs) you plan to include in the targeted expenditure sub-category details section of your presentation. Consider the following when determining what to include or exclude:
        1. The presence of important fence-sitters. If there are key individuals who require more convincing, this is where you show them the reality of what it costs to deliver their most business-critical IT services to them.
        2. The degree to which you’ve already gone over the numbers previously with your audience. Again, if you’ve done your pre-selling, this data may be old news and not worth going over again.
        3. Your time allowance. Plan for a maximum of seven minutes for every half hour of total presentation time.
      3. Note what you plan to include in your presentation and set aside.

      Download the IT Cost Forecasting and Budgeting Workbook

      InputOutput
      • Data and graphs from the completed IT Cost Forecasting and Budgeting Workbook
      • Selected content and visuals for the expenditure category details section of the IT Budget Executive Presentation
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT Financial Lead
      • Other IT Management

      Finalize your line-up and put your selected content into a presentation template

      This step is about nailing down the horizontal logic of the story you want to tell. Start by ordering and loading the visualizations of your budget data.

      Download Info-Tech’s IT Budget Executive Presentation Template

      The image contains a screenshot of the IT Budget Executive Presentation Template.

      If you prefer, use your own internal presentation standard template instead and Info-Tech’s template as a structural guide.

      Regardless of the template you use, Info-Tech recommends the following structure:

      1. Summary: An overview of your decision-making assumptions, initial targets given the business context, and the total proposed IT budget amount.
      2. Retrospective: An overview of previous years’ performance, with a specific focus on last fiscal year.
      3. Proposed budget overview: A high-level view of the proposed budget for next fiscal year in the context of last year’s performance (i.e. the bridge from past to future), including alternative scenarios considered and capital projects on the roster.
      4. Proposed budget details by category: Detailed views of the proposed budget by expense type, IT service, business unit, and business focus category.
      5. Next steps: Include question-and-answer and itemization of your next actions through to submitting your final budget to the CFO.

      Draft the commentary that describes and highlights your data’s key messages

      This is where the rationales that you perfected earlier come into play.

      Leave the details for the speaker’s notes.
      Remember that this is an executive presentation. Use tags, pointers, and very brief sentences in the body of the presentation itself. Avoid walls of text. You want your audience to be listening to your words, not reading a slide.

      Speak to everything that represents an increase or decrease of more than 5% or that simply looks odd.
      Being transparent is essential. Don’t hide anything. Acknowledge the elephant in the room before your audience does to quickly stop suspicious or doubtful thoughts

      Identify causes and rationales.
      This is why your numbers are as they are. However, if you’re not 100% sure what all driving factors are, don’t make them up. Also, if the line between cause and effect isn’t straight, craft in advance a very simple way of explaining it that you can offer whenever needed.

      Be neutral and objective in your language.
      You need to park strong feelings at the door. You’re presenting rational facts and thoroughly vetted recommendations. The best defense is not to be defensive, or even offensive for that matter. You don’t need to argue, plead, or apologize – let your information speak for itself and allow the audience to arrive at their own logical conclusions.

      Re-emphasize your core themes to create connections.
      If a single strategic project is driving cost increases across multiple cost categories, point it out multiple times if needed to reinforce its importance. If an increase in one area is made possible by a significant offset in another, say so to demonstrate your ongoing commitment to efficiencies. If a single event from last year will continue having cost impacts on several IT services next year, spell this out.

      5.2 Develop an executive presentation

      Duration: 2 hours

      1. Download the IT Budget Executive Presentation PowerPoint template.
      2. Open your working version of the IT Cost Forecasting and Budgeting Workbook and copy and paste your selected graphs and tables into the template. Note: Pasting as an image will preserve graph formatting.
      3. Incorporate observations and insights about your proposed budget and other analysis into the template where indicated.
      4. Conduct an internal review of the final presentation to ensure it includes all the elements you need and is error-free.

      Note: Refer to your organization’s standards and norms for executive-level presentations and either adapt the Info-Tech template accordingly or use your own.

      Download the IT Budget Executive Presentation template

      Input Output
      • Tabular and graphical data outputs in the IT Cost Forecasting and Budgeting Workbook
      • Interpretive commentary based on your analysis
      • Executive presentation summarizing your proposed IT budget
      Materials Participants
      • IT Cost Forecasting and Budgeting Workbook
      • IT Budget Executive Presentation template
      • CIO/IT Directors
      • IT Financial Lead
      • Other IT Management

      Now it’s time to present your proposed IT budget for next fiscal year

      If you’ve done your homework and pre-sold your budget, the presentation itself should be a mere formality with no surprises for anyone, including you.

      Some final advice on presenting your proposed budget…

      Partner up

      If something big in your budget is an initiative that’s for a specific business unit, let that business unit’s leader be the face of it and have IT play the role of supporting partner.

      Use your champions

      Let your advocates know in advance that you’d appreciate hearing their voice during the presentation if you encounter any pushback, or just to reinforce your main messages.

      Focus on the CFO

      The CFO is the most important stakeholder in the room at the end of the day, even more than the CEO in some cases. Their interests should take priority if you’re pressed for time.

      Avoid judgment

      Let the numbers speak for themselves. Do point out highlights and areas of interest but hold off on offering emotion-driven opinions. Let your audience draw their own conclusions.

      Solicit questions

      You do want dialogue. However, keep your answers short and to the point. What does come up in discussion is a good indication of where you’ll need to spend more time in the future.

      The only other thing that can boost your chances is if you’re lucky enough to be scheduled to present between 10:00 and 11:00 on a Thursday morning when people are most agreeable. Beyond that, apply the standard rules of good presentations to optimize your success.

      Your presentation is done – now re-focus on budget finalization and submission

      This final stage tends to be very administrative. Follow the rules and get it done.

      • Incorporate feedback: Follow up on comments from your first presentation and reflect them in your budget if appropriate. This may include:
        • Having follow-up conversations with stakeholders.
        • Further clarifying the ROI projections or business benefits.
        • Adjusting proposed expenditure amounts based on new information or a shift in priorities.
        • Adding details or increasing granularity around specific issues of interest.
      • Trim: Almost every business unit leader will need to make cuts to their initial budget proposal. After all, the CFO has a finite pool of money to allocate. If all’s gone well, it may only be a few percent. Resurrect your less-costly alternative scenario and selectively apply the options you laid out there. Focus on downsizing or deferring capital projects if possible. If you must trim OpEx, remind the CFO about any service-level adjustments that will need to happen to make the less expensive alternatives work.
      • Re-present: It’s not unusual to have to present your budget one more time after you’ve made your adjustments. In some organizations, the first presentation is to an internal executive group while the second one is to a governing board. The same rules apply to this second presentation as to your first one.
      • Submit: Slot your final budget into the list of accounts prescribed in the budget template provided by Finance. These templates often don’t align with IT’s budget categories, but you’ll have to make do.

      Phase recap: Create and deliver your presentation

      You’ve reached the end of the budget creation and approval process. Now you can refocus on using your budget as a living governance tool.

      This phase focused on developing your final proposed budget presentation for delivery to your various stakeholders. Here, you:

      • Planned your final content. You selected the data and visuals to include and highlight.
      • Built your presentation. You pulled everything together into a PowerPoint template and crafted commentary to tell a cohesive IT budget story.
      • Presented to stakeholders. You delivered your proposed IT budget and solicited their comments and feedback.
      • Made final adjustments and submitted your budget. You applied final tweaks, deconstructed your budget to fit Finance’s template, and submitted it for entry into Finance’s system.

      “Everyone understands that there’s never enough money. The challenge is prioritizing the right work and funding it.”

      – Trisha Goya, Director, IT Governance & Administration, Hawaii Medical Service Association

      Next Steps

      “Keep that conversation going throughout the year so that at budgeting time no one is surprised…Make sure that you’re telling your story all year long and keep track of that story.”

      – Angela Hintz, VP of PMO & Integrated Services,
      Blue Cross and Blue Shield of Louisiana

      This final section will provide you with:

      • An overall summary of accomplishment.
      • Recommended next steps.
      • A list of contributors to this research.
      • Some related Info-Tech resources.

      Summary of Accomplishment

      You’ve successfully created a transparent IT budget and gotten it approved.

      By following the phases and steps in this blueprint, you have:

      1. Learned more about what an IT budget does and what it means to your key stakeholders.
      2. Assembled your budgeting team and critical data needed for forecasting and budgeting, as well as set expenditure goals for next fiscal year, and metrics for improving the budgeting process overall.
      3. Forecasted your project and non-project CapEx and OpEx for next fiscal year and beyond.
      4. Fine-tuned your proposed expenditure rationales.
      5. Crafted and delivered an executive presentation and got your budget approved.

      What’s next?

      Use your approved budget as an ongoing IT financial management governance tool and track your budget process improvement metrics.

      If you would like additional support, have our analysts guide you through an Info-Tech full-service engagement or Guided Implementation.

      Contact your account representative for more information.

      1-888-670-8889

      Research Contributors and Experts

      Monica Braun

      Research Director, ITFM Practice

      Info-Tech Research Group

      Carol Carr

      Technical Counselor (Finance)

      Info-Tech Research Group

      Larry Clark

      Executive Counselor

      Info-Tech Research Group

      Duane Cooney

      Executive Counselor

      Info-Tech Research Group

      Lynn Fyhrlund

      Former Chief Information Officer

      Milwaukee County

      Jay Gnuse

      Information Technology Director

      Chief Industries

      Trisha Goya

      Director, IS Client Services

      Hawaii Medical Service Association

      Angela Hintz

      VP of PMO & Integrated Services

      Blue Cross and Blue Shield of Louisiana

      Rick Hopfer

      Chief Information Officer

      Hawaii Medical Service Association

      Theresa Hughes

      Executive Counselor

      Info-Tech Research Group

      Research Contributors and Experts

      Dave Kish

      Practice Lead, IT Financial Management Practice

      Info-Tech Research Group

      Matt Johnson

      IT Director Governance and Business Solutions

      Milwaukee County

      Titus Moore

      Executive Counselor

      Info-Tech Research Group

      Angie Reynolds

      Principal Research Director, IT Financial Management Practice

      Info-Tech Research Group

      Mark Roman

      Managing Partner, Executive Services

      Info-Tech Research Group

      Darin Stahl

      Distinguished Analyst & Research Fellow

      Info-Tech Research Group

      Miguel Suarez

      Head of Technology

      Seguros Monterrey New York Life

      Kristen Thurber

      IT Director, Office of the CIO

      Donaldson Company

      Related Info-Tech Research & Services

      Achieve IT Spend & Staffing Transparency

      • IT spend has increased in volume and complexity, but how IT spend decisions are made has not kept pace.
      • Lay a foundation for meaningful conversations and informed decision making around IT spend by transparently mapping exactly where IT funds are really going.

      IT Spend & Staffing Benchmarking Service

      • Is a do-it-yourself approach to achieving spend transparency too onerous? Let Info-Tech do the heavy lifting for you.
      • Using Info-Tech’s ITFM Cost Model, our analysts will map your IT expenditure to four different stakeholder views – CFO Expense View, CIO Service View, CXO Business View, and CEO Innovation View – so that you clearly show where expenditure is going in terms that stakeholders can relate to and better demonstrate IT’s value to the business.
      • Get a full report that shows how your spend is allocated plus benchmarks that compare your results to those of your industry peers.

      Build Your IT Cost Optimization Roadmap

      • Cost optimization is usually thought about in terms of cuts, when it’s really about optimizing IT’s cost-to-value ratio.
      • Develop a cost-optimization strategy based on your organization’s circumstances and timeline focused on four key areas of IT expenditure: assets, vendors, projects, and workforce.

      Bibliography

      “How Much Should a Company Spend on IT?” Techvera, no date. Accessed 3 Mar. 2023.
      “State of the CIO Study 2023.” Foundry, 25 Jan. 2023. Accessed 3 Mar. 2023.
      Aberdeen Strategy & Research. “The State of IT 2023.” Spiceworks. Ziff Davis, 2022. Accessed 28 Feb. 2023.
      Ainsworth, Paul. “Responsibilities of the Modern CFO - A Function in Transition.” TopTal, LLC., no date. Accessed 15 Feb. 2023.
      Balasaygun, Kaitlin. “For the first time in a long time, CFOs can say no to tech spending.” CNBC CFO Council, 19 Jan. 2023. Accessed 17 Feb. 2023.
      Bashir, Ahmad. “Objectives of Capital Budgeting and factors affecting Capital Budget Decisions.” LinkedIn, 27 May 2017. Accessed 14 Apr. 2023.
      Blackmon, Kris. “Building a Data-Driven Budget Pitch the C-Suite Can't Refuse.” NetSuite Brainyard, 21 Sep. 2021. Accessed 17 Feb. 2023
      Butcher, Daniel. “CFO to CFO: Budgeting to Fund Strategic Plans.” Strategic Finance Magazine/Institute of Management Accountants, 1 Dec. 2021. Accessed 17 Feb. 2023
      Gray, Patrick. “IT Budgeting: A Cheat Sheet.” TechRepublic, 29 Jul. 2020. Accessed 28 Feb. 2023.
      Greenbaum, David. “Budget vs. Actuals: Budget Variance Analysis & Guide.” OnPlan, 15 Mar. 2022. Accessed 22 Mar. 2023.
      Huber, Michael and Joan Rundle. “How to Budget for IT Like a CFO.” Huber & Associates, no date. Accessed 15 Feb. 2023.
      Kinney, Tara. “Executing Your Department Budget Like a CFO.” Atomic Revenue, LLC., no date. Accessed 15 Feb. 2023.
      Lafley, A.G. “What Only the CFO Can Do.” Harvard Business Review, May 2009. Accessed 15 Mar. 2009.
      Moore, Peter D. “IN THE DIGITAL WORLD, IT should be run as a profit center, not a cost center.” Wild Oak Enterprise, 26 Feb. 2020. Accessed 3 Mar. 2023.
      Nordmeyer, Bille. “What Factors Are Going to Influence Your Budgeting Decisions?” bizfluent, 8 May 2019. Accessed 14 Apr. 2023
      Ryan, Vincent. “IT Spending and 2023 Budgets Under Close Scrutiny.” CFO, 5 Dec. 2022. Accessed 3 Mar. 2023.
      Stackpole, Beth. “State of the CIO, 2022: Focus turns to IT fundamentals.” CIO Magazine, 21 Mar. 2022. Accessed 3 Mar. 2023.

      Analyze Your Service Desk Ticket Data

      • Buy Link or Shortcode: {j2store}483|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $6,499 Average $ Saved
      • member rating average days saved: 3 Average Days Saved
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk
      • Leverage your service desk ticket data to gain insights for your service desk strategy.

      Our Advice

      Critical Insight

      • Properly analyzing ticket data is challenging for the following reasons:
        • Poor ticket hygiene and unclear ticket handling means the data is often inaccurate or incomplete.
        • Service desk personnel are not sure where to start with analysis.
        • Too many metrics are tracked to parse actionable data from the noise.
      • Ticket data won’t give you a silver bullet, but it can help point you in the right direction.

      Impact and Result

      • Create an iterative framework for tracking metrics, keeping data clean, and actioning your data on day-to-day and month-to-month timelines.

      Analyze Your Service Desk Ticket Data Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should analyze your service desk ticket data, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Import your ticket data

      Enter your data into our tool. Compare your own ITSM ticket fields to improve ticket data moving forward.

      • Service Desk Ticket Analysis Tool

      2. Analyze your ticket data

      Use the ticket analysis tool as a guide to build your own operational dashboards to measure metrics over time. Gain actionable insights from your data.

      • Ticket Analysis Report

      3. Action your ticket data

      Use the data to communicate your findings to the business and leadership using the Ticket Analysis Report.

      [infographic]

      Further reading

      INFO-TECH RESEARCH GROUP

      Analyze Your Service Desk Ticket Data

      Take a data-driven approach to service desk optimization.

      EXECUTIVE BRIEF

      Analyst Perspective

      Photo of Benedict Chang, Research Analyst, Infrastructure & Operations, Info-Tech Research Group

      Benedict Chang
      Research Analyst, Infrastructure & Operations
      Info-Tech Research Group

      Photo of Ken Weston ITIL MP, PMP, Cert.APM, SMC, Research Director, Infrastructure & Operations, Info-Tech Research Group

      Ken Weston ITIL MP, PMP, Cert.APM, SMC
      Research Director, Infrastructure & Operations
      Info-Tech Research Group

      The perfect time to start analyzing your ticket data is now

      Service desks improve their services by leveraging ticket data to inform their actions. However, many organizations don’t know where to start. It’s tempting to wait for perfect data, but there’s a lot of value in analyzing your ticket data as it exists today.

      Start small. Track key tension metrics based on the out-of-the-box functionality in your tool. Review the metrics regularly to stay on track.

      By reviewing your ticket data, you’re going to get better organically. You’re going to learn about the state of your environment, the health of your processes, and the quality of your services. Regularly analyze your data to drive improvements.

      Make ticket analysis a weekly habit. Every week, you should be evaluating how the past week went. Every month, you should be looking for patterns and trends.

      Executive Summary

      Your Situation

      Leverage your service desk ticket data to gain insights for improving your operations:

      1. Use a data-based approach to allocate service desk resources.
      2. Design appropriate SLOs and SLAs to better service end users.
      3. Gain efficiencies for your shift-left strategy.
      4. Communicate the current and future value of the service desk to the business.

      Common Obstacles

      Properly analyzing ticket data is challenging for the following reasons:

      • Poor ticket hygiene and unclear ticket handling guidelines can lead to untrustworthy results.
      • Undocumented tickets from various intake channels prevents you from seeing the whole picture.
      • Service desk personnel are not sure where to start with analysis and are too busy to find time.
      • Too many metrics are tracked to parse actionable insights from the noise.

      Info-Tech’s Approach

      Info-Tech’s approach to improvement:

      • To reduce the noise, standardize your ticket data in a format that will ease analysis.
      • Start with common analyses using the cleaned data set.
      • Identify action items based on your ticket data.

      Analyze your ticket data to help continually improve your service desk.

      Slow down. Give yourself time.

      Give yourself time to observe the new metrics and draw enough insights to make recommendations for improvement. Then, execute on those recommendations. Slow and steady improvement of the service desk only adds business value and will have a positive impact on customer satisfaction.

      Your challenge

      This research is designed to help service desk managers analyze their ticket data

      Analyzing ticket data involves:

      • Collecting ticket data and keeping it clean. Based on the metrics you’re analyzing, define ticket expectations and keep the data up to date.
      • Showing the value of the service desk. SLAs are meaningless if they are not met consistently. The prerequisite to implementing proper SLAs is fully understanding the workload of the service desk.
      • Understanding – and improving – the user experience. You cannot improve the user experience without meaningful metrics that allow you to understand the user experience. Different user groups will have different needs and different expectations of the level of service. Your metrics should reflect those needs and expectations.

      36% of organizations are prioritizing ticket handling in IT for 2021 (Source: SDI, 2021)

      12% of organizations are focusing directly on service desk improvement (Source: SDI, 2021)

      Common obstacles

      Many organizations face these barriers to analyzing their ticket data:

      • Finding time to properly analyze ticket data is a challenge. Not knowing where to start can lead to not analyzing the proper data. Service desks end up either tracking too much data or not tracking the proper metrics.
      • Data, even if clean, can be housed in various tools and databases. It’s difficult to aggregate data if the data is stored throughout various tools. Comparisons may also be difficult if the data sets aren’t consistent.
      • Shifting left to move tickets toward self-service is difficult when there is no visibility into which tickets should be shifted left.

      What your peers are saying about why they can’t start analyzing their ticket data:

      • “My technicians do not consistently update and close tickets.”
      • “My ITSM doesn’t have the capabilities I need to make informed decisions on shifting tickets left.”
      • “My tickets are always missing data”
      • “I’m constantly firefighting. I have no time for ticket data analysis.”
      • “I have no idea where to start with the amount of data I have.”
      (Source: Info-Tech survey, 2021; N=20.)

      Common obstacles that prevent effective ticket analysis

      We asked IT service desk managers and teams about their biggest hurdles

      Missing or Inaccurate Information
      • Lack of information in the ticket
      • Categories are too general/specific to draw insights
      • Poor ticket hygiene
      Missing Updates
      • Tickets aren’t updated while being resolved
      Correlating Tickets to Identify Trends
      • Not sure where to start with all the data at hand
      No Time
      • No time to figure out the tool or analyze the data properly
      Ineffective Categorization Schemes
      • Reduces the power of ticket data
      Tool Limitations
      • Can’t be easily customized
      • Too customized to be effective
      • Desired dashboards unavailable
      (Source: Info-Tech survey, 2021; N=20)

      Info-Tech’s approach

      Repeat this analysis every business cycle:

      • Gather Your Data
        Collect your ticket data OR start measuring the right metrics.
      • Extract & Analyze
        Organize and visualize your data to extract insights
      • Action the Results
        Implement low-effort improvements and celebrate quick successes.
      • Implement Larger Changes
        Reference your ticket data while implementing process, tooling, and other changes.
      • Communicate the Results
        Use your data to show the value of your effort.

      Measure the value of this blueprint

      Track these metrics as you improve

      Use the data to tell you which aspects of IT need to be shifted left and which need to be automated

      Your data will show you where you can improve.

      As you act on your data, you should see:

      • Lower costs per ticket
      • Decreased average time to resolve
      • Increased end-user satisfaction
      • Fewer tickets escalated beyond Tier 1

      An illustration of the 'Shift Left Strategy' using three line graphs arranged in a table with the same axes but representing different metrics. The header row is 'Metrics,' then values of the x-axes are 'Auto-Fix,' 'User,' 'Tier 1,' 'Tier2/Tier3,' and 'Vendor.' Under 'Metrics' we see 'Cost,' 'Time,' and 'Satisfaction.' The 'Cost' graph begins 'Low' at 'Auto-Fix' and gradually moves to 'High' at 'Vendor.' The 'Time' graph begins 'Low' at 'Auto-Fix' and gradually moves to 'High' at 'Vendor.' The 'Satisfaction' graph begins 'High' at 'Auto-Fix' and gradually moves to 'Low' at 'Vendor.' Below is an arrow directing us away from the 'Vendor' option and toward the 'Auto-Fix' option, 'Shift Ticket Resolution Left.'

      See Info-Tech’s blueprint Optimize the Service Desk With a Shift-Left Strategy.

      Info-Tech’s methodology for analyzing service desk tickets

      1. Import Your Ticket Data 2. Analyze Your Ticket Data 3. Communicate Your Insights
      Phase Steps
      1. Import Your Ticket Data
      1. Analyze High-Level Ticket Data
      2. Analyze Incidents, Service Requests, and Ticket Categories
      1. Build Recommendations
      2. Action and Communicate Your Ticket Data
      Phase Outcomes Enter your data into our tool. Compare your own ITSM ticket fields to improve ticket data moving forward. Use the Service Desk Ticket Analysis Tool as a guide to build your own operational dashboards to measure metrics over time. Gain actionable insights from your data. Use the data to communicate your findings to the business and leadership using the Ticket Analysis Report.

      Insight summary

      Slow down. Give yourself time.

      Give yourself time to observe the new metrics and draw enough insights to make recommendations for improvement. Then, execute on those recommendations. Slow and steady improvement of the service desk only adds business value and will have a positive impact on customer satisfaction.

      Iterate on what to track rather than trying to get it right the first time.

      Tracking the right data in your ticket can be challenging if you don’t know what you’re looking for. Start with standardized fields and iterate on your data analysis to figure out your gaps and needs.

      If you don’t know where to go, ticket data can point you in the right direction.

      If you have service desk challenges, you will need to allocate time to process improvement. However, prioritizing your initiatives is easier if you have the ticket data to point you in the right direction.

      Start with data from one business cycle.

      Service desks don’t need three years’ worth of data. Focus on gathering data for one business cycle (e.g. three months). That will give you enough information to start generating value.

      Let the data do the talking.

      Leverage the data to drive organizational and process change in your organization by tracking meaningful metrics. Choose those metrics using business-aligned goals.

      Paint the whole picture.

      Single metrics in isolation, even if measured over time, may not tell the whole story. Make sure you design tension metrics where necessary to get a holistic view of your service desk.

      Blueprint deliverables

      This blueprint’s key deliverable is a ticket analysis tool. Many of the activities throughout this blueprint will direct you to complete and interpret this tool. The other main deliverable is a stakeholder presentation template to help you document the outcomes of the project.
      Service Desk Ticket Analysis Tool Ticket Analysis Report
      Use this tool to identify trends and patterns in your ticket data to action improvement initiatives.

      Sample of the Service Desk Ticket Analysis Tool blueprint deliverable.

      Use this template to document the justification for addressing service desk improvement, the results of your analysis, and your next steps.

      Sample of the Ticket Analysis Report blueprint deliverable.

      Blueprint benefits

      IT Benefits

      • Discover and implement the proper metrics to improve your service desk
      • Use a data-based approach to improve your customer service and operational goals
      • Increase visibility with the business and other IT departments using a structured presentation

      Business Benefits

      • Quicker resolutions to incidents and service requests
      • Better expectations for the service desk and IT
      • Better visibility into the current state, challenges, and goals of the service desk
      • More effective support when contacting the service desk

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 3-4 calls over the course of 2-3 months.

      What does a typical GI on this topic look like?

        Phase 1

      • Call #1: Scope requirements, objectives, and your specific challenges. Enter your data into the tool.
      • Phase 2

      • Call #2: Assess the current state across the different dashboards.
      • Phase 3

      • Call #3: Identify improvements and insights to include in the communication report.
      • Call #4: Review the service desk ticket analysis report.

      PHASE 1

      Import Your Ticket Data

      This phase will walk you through the following activities:

      • 1.1.1 Define your objectives for analyzing ticket data
      • 1.1.2 Identify success metrics
      • 1.1.3 Import your ticket data into the tool
      • 1.1.4 Update your ticket fields for future analysis

      This phase involves the following participants:

      • Service Desk Manager
      • ITSM Manager
      • Service Desk Technician

      1.1.1 Define your objectives for analyzing ticket data

      Input: Understanding of current service desk process and ticket routing

      Output: Defined objectives for the project

      Materials: Whiteboard/flip charts, Ticket Analysis Report

      Participants: Service Desk Staff, Service Desk Manager, IT Director, CIO

      Use the discussion questions below as a guide
      1. Identify your main objective for analyzing ticket data. Use these three sample objectives as a starting point:
        • Demonstrate value to the business by improving customer service.
        • Improve service desk operations.
        • Reduce the number of recurring incidents.
      2. Answer the following questions as a group:
        • What challenges do you have getting accurate data for this objective?
        • What data is missing for supporting this objective?
        • What kind of issues must be solved for us to make progress on achieving this objective?
        • What decisions are held up from a lack of data?
        • How can better ticket data help us to more effectively manage our services and operations?

      Document in the Ticket Analysis Report.

      1.1.2 Identify success metrics

      Select metrics that will track your progress on meeting the objective identified in Activity 1.1.1.

      Input: Understanding of current service desk process and ticket routing

      Output: Defined objectives for the project

      Materials: Whiteboard/flip charts, Ticket Analysis Report

      Participants: Service Desk Manager, IT Director, CIO

      Use these sample metrics as a starting point:
      Demonstrate value to the business by improving customer service
      Ticket trends by category by month # tickets by business department % SLAs met by IT teams
      Average customer satisfaction rating % incident tickets closed in one day Service request SLAs met by % Annual IT satisfaction survey result
      Improve service desk operations
      Incident tickets assigned, sorted by age and priority Scheduled requests for today and tomorrow Knowledgebase articles due for renewal this month Top 5-10 tickets for the quarter
      Unassigned tickets by age # incident tickets assigned by tech Open tickets by category Backlog summary by age
      Reducing the number of recurring incidents
      # incidents by category and resolution code Number of problem tickets opened and resolved Correlation of ticket volume trends to events Reduction of volume of recurring tickets
      Use of knowledgebase by users Use of self-service for ticket creation Use of service catalog Use of automated features (e.g. password resets)
      Average call hold time % calls abandoned Average resolution time Number of tickets reopened

      Document in the Ticket Analysis Report.

      Inefficient ticket-handling processes lead to SLA breaches and unplanned downtime

      Analyze the ticket data to catch mismanaged or lost tickets that lead to unnecessary escalations and impact business profitability

      • Ticket Category – Are your tickets categorized by type of asset? By service?
      • Average Ticket Times – How long does it take to resolve or fulfill tickets?
      • Ticket Priority – What is the impact and urgency of the ticket?
      • SLA/OLA Violations – Did we meet our SLA objectives? If not, why?
      • Ticket Channel – How was the issue reported or ticket received?
      • Response and Fulfillment – Did we complete first contact resolution? How many times was it transferred?
      • Associated Tasks and Tickets – Is this incident associated with any other tasks like change tickets or problem tickets?

      Encourage proper ticket-handling procedures to enable data quality

      Ensure everyone understands the expectations and the value created from having ticket data that follows these expectations

      • Create and update tickets, but not at the expense of good customer service. Agents can start the ticket but shouldn’t spend five minutes creating the ticket when they should be troubleshooting the problem.
      • Update the ticket when the issue is resolved or needs to be escalated. If agents are escalating, they should make sure all relevant information is passed along within the ticket to the next technician.
      • Update user of ETA if issue cannot be resolved quickly.
      • Ticket templates for common incidents can lead to fast creation, data input, and categorizations. Templates can reduce the time it takes to create tickets from two minutes to 30 seconds.
      • Update categories to reflect the actual issue and resolution.
      • Reference or link to the knowledgebase article as the documented steps taken to resolve the incident.
      • Validate with the client that the incident is resolved; automate this process with ticket closure after a certain time.
      • Close or resolve the ticket on time.

      Info-Tech Insight

      Ticket handling ensures clean handovers, whether it is to higher tiers or back to the customer. When filling the ticket out with information intended for another party, ensure the information is written for their benefit and from their point of view.

      Service Desk Ticket Analysis Tool overview

      The Service Desk Ticket Analysis Tool will help you standardize your ticket data in a meaningful format that will allow you to apply common analyses to identify the actions you need to take to improve service desk operations

      TABS 1 & 2
      INSTRUCTIONS & DATA ENTRY
      TAB 3 : TICKET SUMMARY
      TICKET SUMMARY DASHBOARDS
      TABS 4 to 8: DASHBOARDS
      INCIDENT SERVICE REQUEST CATEGORY
      Sample of the Service Desk Ticket Analysis Tool, tabs 1 & 2.
      Input at least three months of your exported ticket data into the corresponding columns in the tool to feed into the common analysis graphs in the other tabs.
      Sample of the Service Desk Ticket Analysis Tool, tab 3.
      This tab contains multiple dashboards analyzing how tickets come in, who requests them, who resolves them, and how long it takes to resolve them.
      Sample of the Service Desk Ticket Analysis Tool, tabs 4 to 8.
      These tabs each have dashboards outlining analysis on incidents and service requests. The category tab will allow you to dive deeper on commonly reported issues.

      1.1.3 Import your data into our Service Desk Ticket Analysis Tool

      You can still leverage your current data, but use this opportunity to improve your service desk ticket fields down the line

      Input: ITSM data log

      Output: Populated Service Desk Ticket Data Analysis Tool

      Materials: Whiteboard/flip charts, Service Desk Ticket Analysis Tool

      Participants: Service Desk Manager, Service Desk Technicians

      Start here:

      • Extract your ticket data from your ITSM tool in an Excel or text format.
      • Look at the fields on the data entry tab of the Service Desk Ticket Analysis Tool.
      • Fill the fields with your ticket data by copying and pasting relevant sections. It is okay if you don’t have all the fields, but take note of the fields you are missing.
      • With the list of the fields you are missing, run through the following activity to decide if you will need to adopt or add fields to your own service desk ticket tool.
      Fields Captured
      Ticket Number Open Date
      Open Time Closed Date
      Closed Time Intake Channel
      Time to Resolve Site Location
      First Contact Resolution Resolution Code
      Category (I, II, III) Ticket Type (Request or Incident)
      Status of Ticket Resolved by Tier
      Ticket Priority Requestor/Department
      SLA Fulfilled Subject
      Technician

      When entering your data, pay close attention to the following fields:

      • Time to Resolve: This is automatically calculated using data in the Open Date, Open Time, Close Date, and Close Time fields. You have three options for entering your data in these fields:
        1. Enter your data as the fields describe. Ensure your data contain only the field description (e.g. Open Date separated from Open Time). If your data contain Open Date AND Open Time, Excel will not show both.
        2. Enter your data only in Open Date and Close Date. If your ITSM does not separate date and time, you can keep the data in a single cell and enter it in the column. The formula in Time to Resolve will still be accurate.
        3. If your ITSM outputs Time to Resolve, overwrite the formula in the Time to Resolve column.
      • SLA: If your ITSM outputs SLA fulfilled: Y/N, enter that directly into the SLA Fulfilled column.
      • Blank Columns: If you do not have data for all the columns, that is okay. Continue with the following activity. Note that some stock dashboards will be empty if that is the case.
      • Incidents vs. Service Requests: If you separate incidents and service requests, be sure to capture that in the SR/Incident for Tabs 4 and 5. If you do not separate the two, then you will only need to analyze Tab 3.
      Fields Captured
      Ticket Number Open Date
      Open Time Closed Date
      Closed Time Intake Channel
      Time to Resolve Site Location
      First Contact Resolution Resolution Code
      Category (I, II, III) Ticket Type (Request or Incident)
      Status of Ticket Resolved by Tier
      Ticket Priority Requestor/Department
      SLA Fulfilled Subject
      Technician

      Use Info-Tech’s tool instead of building your own. Download the Service Desk Ticket Analysis Tool.

      1.1.4 Update your ticket fields for future analysis

      Input: Populated Service Desk Ticket Data Analysis Tool

      Output: New ticket fields to track

      Materials: Whiteboard/flip charts, Service Desk Ticket Analysis Tool

      Participants: Service Desk Manager, Service Desk Technicians

      As a group, pay attention to the ticket fields populated in the tool as well as the ticket fields that you were not able to populate. Use the example “Fields Captured” table to the right, which lists all fields present in the ticket analysis tool.

      Discuss the following questions:

      1. Consider the fields not captured. Would it be valuable to start capturing that data for future analysis?
      2. If so, does your ITSM support that field?
      3. Can you make the change in-house or do you have to bring in an external ITSM administrator to make the change?
      4. Capture the results in the Ticket Analysis Report.
      Example: Fields Captured - Fields Not Captured
      Ticket Number Open Date
      Open Time Closed Date
      Closed Time Intake Channel
      Time to Resolve Site Location
      First Contact Resolution Resolution Code
      Category (I, II, III) Ticket Type (Request or Incident)
      Status of Ticket Resolved by Tier
      Ticket Priority Requestor/Department
      SLA Fulfilled Subject
      Technician

      Document in the Ticket Analysis Report.

      Info-Tech Insight

      Don’t wait for your ticket quality to be perfect. You can still draw actions from your ticket data. They will likely be process improvements initially, but the exercise of pulling the data is a necessary first step.

      Common ticket fields tracked by your peers

      Which of these metrics do you track and action?

      • Remember you don’t have to track every metric. Only track metrics that are actionable.

      For each metric that you end up tracking:

      • Look for trends over time.
      • Brainstorm reasons why the metric could rise or fall.

      Associate a metric with each improvement you execute.

      • Performing this step will allow you to better see the value from your team’s efforts.
      • It will also give you a quicker response than waiting for spikes in your data.

      A bar chart of 'Metrics tracked by other organizations' with the x-axis populated by different metrics and the y-axis as '% organizations who track the metric'. The highest percentage of businesses track 'Ticket volume', then 'Ticket trends by category', then 'Tickets by business units'. The lowest three shown are 'Reopened tickets', 'Cost per ticket', and 'Other'.(Source: Info-Tech survey, 2021; N=20)

      PHASE 2

      Analyze Your Ticket Data

      This phase will walk you through the following activities:

      • 2.1.1 Review high-level ticket dashboards
      • 2.2.1 Review incident, service request, and ticket category dashboards

      This phase involves the following participants:

      • Service Desk Manager
      • Service Desk Technicians
      • IT Managers

      Visualize your ticket data as a first step to analysis

      Identifying trends is easier when looking at diagrams, graphs, and figures

      Start your analysis with common visuals employed by other service desk professionals

      • Phase 2 will walk you through visualizing your data to get a better understanding of your ticket intake, incident management, and service request management.
      • Each step will walk you through:
        • Common visualizations used by service desks
        • Patterns to look for in your visualizations
        • Actions to take to address negative patterns and to continue positive trends
      • Share diagrams that underscore both the value being provided by the service desk as well as the scope of the pain points. Use Info-Tech’s Ticket Analysis Report template as a starting point.

      “Being able to tell stories with data is a skill that’s becoming ever more important in our world of increasing data and desire for data-driven decision making. An effective data visualization can mean the difference between success and failure when it comes to communicating the findings of your study, raising money for your nonprofit, presenting to your board, or simply getting your point across to your audience.” - Cole Knaflic, Founder and CEO, Storytelling with Data: A Data Visualization Guide for Business Professionals

      Use the detailed dashboards to determine the next steps for improvement

      A single number doesn’t tell the whole picture

      Analyze trends over time:

      • Analyze trends by day, by week, by month, and by year to determine:
        • When are the busy periods? (E.g. Do tickets tend to spike every morning, every Monday, or every September?)
        • When are the slow periods? (E.g. Do tickets drop at the end of the day, at midday, on Fridays, or over the summer?)
      • Are spikes or drops in volume consistent trends or one-time anomalies?

      Then build a plan to address them:

      • How will you handle volume spikes, if they’re consistent?
      • What can your resources work on during slow times, if they are consistent?
      • If you assume no shrinkage, can you handle the peaks in volume if you make all FTEs available to work on tickets at a certain time of day?

      Sample of a bar chart comparing tickets that were 'Backlog versus Closed by Month Opened'.

      Look for seasonal trends. In this example, we see high ticket volumes in May and January, with lower ticket volumes in June and July when many staff are taking holidays. However, also be careful to look at the big picture of how you pulled the data. August through October sees a high volume of open tickets because the data set is pulled in November, not because there’s a seasonal spike on tickets not closing at the end of the fiscal year.

      Track ticket data over time

      Make low-effort adjustments before major changes

      Don’t rush to a decision based off the first numbers you see

      Review ticket summary dashboard

      Ideally, you should track ticket patterns over an entire year to get a full sense of trends within each month of the year. At minimum, track for 30 days, then 60, then 90, and see if anything changes. The longer you can track ticket patterns, the more accurate your picture will be.

      Review additional dashboards

      If you separate incidents and service requests, and you have accurate ticket categories, then you can use these dashboards to further break down the data to identify ticket trends.

      The output of the ticket analysis will only be as accurate as its input.
      To get the most accurate results, first ensure your data is accurate, then analyze it over as much time as possible. Aggregating with accurate data will give you a better picture of the trends in demand that your service desk sees.

      Not separating incidents and service requests? Need to fix your ticket categories? Visit Standardize the Service Desk to get started.

      Analyze incidents and requests separately

      Each type has its own set of customer experiences and expectations

      • Different ticket types are associated with radically different prioritization, routing, and service levels. For instance, most incidents are resolved within a business day, but requests take longer to implement.
      • If you fail to distinguish between ticket types, your metrics will obscure service desk performance.
      • From a ticket analysis standpoint, separating ticket types prior to analysis or, better yet, at intake allows for cleaner data. In turn, this means more structured analyses, better insights, and more meaningful actions. Not separating ticket types may still get you to the same conclusions, but it will be much more difficult to sift through the data.

      Incident

      An unanticipated interruption of a service.
      The goal of incident management is to restore the service as soon as possible, even if the resolution involves a workaround.

      Request

      A generic description for a small change or service access.
      Requests are small, frequent, and low risk. They are best handled by a process distinct from incident, change, and project management.

      Not separating incidents and service requests? Need to fix your ticket categories? Visit Standardize the Service Desk to get started.

      Step 2.1

      Analyze Your High-Level Ticket Data

      Dashboards
      • Ticket Volume
      • Ticket Intake
      • Ticket Handling and Resolution
      • Ticket Categorization

      This step will walk you through the following activities:

      Visualize the current state of your service desk.

      This step involves the following participants:

      • Service Desk Manager
      • Service Desk Technicians
      • IT Managers

      Outcomes of this step

      Build your metrics baseline to compare with future metric results.

      Dashboards: Ticket Volume

      Example of a dashboard for ticket volume with two bar charts, one breaking down volume by month, and the other marking certain days or weeks in each month.

      Analyze your data for insights

      • Analyze volume trends by day, by week, by month, and by year to determine:
        • When are the busy periods? (E.g. Do tickets tend to spike every morning, every Monday, or every September?)
        • When are slow periods? (E.g. Do tickets drop at the end of the day, at midday, on Fridays, or over the summer?)
      • Are spikes or drops in volume consistent trends or one-time anomalies?
      • What can your resources be working on during slow times? Are you able to address ticket backlog?

      Dashboards: Ticket Intake

      Example of a dashboard for ticket intake with three bar charts, one breaking it down by 'Intake Channel', one by 'Requestor/Department', and one by 'Location'.

      Analyze your data for insights

      • Determine how to drive intake to the most appropriate solution for your organization:
        • A web portal is the most efficient intake method, but it must be user friendly to increase its adoption.
        • The phone should be available for urgent requests or incidents. Encourage those who call with a request to submit a ticket through the portal.
        • Discourage use of email if it is unstructured, as users don’t provide enough detail, and often two or three transactions are required for triage.
        • If walk-ups are encouraged, structure and formalize the support so it can be resourced and managed rather than interrupt-driven.

      Dashboard: Ticket Handling and Resolution

      Example of a dashboard for ticket handling and resolution with three bar charts, one breaking down 'Tickets Resolved by Technician', one by 'Tier', and one by 'Average Time to Resolve (Hours)'.

      Analyze your data for insights

      • Look at your ticket load by technician and by tier. This is an essential step to set your baseline to measure your shift-left initiatives. If you are focusing on self-service or Tier 1 training, the ticket load from higher tiers should decrease over time.
      • If Tiers 2 and 3 are handling the majority of the tickets, this could be a red flag indicating tickets are inappropriately escalated or Tier 1 could use more training and support.
      • For average time to resolve and average time to resolve by tier, are you meeting your SLAs? If not, are your SLAs too aggressive? Are tickets left open and not properly closed?

      Dashboard: Ticket Categorization

      Analyze your data for insights

      • Ticket categorization is critical to clean data. Having a categorization scheme with categories that are miscellaneous, too specific, or too general easily leads to inaccurate reporting or confusing workflows for technicians.
      • When looking at your ticket categories, first look for duplicate categories that could be collapsed into one.
      • Also look at your top five to seven categories and see if they make sense. Are these good candidates in your organization for automation or shift-left?
      • Compare your Tier 1 categories. The level of specificity for these categories should be comparable to easily run reports. If they are not, assess the need for a category redesign.

      Example of a dashboard for ticket categorization with one horizontal bar chart, 'Incident Ticket Volume by Level 1 Category'.

      Step 2.2

      Analyze Incidents, Service Requests, and Ticket Categories

      Dashboards
      • Incidents
      • Service Requests
      • Volume by Ticket Category
      • Resolution Times by Priority and/or Category
      • Tabs for More Granular Investigation and Reporting

      This step will walk you through the following activities:

      Visualize your incident and service request ticket load and analyze trends. Use this information and cross reference data sets to gain a holistic view of how the service desk interacts with IT and the business.

      This step involves the following participants:

      • Service Desk Manager
      • Service Desk Technicians
      • IT Managers

      Outcomes of this step

      Gain actionable, data-driven improvements based on your incident and service request data. Show the value of the service desk and highlight improvements needed.

      Incident and Service Requests Dashboard: Priority and SLA

      Example of an Incident and Service Requests dashboard for priority and SLA with three charts, one breaking down 'Incident Priority', one 'Average time to resolve (in hours) by priority', and one '% of SLA met'.

      Analyze your data for insights

      • Your ticket priority distribution for overall load and time to resolve (TTR) should look something like above with low-priority tickets having higher load and TTR and high/critical-priority tickets having a lower load and lower TTR. If it is reversed, that is a good indication that the service desk is too reactive or isn’t properly prioritizing its work.
      • If your SLA has a high failure rate, consider reassessing your targets with SLOs that you can meet before publishing them as achievable SLAs.

      Incident and Service Requests Dashboard: Priority and SLA

      Example of an Incident and Service Requests dashboard for resolution and close with three bar charts, one breaking down 'Incident Volume by Resolution Code', one 'Incidents Resolved by Tier', and one 'Average time to resolve (in hours) by Resolution Code'.

      Analyze your data for insights

      • Examine your ticket handling by looking at ticket status and resolution codes.
        • If you have a lot of blanks, then tickets are not properly handled. Consider reinforcing your standards for close codes and statuses.
        • Alternatively, if tickets are left open, you may have to build follow-ups on stale tickets into your process or introduce proper auto-close processes.

      Category, Resolution Time, and Resolution Code Dashboards

      These PivotCharts allow you to dig deeper

      Investigate whether there are trends in ticket volume and resolution times within specific categories and subcategories

      Tab 6, Category Dashboard; tab 7, Resolution Time Dashboard; and tab 8, Resolution Code Dashboard are PivotCharts. Use these tabs to investigate whether there are trends in ticket volume, resolution times, and resolution codes within specific categories and subcategories.

      Start with the charts that are available. The +/- buttons will allow you to show more granular information. By default, this granularity will be into the levels of the ticket categorization scheme.

      For most categorization schemes, there will be too many categories to properly graph. You can apply a filter to investigate specific categories by clicking on the drop-down buttons.

      Example of dashboards featured on next slide

      Use these tabs for more granular investigation and reporting

      TAB 6
      CATEGORY DASHBOARD
      TAB 7
      RESOLUTION TIME DASHBOARD
      TAB 8
      RESOLUTION TIME DASHBOARD
      Sample of the 'Ticket Volume by Second, Third Level Category' dashboard tab.
      Investigate ticket distributions in first, second, and third levels. Are certain categories overcrowded, suggesting they can be split? Are certain categories not being used?
      Sample of the 'Average Resolution Times' dashboard tab.
      Do average resolution times match your service level agreements? Do certain categories have significantly different resolution times? Are there areas that can benefit from shift-left?
      Sample of the 'Volume of Resolution Codes' dashboard tab.
      Are resolution codes being accurately used? Are there trends in resolution codes? Are these codes providing sufficient information for problem management?

      PHASE 3

      Communicate Your Insights

      This phase will walk you through the following activities:

      • 3.1.1 Review common recommendations
      • 3.2.1 Review ticket reports daily
      • 3.2.2 Incorporate ticket data into retrospectives and team updates
      • 3.2.3 Regularly review trends with business leaders
      • 3.2.4 Tell a story with your data

      This phase involves the following participants:

      • Service Desk Manager
      • Service Desk Technicians
      • IT Managers

      Step 3.1

      Build Recommendations Based on Your Ticket Data

      Activities
      • 3.1.1 Review common recommendations

      This step will walk you through the following activities:

      Review common recommendations as a first step to extracting insights from your own data.

      This step involves the following participants:

      • Service Desk Manager
      • Service Desk Technicians

      Outcomes of this step

      You will gain an understanding of the common challenges with service desks and ticket analysis in general. See which ones apply to you to inform your ticket data analysis moving forward.

      Review these common recommendations

      1. Fix your ticket categories
        Organize your ticket categorization scheme for proper routing and reporting.
      2. Focus more on self-service
        Self-service is essential to enable shift-left strategies. Focus on knowledgebase processes and portal ease of use.
      3. Update your service catalog
        Improve your service catalog, if necessary, to make it easy for end users to request services and for the service desk to provide those services.
      4. Direct volume toward other channels
        Walk-ups make it more difficult to properly log tickets and assign service desk resources. Drive volume to other channels to improve your ticket quality.
      5. Crosstrain Tier 1 on certain topics
        Tier 1 breadth of knowledge is essential to drive up first contact resolution.
      6. Build more automation
        Identify bottlenecks and challenges with your ticket data to streamline ticket handling and resolution.
      7. Revisit service level agreements
        Update your SLAs and/or SLOs to prioritize expectation management for your end users.
      8. Improve your data quality
        You can only analyze data that exists. Revisit your ticket-handling guidelines and more regularly check tickets to ensure they comply with those standards.

      Optimize your processes and look for opportunities for automation

      Leverage Info-Tech research to improve service desk processes

      Review your service desk processes and tools for optimization opportunities:

      • Clearly establish ticket-handling guidelines.
      • Use ticket templates to reduce time spent entering tickets.
      • Document incident management and service request fulfillment workflows and eliminate any unnecessary steps.
      • Automate manual tasks wherever possible.
      • Build or improve a self-service portal with a knowledgebase to allow users to resolve their own issues, reducing incoming ticket volume to the service desk.
      • Optimize your internal knowledgebase to reduce time spent troubleshooting recurring issues.
      • Leverage AI capabilities to speed up ticket processing and resolution.

      Standardize the Service Desk

      This project will help you build and improve essential service desk processes, including incident management, request fulfillment, and knowledge management.

      Optimize the Service Desk With a Shift-Left Strategy

      This project will help you build a strategy to shift service support left to optimize your service desk operations and increase end-user satisfaction.

      Step 3.2

      Action and Communicate Your Ticket Data

      Activities
      • 3.2.1 Review your ticket queues daily
      • 3.2.2 Incorporate ticket data into retrospectives and team status updates
      • 3.2.3 Regularly review trends with business leaders
      • 3.2.4 Tell a story with your data

      This step will walk you through the following activities:

      Organize your scrums to report on the metrics that will inform daily and monthly operations.

      This step involves the following participants:

      • Service Desk Manager
      • Service Desk Technicians
      • IT Managers

      Outcomes of this step

      Use the dashboards and data to inform your daily and monthly scrums.

      3.2.1 Review your ticket queues daily

      Clean data is still useless if not used properly

      • The metrics you’ve chosen to measure and visualize in the previous step are useful for informing your day-to-day, week-to-week, and month-to-month strategies for the service desk and IT. Conduct scrums daily to action your dashboard data to help clear ticket queues.
      • Reference your dashboards daily with each IT team.
      • You need to have a dashboard of open tickets assigned to each team.

      Review Daily

      • Ticket volume over the last day (look for spikes)
      • SLA breach risks/SLA breaches
      • Recurring incidents
      • Tickets open
      • Tickets handed over (confirmation of handover)

      3.2.2 Incorporate ticket data into retrospectives and team status updates

      Explain your metric spikes and trends

      • Hold weekly or monthly meetings to review the ticket trends selected during Phases 1 and 2 of this blueprint.
      • Review ticket spikes, identify seasonal trends, and discuss root causes (e.g. projects/changes going live, onboarding blitz).
      • Discuss any actions associated with spikes and seasonal trends (e.g. resource allocation, hiring, training).
      • You can incorporate other IT leaders or departments in this meeting as needed to discuss action items for improvement, quality assurance concerns, customer service concerns, and/or operating level agreement concerns.

      Review Weekly/Monthly

      • Ticket volume
      • Ticket category by priority level over time
      • Tickets from different business groups, VIP groups, and different vertical levels
      • Tickets escalated, tickets that didn’t need to be escalated, tickets that were incorrectly escalated
      • Ticket priority levels over time
      • Most requested services
      • Tickets resolved by which group over time
      • Ability to meet SLAs and OLAs over time by different groups

      3.2.3 Regularly review trends with business leaders

      Use your data to help improve business relationships

      Review the following with business leaders:

      • Volume of work done this past time cycle for the leader’s group
      • Trends and spikes in the data and possible explanations for them (note: get their input on the potential causes of trends)
      • Improvements you plan to execute within the service desk
      • Action items you need from the business leader

      Use your data to show the value you provide to the group. Schedule quarterly meetings with the heads of different business groups to discuss the work that the service desk does for each group.

      Show trends in incidents and service requests: “I see you have a spike in CRM tickets. I’ve been working with the CRM team to address this issue.”

      3.2.4 Tell a story with your data

      Effectively communicate with the business and leadership

      • With your visualized metrics, organize your story into a presentation for different stakeholder groups. You can use the Ticket Analysis Report as a starting point to provide data about:
        • Value provided by the service desk
        • Successes
        • Opportunities for Improvements
        • Current state of KPIs
      • Include information about the causes of data trends and actions you will take in response to the data.
      • For each of these themes, look at the metrics you’ve chosen to track and see which ones fit to tell the story. Let the data do the talking.
      • Consider supplementing the ticket data with data from other systems. For example, you can include data on transactional customer satisfaction surveys, knowledgebase utilization, and self-service utilization.

      Sample of the Ticket Analysis Report.

      Download the Ticket Analysis Report.

      Ticket Analysis Report

      Include the following information as you build your ticket analysis report:

      • Value Provided by the Service Desk
        Start with the value provided by the service desk to different areas of the business. Include information about first contact resolution, average resolution times, ticket volume (e.g. by category, priority, location, requestor).
      • Successes
        Successes is a general field that can include how process improvements have impacted the service desk or how initiatives have enhanced shift-left opportunities. Highlight any positive trends over time.
      • Opportunities for Improvement
        Let the data guide the conversation to where improvements can be made. Day-to-day ops, self-service tools, shifting work left from Tier 2, Tier 3, standardizing a non-standard service, and staffing adjustments are possibilities for this section.
      • Current State of KPIs
        Mean time to resolve, FCR, ticket volume, and end-user satisfaction are great KPIs to include as a starting point.

      Sample of the Ticket Analysis Report.

      Download the Ticket Analysis Report.

      Summary of Accomplishment

      Problem Solved

      You now have a better understanding of how to action your service desk ticket data, including improvements to your current ticket templates for incidents and service requests.

      You also have the data to craft a story to different stakeholder groups to celebrate the successes of the service desk and highlight possible improvements. Continue this exercise iteratively to continue improving the service desk.

      Remember, ticket analysis is not a single event but an ongoing initiative. As you track, analyze, and action more data, you will find more improvements.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Photo of Benedict Chang.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team. Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      Sample of dashboards we saw earlier. Sample of the 'Ticket Analysis Report'.
      Analyze your dashboards
      An analyst will walk through the ticket data and dashboards with you and your team to help interpret the data and tailor improvements
      Populate your ticket data report
      Given the action items from this solution set, an analyst will help you craft a report to celebrate the successes and highlight needed improvements in the service desk.

      Related Info-Tech Research

      Optimize the Service Desk With a Shift-Left Strategy

      The best type of service desk ticket is the one that doesn’t exist.

      Incident & Problem Management

      Don’t let persistent problems govern your department.

      Design & Build a User-Facing Service Catalog

      Improve user satisfaction with IT with a convenient menu-like catalog.

      Bibliography

      Bayes, Scarlett. “ITSM: 2021 & Beyond.” Service Desk Institute, 2021. Web.

      “Benchmarking Report v.9.” Service Desk Institute, 17 Jan. 2020. Web.

      Bennett, Micah. “The 9 Help Desk Metrics That Should Guide Your Customer Support.” Zapier, 3 Dec. 2015. Web.

      “Global State of Customer Service: The transformation of customer service from 2015 to present day.” Microsoft Dynamics 365, Microsoft, 2020. Web.

      Goodey, Ben. “How to Manually Analyze Support Tickets.” SentiSum, 26 July 2021. Web.

      Jadhav, Megha. “Four Metrics to Analyze When Using Ticketing Software.” Vision Helpdesk Blog, 21 Mar. 2016. Web.

      Knaflic, Cole Nussbaumer. Storytelling with Data: A Data Visualization Guide for Business Professionals. Wiley, 2015.

      Li, Ta Hsin, et al. “Incident Ticket Analytics for IT Application Management Services.” 2014 IEEE International Conference on Services Computing, 2014. Web.

      Olson, Sarah. “10 Help Desk Metrics for Service Desks and Internal Help Desks.” Zendesk Blog, Sept. 2021. Web.

      Paramesh, S.P., et al. “Classifying the Unstructured IT Service Desk Tickets Using Ensemble of Classifiers.” 2018 3rd International Conference on Computational Systems and Information Technology for Sustainable Solutions (CSITSS), 2018. Web.

      Volini, Erica, et al. “2021 Global Human Capital Trends: Special Report.” Deloitte Insights, 21 July 2021. Web.

      “What Kind of Analysis You Can Perform on a Ticket Management System.” Commence, 3 Dec. 2019. Web.

      INFO-TECH RESEARCH GROUP

      Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan

      • Buy Link or Shortcode: {j2store}378|cart{/j2store}
      • member rating overall impact: 7.3/10 Overall Impact
      • member rating average dollars saved: $10,756 Average $ Saved
      • member rating average days saved: 9 Average Days Saved
      • Parent Category Name: Governance, Risk & Compliance
      • Parent Category Link: /governance-risk-compliance
      • The demand for qualified cybersecurity professionals far exceeds supply. As a result, organizations are struggling to protect their data against the evolving threat landscape.
      • It is a constant challenge to know what skills will be needed in the future, and when and how to acquire them.

      Our Advice

      Critical Insight

      • Plan for the inevitable. All industries are expected to be affected by the talent gap in the coming years. Plan ahead to address your organization’s future needs.
      • Base skills acquisition decisions on the five key factors to define skill needs. Create an impact scale for the five key factors (data criticality, durability, availability, urgency, and frequency) that reflects your organizational strategy, initiatives, and pressures.
      • A skills gap will always exist to some degree. The threat landscape is constantly changing, and your workforce’s skill sets must evolve as well.

      Impact and Result

      • Organizations must align their security initiatives to talent requirements such that business objectives are achieved and the business is cyber ready.
      • Identify if there are skill gaps in your current workforce.
      • Decide how you’ll acquire needed skills based on characteristics of need for each skill.

      Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should develop a technical skills acquisition strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify skill needs for target state

      Identify what skills will be needed in your future state.

      • Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan – Phase 1: Identity Skill Needs for Target State
      • Security Initiative Skills Guide
      • Skills Gap Prioritization Tool

      2. Identify technical skill gaps

      Align role requirements with future initiative skill needs.

      • Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan – Phase 2: Identify Technical Skill Gaps
      • Current Workforce Skills Assessment
      • Technical Skills Workbook
      • Information Security Compliance Manager
      • IT Security Analyst
      • Chief Information Security Officer
      • Security Administrator
      • Security Architect

      3. Develop a sourcing plan for future work roles

      Acquire skills based on the impact of the five key factors.

      • Close the InfoSec Skills Gap: Develop a Skills Sourcing Plan for Future Work Roles – Phase 3: Develop a Sourcing Plan for Future Work Roles
      [infographic]

      Workshop: Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Skill Needs for Target State

      The Purpose

      Determine the skills needed in your workforce and align them to your organization’s security roadmap.

      Key Benefits Achieved

      Insight on what skills your organization will need in the future.

      Activities

      1.1 Understand the importance of aligning security initiatives skill needs with workforce requirements.

      1.2 Identify needed skills for future initiatives.

      1.3 Prioritize the initiative skill gaps.

      Outputs

      Security Initiative Skills Guide

      Skills Gap Prioritization Tool

      2 Define Technical Skill Requirements

      The Purpose

      Identify and create technical skill requirements for key work roles that are needed to successfully execute future initiatives.

      Key Benefits Achieved

      Increased understanding of the NICE Cybersecurity Workforce Framework.

      Standardization of technical skill requirements of current and future work roles.

      Activities

      2.1 Assign work roles to the needs of your future environment.

      2.2 Discuss the NICE Cybersecurity Workforce Framework.

      2.3 Develop technical skill requirements for current and future work roles.

      Outputs

      Skills Gap Prioritization Tool

      Technical Skills Workbook

      Current Workforce Skills Assessment

      3 Acquire Technical Skills

      The Purpose

      Assess your current workforce against their role’s skill requirements.

      Discuss five key factors that aid acquiring skills.

      Key Benefits Achieved

      A method to acquire skills in future roles.

      Activities

      3.1 Continue developing technical skill requirements for current and future work roles.

      3.2 Conduct Current Workforce Skills Assessment.

      3.3 Discuss methods of acquiring skills.

      3.4 Develop a plan to acquire skills.

      Outputs

      Technical Skills Workbook

      Current Workforce Skills Assessment

      Current Workforce Skills Assessment

      Technical Skills Workbook

      Current Workforce Skills Assessment

      Technical Skills Workbook

      Current Workforce Skills Assessment

      4 Plan to Execute Action Plan

      The Purpose

      Assist with communicating the state of the skill gap in your organization.

      Key Benefits Achieved

      Strategy on how to acquire skills needs of the organization.

      Activities

      4.1 Review skills acquisition plan.

      4.2 Discuss training and certification opportunities for staff.

      4.3 Discuss next steps for closing the skills gap.

      4.4 Debrief.

      Outputs

      Technical Skills Workbook

      Stakeholder Relations

      • Buy Link or Shortcode: {j2store}25|cart{/j2store}
      • Related Products: {j2store}25|crosssells{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Strategy and Governance
      • Parent Category Link: /strategy-and-governance

      The challenge

      • Stakeholders come in a wide variety, often with competing and conflicting demands.
      • Some stakeholders are hard to identify. Those hidden agendas may derail your efforts.
      • Understanding your stakeholders' relative importance allows you to prioritize your IT agenda according to the business needs.

      Our advice

      Insight

      • Stakeholder management is an essential factor in how successful you will be.
      • Stakeholder management is a continuous process. The landscape constantly shifts.
      • You must also update your stakeholder management plan and approach on an ongoing basis.

      Impact and results 

      • Use your stakeholder management process to identify, prioritize, and manage key stakeholders effectively.
      • Continue to build on strengthening your relationships with stakeholders. It will help to gain easier buy-in and support for your future initiatives. 

      The roadmap

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Make the case

      Identify stakeholders

      • Stakeholder Management Analysis Tool (xls)

      Analyze your stakeholders

      Assess the stakeholder's influence, interest, standing, and support to determine priority for future actions 

      Manage your stakeholders

      Develop your stakeholder management and communication plans

      • Stakeholder Management Plan Template (doc)
      • Communication Plan Template (doc)

      Monitor your stakeholder management plan performance

      Measure and monitor the success of your stakeholder management process.

       

       

      Develop a Targeted Flexible Work Program for IT

      • Buy Link or Shortcode: {j2store}542|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: $18,909 Average $ Saved
      • member rating average days saved: 13 Average Days Saved
      • Parent Category Name: Attract & Select
      • Parent Category Link: /attract-and-select
      • Workplace flexibility continues to be top priority for IT employees. Organizations who fail to offer flexibility will have a difficult time attracting, recruiting, and retaining talent.
      • When the benefits of remote work are not available to everyone, this raises fairness and equity concerns.

      Our Advice

      Critical Insight

      IT excels at hybrid location work and is more effective as a business function when location flexibility is an option for its employees. But hybrid work is just a start. A comprehensive flex work program extends beyond flexible location, so organizations must understand the needs of unique employee groups to uncover the options that will attract and retain talent.

      Impact and Result

      • Uncover the needs of unique employee segments to shortlist flexible work options that employees want and will use.
      • Assess the feasibility of various flexible work options and select ones that meet employee needs and are feasible for the organization.
      • Equip leaders with the information and tools needed to implement and sustain a flexible work program.

      Develop a Targeted Flexible Work Program for IT Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Assess employee and organizational flexibility needs

      Identify prioritized employee segments, flexibility challenges, and the desired state to inform program goals.

      • Develop a Targeted Flexible Work Program for IT – Phases 1-3
      • Talent Metrics Library
      • Targeted Flexible Work Program Workbook
      • Fast-Track Hybrid Work Program Workbook

      2. Identify potential flex options and assess feasibility

      Review, shortlist, and assess the feasibility of common types of flexible work. Identify implementation issues and cultural barriers.

      • Flexible Work Focus Group Guide
      • Flexible Work Options Catalog

      3. Implement selected option(s)

      Equip managers and employees to adopt flexible work options while addressing implementation issues and cultural barriers and aligning HR programs.

      • Guide to Flexible Work for Managers and Employees
      • Flexible Work Time Policy
      • Flexible Work Time Off Policy
      • Flexible Work Location Policy

      Infographic

      Workshop: Develop a Targeted Flexible Work Program for IT

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Prepare to Assess Flex Work Feasibility

      The Purpose

      Gather information on organizational and employee flexibility needs.

      Key Benefits Achieved

      Understand the flexibility needs of the organization and its employees to inform a targeted flex work program.

      Activities

      1.1 Identify employee and organizational needs.

      1.2 Identify employee segments.

      1.3 Establish program goals and metrics.

      1.4 Shortlist flexible work options.

      Outputs

      Organizational context summary

      List of shortlisted flex work options

      2 Assess Flex Work Feasibility

      The Purpose

      Perform a data-driven feasibility analysis on shortlisted work options.

      Key Benefits Achieved

      A data-driven feasibility analysis ensures your flex work program meets its goals.

      Activities

      2.1 Conduct employee/manager focus groups to assess feasibility of flex work options.

      Outputs

      Summary of flex work options feasibility per employee segment

      3 Finalize Flex Work Options

      The Purpose

      Select the most impactful flex work options and create a plan for addressing implementation challenge

      Key Benefits Achieved

      A data-driven selection process ensures decisions and exceptions can be communicated with full transparency.

      Activities

      3.1 Finalize list of approved flex work options.

      3.2 Brainstorm solutions to implementation issues.

      3.3 Identify how to overcome cultural barriers.

      Outputs

      Final list of flex work options

      Implementation barriers and solutions summary

      4 Prepare for Implementation

      The Purpose

      Create supporting materials to ensure program implementation proceeds smoothly.

      Key Benefits Achieved

      Employee- and manager-facing guides and policies ensure the program is clearly documented and communicated.

      Activities

      4.1 Design employee and manager guide prototype.

      4.2 Align HR programs and policies to support flexible work.

      4.3 Create a communication plan.

      Outputs

      Employee and manager guide to flexible work

      Flex work roadmap and communication plan

      5 Next Steps and Wrap-Up

      The Purpose

      Put everything together and prepare to implement.

      Key Benefits Achieved

      Our analysts will support you in synthesizing the workshop’s efforts into a cohesive implementation strategy.

      Activities

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Outputs

      Completed flexible work feasibility workbook

      Flexible work communication plan

      Further reading

      Develop a Targeted Flexible Work Program for IT

      Select flexible work options that balance organizational and employee needs to drive engagement and improve attraction and retention.

      Executive Summary

      Your Challenge

      • IT leaders continue to struggle with workplace flexibility, and it is a top priority for IT employees; as a result, organizations who fail to offer flexibility will have a difficult time attracting, recruiting, and retaining talent.
      • The benefits of remote work are not available to everyone, raising fairness and equity concerns for employees.

      Common Obstacles

      • A one-size-fits-all approach to selecting and implementing flexible work options fails to consider unique employee needs and will not reap the benefits of offering a flexible work program (e.g. higher engagement or enhanced employer brand).
      • Improper structure and implementation of flexible work programs exacerbates existing challenges (e.g. high turnover) or creates new ones.

      Info-Tech's Approach

      • Uncover the needs of unique employee segments to shortlist flexible work options that employees want and will use.
      • Assess the feasibility of various flexible work options and select ones that meet employee needs and are feasible for the organization.
      • Equip leaders with the information and tools needed to implement and sustain a flexible work program.

      Info-Tech Insight

      IT excels at hybrid location work and is more effective as a business function when location flexibility is an option for its employees. But hybrid work is just a start. A comprehensive flex work program extends beyond flexible location, so organizations must understand the needs of unique employee groups to uncover the options that will attract and retain talent.

      Flexible work arrangements are a requirement in today's world of work

      Flexible work continues to gain momentum…

      A 2022 LinkedIn report found that the following occurred between 2019 and 2021:

      +362%

      Increase in LinkedIn members sharing content with the term "flexible work."

      +83%

      Increase in job postings that mention "flexibility."
      (LinkedIn, 2022)

      In 2022, Into-Tech found that hybrid was the most commonly used location work model for IT across all industries.

      ("State of Hybrid Work in IT," Info-Tech Research Group, 2022)

      …and employees are demanding more flexibility

      90%

      of employees said they want schedule and location flexibility ("Global Employee Survey," EY, 2021).

      17%

      of resigning IT employees cited lack of flexible work options as a reason ("IT Talent Trends 2022," Info-Tech Research Group, 2022).

      71%

      of executives said they felt "pressure to change working models and adapt workplace policies to allow for greater flexibility" (LinkedIn, 2021).

      Therefore, organizations who fail to offer flexibility will be left behind

      Difficulty attracting and retaining talent

      98% of IT employees say flexible work options are important in choosing an employer ("IT Talent Trends 2022," Info-Tech Research Group, 2022).

      Worsening employee wellbeing and burnout

      Knowledge workers with minimal to no schedule flexibility are 2.2x more likely to experience work-related stress and are 1.4x more likely to suffer from burnout (Slack, 2022; N=10,818).

      Offering workplace flexibility benefits organizations and employees

      Higher performance

      IT departments that offer some degree of location flexibility are more effective at supporting the organization than those who do not.

      35% of service desk functions report improved service since implementing location flexibility.
      ("State of Hybrid Work in IT," Info-Tech Research Group, 2023).

      Enhanced employer brand

      Employees are 2.1x more likely to recommend their employer to others when they are satisfied with their organization's flexible work arrangements (LinkedIn, 2021).

      Improved attraction

      41% of IT departments cite an expanded hiring pool as a key benefit of hybrid work.

      Organizations that mention "flexibility" in their job postings have 35% more engagement with their posts (LinkedIn, 2022).

      Increased job satisfaction

      IT employees who have more control over their working arrangement experience a greater sense of contribution and trust in leadership ("State of Hybrid Work in IT," Info-Tech Research Group, 2023).

      Better work-life balance

      81% of employees say flexible work will positively impact their work-life balance (FlexJobs, 2021).

      Boosted inclusivity

      • Caregivers regardless of gender, supporting them in balancing responsibilities
      • Individuals with disabilities, enabling them to work from the comfort of their homes
      • Women who may have increased responsibilities
      • Women of color to mitigate the emotional tax experienced at work

      Info-Tech Insight

      Flexible work options are not a concession to lower productivity. Properly implemented, flex work enables employees to be more productive at reaching business goals.

      Despite the popularity of flexible work options, not all employees can participate

      IT organizations differ on how much flexibility different roles can have.

      IT employees were asked what percentage of IT roles were currently in a hybrid or remote work arrangement ("State of Hybrid Work in IT," Info-Tech Research Group, 2023).

      However, the benefits of remote work are not available to all, which raises fairness and equity concerns between remote and onsite employees.

      45%

      of employers said, "one of the biggest risks will be their ability to establish fairness and equity among employees when some jobs require a fixed schedule or location, creating a 'have and have not' dynamic based on roles" ("Businesses Suffering," EY, 2021).

      Offering schedule flexibility to employees who need to be fully onsite can be used to close the fairness and equity gap.

      When offered the choice, 54% of employees said they would choose schedule flexibility over location flexibility ("Global Employee Survey," EY, 2021).

      When employees were asked "What choice would you want your employer to provide related to when you have to work?" The top three choices were:

      68%

      Flexibility on when to start and finish work

      38%

      Compressed or four-day work weeks

      33%

      Fixed hours (e.g. 9am to 5pm)

      Disclaimer: "Percentages do not sum to 100%, as each respondent could choose up to three of the [five options provided]" ("Global Employee Survey," EY, 2021).

      Beware of the "all or nothing" approach

      There is no one-size-fits-all approach to workplace flexibility.

      Understanding the needs of various employee segments in the organization is critical to the success of a flexible work program.

      Working parents want more flexibility

      82%

      of working mothers desire flexibility in where they work.

      48%

      of working fathers "want to work remotely 3 to 5 days a week."

      Historically underrepresented groups value more flexibility

      38%

      "Thirty-eight percent of Black male employees and 33% of Black female employees would prefer a fully flexible schedule, compared to 25% of white female employees and 26% of white male employees."
      (Slack, 2022; N=10,818)

      33%

      Workplace flexibility must be customized to the organization to avoid longer working hours and heavy workloads that impact employee wellbeing

      84%

      of remote workers and 61% of onsite workers reported working longer hours post pandemic. Longer working hours were attributed to reasons such as pressure from management and checking emails after working hours (Indeed, 2021).

      2.6x

      Respondents who either agreed or strongly agreed with the statement "Generally, I find my workload reasonable" were 2.6x more likely to be engaged compared to those who stated they disagreed or strongly disagreed (McLean & Company Engagement Survey Database;2022; N=5,615 responses).

      Longer hours and unsustainable workloads can contribute to stress and burnout, which is a threat to employee engagement and retention. With careful management (e.g. setting clear expectations and establishing manageable workloads), flexible work arrangement benefits can be preserved.

      Info-Tech Insight

      Employees' lived experiences and needs determine if people use flexible work programs – a flex program that has limited use or excludes people will not benefit the organization.

      Develop a flexible work program that meets employee and organizational needs

      This is an image of a sample flexible work program which meets employee and organizational needs.

      Insight summary

      Overarching insight: IT excels at hybrid location work and is more effective as a business function when location, time, and time-off flexibility are an option for its employees.

      Introduction

      Step 1 insight

      Step 2 insight

      Step 3 insight

      • Flexible work options are not a concession to lower productivity. Properly implemented, flex work enables employees to be more productive at reaching business goals.
      • Employees' lived experiences and needs determine if people use flexible work programs – a flex program that has limited use or excludes people will not benefit the organization.
      • Flexible work benefits everyone. IT employees experience greater engagement, motivation, and company loyalty. IT organizations realize benefits such as better service coverage, reduced facilities costs, and increased productivity.
      • Hybrid work is a start. A comprehensive flex work program extends beyond flexible location to flexible time and time off. Organizations must understand the needs of unique employee groups to uncover the options that will attract and retain talent. Provide greater inclusivity to employees by broadening the scope to include flex location, flex time, and flex time off.
      • No two employee segments are the same. To be effective, flexible work options must align with the expectations and working processes of each segment.
      • Every role is eligible for hybrid location work. If onsite work duties prevent an employee group from participating, see if processes can be digitized or automated. Flexible work is an opportunity to go beyond current needs to future proofing your organization.
      • Flexible work options must balance organizational and employee needs. If an option is beneficial to employees but there is little or no benefit to the organization, or if the cost of the option is too high, it will not support the long-term success of the organization.
      • Prioritize flexible work options that employees want. Providing too many options often leads to information overload and results in employees not understanding what is available, lowering adoption of the flexible work program.
      • Leaders' collective support of the flexible program determines the program's successful adoption. Don't sweep cultural barriers under the rug; acknowledge and address them to overcome them.
      • Negative performance of a flexible work option does not necessarily mean failure. Take the time to evaluate whether the option simply needs to be tweaked or whether it truly isn't working for the organization.
      • A set of formal guidelines for IT ensures flexible work is:
        1. Administered fairly across all IT employees.
        2. Defensible and clear.
        3. Scalable to the rest of the organization.

      Case Study

      Expanding hybrid work at Info-Tech

      Challenge

      In 2020, Info-Tech implemented emergency work-from-home for its IT department, along with the rest of the organization. Now in 2023, hybrid work is firmly embedded in Info-Tech's culture, with plans to continue location flexibility for the foreseeable future.

      Adjusting to the change came with lessons learned and future-looking questions.

      Lessons Learned

      Moving into remote work was made easier by certain enablers that had already been put in place. These included issuing laptops instead of desktops to the user base and using an existing cloud-based infrastructure. Much support was already being done remotely, making the transition for the support teams virtually seamless.

      Continuing hybrid work has brought benefits such as reduced commuting costs for employees, higher engagement, and satisfaction among staff that their preferences were heard.

      Looking Forward

      Every flexible work implementation is a work in progress and must be continually revisited to ensure it continues to meet organizational and employee needs. Current questions being explored at Info-Tech are:

      • The concept of the "office as a tool" – how does use of the office change when it is used for specific collaboration-related tasks, rather than everything? How should the physical space change to support this?
      • What does a viable replacement for quick hallway meetings look like in a remote world where communication is much more deliberate? How can managers adjust their practices to ensure the benefits of informal encounters aren't lost?

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      Preparation

      Step 1

      Step 2

      Step 3

      Follow-up

      Call #1: Scope requirements, objectives, and your specific challenges.

      Call #2: Assess employee and organizational needs.

      Call #3: Shortlist flex work options and assess feasibility.

      Call #4: Finalize flex work options and create rollout plan.

      Call #5: (Optional) Review rollout progress or evaluate pilot success.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 3 to 5 calls over the course of 4 to 6 months.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Activities

      Prepare to assess flex work feasibility

      Assess flex work feasibility

      Finalize flex work options

      Prepare for implementation

      Next Steps and Wrap-Up (offsite)

      1.1 Identify employee and organizational needs.

      1.2 Identify employee segments.

      1.3 Establish program goals and metrics.

      1.4 Shortlist flex work options.

      2.1 Conduct employee/manager focus groups to assess feasibility of flex work options.

      3.1 Finalize list of approved flex work options.

      3.2 Brainstorm solutions to implementation issues.

      3.2 Identify how to overcome cultural barriers.

      4.1 Design employee and manager guide prototype.

      4.2 Align HR programs and policies to support flexible work.

      4.3 Create a communication plan.

      5.1 Complete in-progress deliverables from previous four days.

      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. Organizational context summary
      2. List of shortlisted flex work options
      1. Summary of flex work options' feasibility per employee segment
      1. 1.Final list of flex work options
      2. 2.Implementation barriers and solutions summary
      1. Employee and manager guide to flexible work
      2. Flex work roadmap and communication plan
      1. Completed flexible work feasibility workbook
      2. Flexible work communication plan

      Step 1

      Assess employee and organizational needs

      1. Assess employee and organizational flexibility needs
      2. Identify potential flex options and assess feasibility
      3. Implement selected option(s)

      After completing this step you will have:

      • Identified key stakeholders and their responsibilities
      • Uncovered the current and desired state of the organization
      • Analyzed feedback to identify flexibility challenges
      • Identified and prioritized employee segments
      • Determined the program goals
      • Identified the degree of flexibility for work location, timing, and deliverables

      Identify key stakeholders

      Organizational flexibility requires collaborative and cross-functional involvement to determine which flexible options will meet the needs of a diverse workforce. HR leads the project to explore flexible work options, while other stakeholders provide feedback during the identification and implementation processes.

      HR

      • Assist with the design, implementation, and maintenance of the program.
      • Provide managers and employees with guidance to establish successful flexible work arrangements.
      • Help develop communications to launch and maintain the program.

      Senior Leaders

      • Champion the project by modeling and promoting flexible work options
      • Help develop and deliver communications; set the tone for flexible work at the organization.
      • Provide input into determining program goals.

      Managers

      • Model flexible work options and encourage direct reports to request and discuss options.
      • Use flexible work program guidelines to work with direct reports to select suitable flexible work options.
      • Develop performance metrics and encourage communication between flexible and non-flexible workers.

      Flexible Workers

      • Indicate preferences of flexible work options to the manager.
      • Identify ways to maintain operational continuity and communication while working flexibly.
      • Flag issues and suggest improvements to the manager.
      • Develop creative ways to work with colleagues who don't work flexibly.

      Non-Flexible Workers

      • Share feedback on issues with flexible arrangements and their impact on operational continuity.

      Info-Tech Insight

      Flexible work is a holistic team effort. Leaders, flexible workers, teammates, and HR must clearly understand their roles to ensure that teams are set up for success.

      Uncover the current and desired state of flexibility in the organization

      Current State

      Target State

      Review:

      • Existing policies related to flexibility (e.g. vacation, work from anywhere)
      • Existing flexibility programs (e.g. seasonal hours) and their uptake
      • Productivity of employees
      • Current culture at the organization. Look for:
        • Employee autonomy
        • Reporting structure and performance management processes
        • Trust and psychological safety of employees
        • Leadership behavior (e.g. do leaders model work-life balance, or does the organization have a work 24/7 mentality?)

      Identify what is driving the need for flexible work options. Ask:

      • Why does the organization need flexible options?
        • For example, the introduction of flexibility for some employees has created a "have and have not" dynamic between roles that must be addressed.
      • What does the organization hope to gain from implementing flexible options? For example:
        • Improved retention
        • Increased attraction, remaining competitive for talent
        • Increased work-life balance for employees
        • Reduced burnout
      • What does the organization aspire to be?
        • For example, an organization that creates an environment that values output, not face time.

      These drivers identify goals for the organization to achieve through targeted flexible work options.

      Info-Tech Insight

      Hybrid work is a start. A comprehensive flex work program extends beyond flexible location, so organizations must understand the needs of unique employee groups to uncover the options that will attract and retain talent. Provide greater inclusivity to employees by broadening the scope to include flex location, flex time, and flex time off.

      Identify employee segments

      Using the data, feedback, and challenges analyzed and uncovered so far, assess the organization and identify employee segments.

      Identify employee segments with common characteristics to assess if they require unique flexible work options. Assess the feasibility options for the segments separately in Step 2.

      • Segments' unique characteristics include:
        • Role responsibilities (e.g. interacting with users, creating reports, development and testing)
        • Work location/schedule (e.g. geographic, remote vs. onsite, 9 to 5)
        • Work processes (e.g. server maintenance, phone support)
        • Group characteristics (e.g. specific teams, new hires)

      Identify employee segments and sort them into groups based on the characteristics above.

      Examples of segments:

      • Functional area (e.g. Service Desk, Security)
      • Job roles (e.g. desktop support, server maintenance)
      • Onsite, remote, or hybrid
      • Full-time or part-time
      • Job level (e.g. managers vs. independent contributors)
      • Employees with dependents

      Prioritize employee segments

      Determine whether the organization needs flexible work options for the entire organization or specific employee segments.
      For specific employee segments:

      • Answer the questions on the right to identify whether an employee segment is high, medium, or low priority. Complete slides 23 to 25 for each high-priority segment, repeating the process for medium-priority segments when resources allow.

      For the entire organization:

      • When identifying an option for the entire organization, consider all segments. The approach must create consistency and inclusion; keep this top of mind when identifying flexibility on slides 23 to 25. For example, the work location flexibility would be low in an organization where some segments can work remotely and others must be onsite due to machinery requirements.

      High priority: The employee segment has the lowest engagement scores or highest turnover within the organization. Segment sentiment is that current flexibility is nonexistent or not sufficiently meeting needs.
      Medium priority: The employee segment has low engagement or high turnover. Segment sentiment is that currently available flexibility is minimal or not sufficiently meeting needs.
      Low priority: The segment does not have the lowest engagement or the highest turnover rate. Segment sentiment is that currently available flexibility is sufficiently meeting needs.

      1. What is the impact on the organization if this segment's challenges aren't addressed (e.g. if low engagement and high turnover are not addressed)?
      2. How critical is flexibility to the segment's needs/engagement?
      3. How time sensitive is it to introduce flexibility to this segment (e.g. is the organization losing employees in this segment at a high rate)?
      4. Will providing flexibility to this segment increase organizational productivity or output

      Identify challenges to address with flexibility

      Uncover the lived experiences and expectations of employees to inform selection of segments and flexible options.

      1. Collect data from existing sources, such as:
        • Engagement surveys
        • New hire/exit surveys
        • Employee experience monitor surveys
        • Employee retention pulse surveys
        • Burnout surveys
        • DEI pulse surveys
      2. Analyze employee feedback on experiences with:
        • Work duties
        • Workload
        • Work-life balance
        • Operating processes and procedures
        • Achieving operational outcomes
        • Collaboration and communication
        • Individual experience and engagement
      3. Evaluate the data and identify challenges

      Example challenges:

      • Engagement: Low average score on work-life balance question; flexible work suggested in open-ended responses.
      • Retention: Exit survey indicating that lack of work-life balance is consistently a reason employees leave. Include the cost of turnover (e.g. recruitment, training, severance).
      • Burnout: Feedback from employees through surveys or HR business partner anecdotes indicating high burnout; high usage of wellness services or employee assistance programs.
      • Absenteeism: High average number of days employees were absent in the past year. Include the cost of lost productivity.
      • Operational continuity: Provide examples of when flexible work would have enabled operational continuity in the case of disaster or extended customer service coverage.
      • Program uptake: If the organization already has a flexible work program, provide data on the low proportion of eligible employees using available options.

      1.1 Prepare to evaluate flexible work options

      1-3 hours

      Follow the guidance on preceding slides to complete the following activities.
      Note: If you are only considering remote or hybrid work, use the Fast-Track Hybrid Work Program Workbook. Otherwise, proceed with the Targeted Flexible Work Program Workbook.

      1. Identify key stakeholders. Be sure to record the level of involvement and responsibility expected from each stakeholder. Use the "Stakeholders" tab of the workbook.
      2. Uncover current and desired state. Review and record your current state with respect to culture, productivity, and current flexible work options, if any. Next, record your desired future state, including reasons for implementing flexible work, and goals for the program. Record this in the "Current and Desired State" tab of the workbook.
      3. Identify and prioritize employee segments. Identify and record employee segments. Depending on the size of your department, you may identify a few or many. Be as granular as necessary to fully separate employee groups with different needs. If your resources or needs prevent you from rolling out flexible work to the entire department, record the priority level of each segment so you can focus on the highest priority first.
      4. Identify challenges with flexibility. With each employee segment in mind, analyze your available data to identify and record each segment's main challenges regarding flexible work. These will inform your program goals and metrics.

      Download the Targeted Flexible Work Program Workbook

      Download the Fast-Track Hybrid Work Program Workbook

      Input

      • List of departmental roles
      • Data on employee engagement, productivity, sentiment regarding flexible work, etc.

      Output

      • List of stakeholders and responsibilities
      • Flexible work challenges and aims
      • Prioritized list of employee segments

      Materials

      • Targeted Flexible Work Program Workbook
        Or
      • Fast-Track Hybrid Work Program Workbook

      Participants

      • IT department head
      • HR business partner
      • Flexible work program committee

      Determine goals and metrics for the flexible work program

      Sample program goals

      Sample metrics

      Increase productivity

      • Employee, team, and department key performance indicators (KPIs) before and after flexible work implementation
      • Absenteeism rate (% of lost working days due to all types of absence)

      Improve business satisfaction and perception of IT value

      Increase retention

      • % of exiting employees who cite lack of flexible work options or poor work-life balance as a reason they left
      • Turnover and retention rates

      Improve the employee value proposition (EVP) and talent attraction

      • # of responses on the new hire survey where flexible work options or work-life balance are cited as a reason for accepting an employment offer
      • # of views of career webpage that mentions flexible work program
      • Time-to-fill rates

      Improve engagement and work-life balance

      • Overall engagement score – deploy Info-Tech's Employee Engagement Diagnostics
      • Score for questions about work-life balance on employee engagement or pulse survey, including:
        • "I am able to maintain a balance between my work and personal life."
        • "I find my stress levels at work manageable."

      Info-Tech Insight

      Implementing flex work without solid performance metrics means you won't have a way of determining whether the program is enabling or hampering your business practices.

      1.2 Determine goals and metrics

      30 minutes

      Use the examples on the preceding slide to identify program goals and metrics:

      1. Brainstorm program goals. Be sure to consider both the business benefits (e.g. productivity, retention) and the employee benefits (work-life balance, engagement). A successful flexible work program benefits both the organization and its employees.
      2. Brainstorm metrics for each goal. Identify metrics that are easy to track accurately. Use Info-Tech's IT and HR metrics libraries for reference. Ideally, the metrics you choose should already exist in your organization so no extra effort will be necessary to implement them. It is also important to have a baseline measure of each one before flexible work is rolled out.
      3. Record your outputs on the "Goals and Metrics" tab of the workbook.

      Download the Targeted Flexible Work Program Workbook

      Download the IT Metrics Library

      Download the HR Metrics Library

      Input

      • Organizational and departmental strategy

      Output

      • List of program goals and metrics

      Materials

      • Targeted Flexible Work Program Workbook
        Or
      • Fast-Track Hybrid Work Program Workbook

      Participants

      • Flexible work program committee

      Determine work location flexibility for priority segments

      Work location looks at where a segment can complete all or some of their tasks (e.g. onsite vs. remote). For each prioritized employee segment, evaluate the amount of location flexibility available.

      Work Duties

      Processes

      Operational Outcomes

      High degree of flexibility

      • Low dependence on onsite equipment
      • Work easily shifts to online platforms
      • Low dependence on onsite external interactions (e.g. clients, customers, vendors)
      • Low interdependence of work duties internally (most work is independent)
      • Work processes and expectations are or can be formally documented
      • Remote work processes are sustainable long term

      Most or all operational outcomes can be achieved offsite (e.g. products/service delivery not impacted by WFH)

      • Some dependence on onsite equipment
      • Some work can shift to online platforms
      • Some dependence on onsite external interactions
      • Some interdependence of work duties internally (collaboration is critical)
      • Most work processes and expectations have been or can be formally documented
      • Remote work processes are sustainable (e.g. workarounds can be supported and didn't add work)

      Some operational outcomes can be achieved offsite (e.g. some impact of WFH on product/service delivery)

      Low degree of flexibility

      • High dependence on onsite equipment
      • Work cannot shift to online platforms
      • High dependence on onsite external interactions
      • High interdependence of work duties internally (e.g. line work)
      • Few work processes and expectations can be formally documented
      • Work processes cannot be done remotely, and workarounds for remote work are not sustainable long term

      Operational outcomes cannot be achieved offsite (e.g. significant impairment to product/service delivery)

      Note

      If roles within the segment have differing levels of location flexibility, use the lowest results (e.g. if role A in the segment has a high degree of flexibility for work duties and role B has a low degree of flexibility, use the results for role B).

      Identify work timing for priority segments

      Work timing looks at when work can or needs to be completed (e.g. Monday to Friday, 9am to 5pm).

      Work Duties

      Processes

      Operational Outcomes

      High degree of flexibility

      • No need to be available to internal and/or external customers during standard work hours
      • Equipment is available at any time
      • Does not rely on synchronous (occurring at the same time) work duties internally
      • Work processes and expectations are or can be formally documented
      • Low reliance on collaboration
      • Work is largely asynchronous (does not occur at the same time)

      Most or all operational outcomes are not time sensitive

      • Must be available to internal and/or external customers during some standard work hours
      • Some reliance on synchronous work duties internally (collaboration is critical)
      • Most work processes and expectations have been or can be formally documented
      • Moderate reliance on collaboration
      • Some work is synchronous

      Some operational outcomes are time sensitive and must be conducted within set date or time windows

      Low degree of flexibility

      • Must be available to internal and/or external customers during all standard work hours (e.g. Monday to Friday 9 to 5)
      • High reliance on synchronous work duties internally (e.g. line work)
      • Few work processes and expectations can be formally documented
      • High reliance on collaboration
      • Most work is synchronous

      Most or all operational outcomes are time sensitive and must be conducted within set date or time windows

      Note

      With additional coordination, flex time or flex time off options are still possible for employee segments with a low degree of flexibility. For example, with a four-day work week, the segment can be split into two teams – one that works Monday to Thursday and one that works Tuesday to Friday – so that employees are still available for clients five days a week.

      Examine work deliverables for priority segments

      Work deliverables look at the employee's ability to deliver on their role expectations (e.g. quota or targets) and whether reducing the time spent working would, in all situations, impact the work deliverables (e.g. constrained vs. unconstrained).

      Work Duties

      Operational Outcomes

      High degree of flexibility

      • Few or no work duties rely on equipment or processes that put constraints on output (unconstrained output)
      • Employees have autonomy over which work duties they focus on each day
      • Most or all operational outcomes are unconstrained (e.g. a marketing analyst who builds reports and strategies for clients can produce more reports, produce better reports, or identify new strategies)
      • Work quota or targets are achievable even if working fewer hours
      • Some work duties rely on equipment or processes that put constraints on output
      • Employees have some ability to decide which work duties they focus on each day
      • Some operational outcomes are constrained or moderately unconstrained (e.g. an analyst build reports based on client data; while it's possible to find efficiencies and build reports faster, it's not possible to attain the client data any faster)
      • Work quota or targets may be achievable if working fewer hours

      Low degree of flexibility

      • Most or all work duties rely on equipment or processes that put constraints on output (constrained output)
      • Daily work duties are prescribed (e.g. a telemarketer is expected to call a set number of people per day using a set list of contacts and a defined script)
      • Most or all operational outcomes are constrained (e.g. a machine operator works on a machine that produces 100 parts an hour; neither the machine nor the worker can produce more parts)
      • Work quota or targets cannot be achieved if fewer hours are worked

      Note

      For segments with a low degree of work deliverable flexibility (e.g. very constrained output), flexibility is still an option, but maintaining output would require additional headcount.

      1.3 Determine flexibility needs and constraints

      1-2 hours

      Use the guidelines on the preceding slides to document the parameters of each work segment.

      1. Determine work location flexibility. Work location looks at where a segment can complete all or some of their tasks (e.g. onsite vs. remote). For each prioritized employee segment, evaluate the amount of location flexibility available.
      2. Identify work timing. Work timing looks at when work can or needs to be completed (e.g. Monday to Friday, 9am to 5pm).
      3. Examine work deliverables. Work deliverables look at the employee's ability to deliver on their role expectations (e.g. quota or targets) and whether reducing the time spent working would, in all situations, impact the work deliverables (e.g. constrained vs. unconstrained).
      4. Record your outputs on the "Current and Desired State" tab of the workbook.

      Download the Targeted Flexible Work Program Workbook

      Input

      • List of employee segments

      Output

      • Summary of flexibility needs and constraints for each employee segment

      Materials

      • Targeted Flexible Work Program Workbook
        Or
      • Fast-Track Hybrid Work Program Workbook

      Participants

      • Flexible work program committee
      • Employee segment managers

      Step 2

      Identify potential flex options and assess feasibility

      1. Assess employee and organizational flexibility needs
      2. Identify potential flex options and assess feasibility
      3. Implement selected option(s)

      After completing this step you will have:

      • Created a shortlist of potential options for each prioritized employee segment
      • Evaluated the feasibility of each potential option
      • Determined the cost and benefit of each potential option
      • Gathered employee sentiment on potential options
      • Finalized options with senior leadership

      Prepare to identify and assess the feasibility of potential flexible work options

      First, review the Flexible Work Solutions Catalog

      Before proceeding to the next slide, review the Flexible Work Options Catalog to identify and shortlist five to seven flexible work options that are best suited to address the challenges faced for each of the priority employee segments identified in Step 1.

      Then, assess the feasibility of implementing selected options using slides 29 to 32

      Assess the feasibility of implementing the shortlisted solutions for the prioritized employee segments against the feasibility factors in this step. Repeat for each employee segment. Use the following slides to consult with and include leaders when appropriate.

      • Document your analysis in tabs 6 to 8 of the Targeted Flexible Work Program Workbook.
      • Note implementation issues throughout the assessment and record them in the tool. They will be addressed in Step 3: Implement Selected Program(s). Don't rule out an option simply because it presents some challenges; careful implementation can overcome many challenges.
      • At the end of this step, determine the final list of flexible work options and gain approval from senior leaders for implementation.

      Evaluate feasibility by reviewing the option's impact on continued operations and job performance

      Operational coverage

      Synchronous communication

      Time zones

      Face-to-face

      communication

      To what extent are employees needed to deliver products or services?

      • If constant customer service is required, stagger employees' schedules (e.g. one team works Monday-Thursday while another works Tuesday-Friday).

      To what extent do employees need to communicate with each other synchronously?

      • Break the workflow down and identify times when employees do and do not have to work at the same time to communicate with each other.

      To what extent do employees need to coordinate work across time zones?

      • If the organization already operates in different time zones, ensure that the option does not impact operations requiring continuous coverage.
      • When employees are located in different time zones, coordinate schedules based on the other operational factors.

      When do employees need to interact with each other or clients in person?

      • Examine the workflow closely to identify times when face-to-face communication is not required. Schedule "office days" for employees to work together when in-person interaction is needed.
      • When the interaction is only required with clients, determine whether employees are able to meet clients offsite.

      Info-Tech Insight

      Every role is eligible for hybrid location work. If onsite work duties prevent an employee group from participating, see if processes can be digitized or automated. Flexible work is an opportunity to go beyond current needs to future-proof your organization.

      Assess the option's alignment with organizational culture

      Symbols

      Values

      Behaviors

      How supportive of flexible work are the visible aspects of the organization's culture?

      • For example, the mission statement, newsletters, or office layout.
      • Note: Visible elements will need to be adapted to ensure they reinforce the value of the flexible work option.

      How supportive are both the stated and lived values of the organization?

      • When the flexible work option includes less direct supervision, assess how empowered employees feel to make decisions.
      • Assess whether all types of employees (e.g. virtual) are included, valued, and supported.

      How supportive are the attitudes and behaviors, especially of leaders?

      • Leaders set the expectations for acceptable behaviors in the organization. Determine how supportive leaders are toward flexible workers by examining their attitudes and perceptions.
      • Identify if employees are open to different ways of doing work.

      Determine the resources required for the option

      People

      Process

      Technology

      Do employees have the knowledge, skills, and abilities to adopt this option?

      • Identify any areas (e.g. process, technology) employees will need to be trained on and assess the associated costs.
      • Determine whether the option will require additional headcount to ensure operational continuity (e.g. two part-time employees in a job-sharing arrangement) and calculate associated costs (e.g. recruitment, training, benefits).

      How much will work processes need to change?

      • Interview organizational leaders with knowledge of the employee segment's core work processes. Determine whether a significant change will be required.
      • If a significant change is required, evaluate whether the benefits of the option outweigh the costs of the process and behavioral change (see the "net benefit" factor on slide 33).

      What new technologies will be required?

      • Identify the technology (e.g. that supports communication, work processes) required to enable the flexible work option.
      • Note whether existing technology can be used or additional technology will be required, and further investigate the viability and costs of these options.

      Examine the option's risks

      Data

      Health & Safety

      Legal

      How will data be kept secure?

      • Determine whether the organization's data policy and technology covers employees working remotely or other flexible work options.
      • If the employee segment handles sensitive data (e.g. personal employee information), consult relevant stakeholders to determine how data can be kept secure and assess any associated costs.

      How will employees' health and safety be impacted?

      • Consult your organization's legal counsel to determine whether the organization will be liable for the employees' health and safety while working from home or other locations.
      • Determine whether the organization's policies and processes will need to be modified.

      What legal risks might be involved?

      • Identify any policies in place or jurisdictional requirements to avoid any legal risks. Consult your organization's legal counsel about the situations below.
        • If the option causes significant changes to the nature of jobs, creating the risk of constructive dismissal.
        • If there are any risks to providing less supervision (e.g. higher chance of harassment).
        • When only some employee segments are eligible for the option, determine whether there is a risk of inequitable access.
        • If the option impacts any unionized employees or collective agreements.

      Determine whether the benefits of the option outweigh the costs

      Include senior leadership in the net benefit process to ensure any unfeasible options are removed from consideration before presenting to employees.

      1. Document the employee and employer benefits of the option from the previous feasibility factors on slides 29 to 32.
      • Include the benefits of reaching program goals identified in Step 1.
      • Quantify the benefits in dollar value where possible.
    • Document the costs and risks of the option, referring to the costs noted from previous feasibility factors.
      • Quantify the costs in dollar value where possible.
    • Compare the benefits and costs.
      • Add an option to your final list if the benefits are greater than the costs.
    • This is an image of a table with the main heading being Net Benefit, with the following subheadings: Benefits to organization; Benefits to employees; Costs.

      Info-Tech Insight

      Flexible work options must balance organizational and employee needs. If an option is beneficial to employees but there is little or no benefit to the organization as a whole, or if the cost of the option is too high, it will not support the long-term success of the organization.

      2.1a Identify and evaluate flexible work options

      30 minutes per employee segment per work option

      If you are only considering hybrid or remote work, skip to activity 2.1b. Use the guidelines on the preceding slides to conduct feasibility assessments.

      1. Shortlist flexible work options. Review the Flexible Work Options Catalog to identify and shortlist five to seven flexible work options that are best suited to address the challenges faced for each of the priority employee segments. Record these on the "Options Shortlist" tab of the workbook. Even if the decision is simple, ensure you record the rationale to help communicate your decision to employees. Transparent communication is the best way to avoid feelings of unfairness if desired work options are not implemented.
      2. Evaluate option feasibility. For each of the shortlisted options, complete one "Feasibility - Option" tab in the workbook. Make as many copies of this tab as needed.
        • When evaluating each option, consider each employee segment individually as you work through the prompts in the workbook. You may find that segments differ greatly in the feasibility of various types of flexible work. You will use this information to inform your overall policy and any exceptions to it.
        • You may need to involve each segment's management team to get an accurate picture of day-to-day responsibilities and flexible work feasibility.
      3. Weigh benefits and costs. At the end of each flexible work option evaluation, record the anticipated costs and benefits. Discuss whether this balance renders the option viable or rules it out.

      Download the Targeted Flexible Work Program Workbook

      Download the Flexible Work Options Catalog

      Input

      • List of employee segments

      Output

      • Shortlist of flexible work options
      • Feasibility analysis for each work option

      Materials

      • Targeted Flexible Work Program Workbook
      • Flexible Work Options Catalog

      Participants

      • Flexible work program committee
      • Employee segment managers

      2.1b Assess hybrid work feasibility

      30 minutes per employee segment

      Use the guidelines on the preceding slides to conduct a feasibility assessment. This exercise relies on having trialed hybrid or remote work before. If you have never implemented any degree of remote work, consider completing the full feasibility assessment in activity 2.1a.

      1. Evaluate hybrid work feasibility. Review the feasibility prompts on the "Work Unit Remote Work Assessment" tab and record your insight for each employee segment.
        • When evaluating each option, consider each employee segment individually as you work through the prompts in the workbook. You may find that segments differ greatly in their ability to accommodate hybrid work. You will use this information to inform your overall policy and any exceptions to it.
        • You may need to involve each segment's management team to get an accurate picture of day-to-day responsibilities and hybrid work feasibility.

      Download the Fast-Track Hybrid Work Program Workbook

      Input

      • List of employee segments

      Output

      • Feasibility analysis for each work option

      Materials

      • Fast-Track Hybrid Work Program Workbook

      Participants

      • Flexible work program committee
      • Employee segment managers

      Ask employees which options they prefer and gather feedback for implementation

      Deliver a survey and/or conduct focus groups with a selection of employees from all prioritized employee segments.

      Share

      • Present your draft list of options to select employees.
      • Communicate that the organization is in the process of assessing the feasibility of flexible work options and would like employee input to ensure flex work meets needs.
      • Be clear that the list is not final or guaranteed.

      Ask

      • Ask which options are preferred more than others.
      • Ask for feedback on each option – how could it be modified to meet employee needs better? Use this information to inform implementation in Step 3.

      Decide

      • Prioritize an option if many employees indicated an interest in it.
      • If employees indicate no interest in an option, consider eliminating it from the list, unless it will be required. There is no value in providing an option if employees won't use it.

      Survey

      • List the options and ask respondents to rate each on a Likert scale from 1 to 5.
      • Ask some open-ended questions with comment boxes for employee suggestions.

      Focus Group

      • Conduct focus groups to gather deeper feedback.
      • See Appendix I for sample focus group questions.

      Info-Tech Insight

      Prioritize flexible work options that employees want. Providing too many options often leads to information overload and results in employees not understanding what is available, lowering adoption of the flexible work program.

      Finalize options list with senior leadership

      1. Select one to three final options and outline the details of each. Include:
        • Scope: To what extent will the option be applied? E.g. work-from-home one or two days a week.
        • Eligibility: Which employee segments are eligible?
        • Cost: What investment will be required?
        • Critical implementation issues: Will any of the implementation issues identified for each feasibility factor impact whether the option will be approved?
        • Resources: What additional resources will be required (e.g. technology)?
      2. Present the options to stakeholders for approval. Include:
        • An outline of the finalized options, including what the option is and the scope, eligibility, and critical implementation issues.
        • The feasibility assessment results, including benefits, costs, and employee preferences. Have more detail from the other factors ready if leaders ask about them.
        • The investment (cost) required to implement the option.
      3. Proceed to Step 3 to implement approved options.

      Running an IT pilot of flex work

      • As a technology department, IT typically doesn't own flexible work implementation for the entire organization. However, it is common to trial flexible work options for IT first, before rolling out to the entire organization.
      • During a flex work pilot, ensure you are working closely with HR partners, especially regarding regulatory and compliance issues.
      • Keep the rest of the organizational stakeholders in the loop, especially regarding their agreement on the metrics by which the pilot's success will be evaluated.

      2.2a Finalize flexible work options

      2-3 hours + time to gather employee feedback

      If you are only considering hybrid or remote work, skip to activity 2.2b. Use the guidelines on the preceding slides to gather final feedback and finalize work option selections.

      1. Gather employee feedback. If employee preferences are already known, skip this step. If they are not, gather feedback to ascertain whether any of the shortlisted options are preferred. Remember that a successful flexible work program balances the needs of employees and the business, so employee preference is a key determinant in flexible work program success. Document this on the "Employee Preferences" tab of the workbook.
      2. Finalize flexible work options. Use your notes on the cost-benefit balance for each option, along with employee preferences, to decide whether the move forward with it. Record this decision on the "Options Final List" tab. Include information about eligible employee segments and any implementation challenges that came up during the feasibility assessments. This is the final decision summary that will inform your flexible program parameters and policies.

      Download the Targeted Flexible Work Program Workbook

      Input

      • Flexible work options shortlist

      Output

      • Final flexible work options list

      Materials

      • Targeted Flexible Work Program Workbook

      Participants

      • Flexible work program committee

      2.2b Finalize hybrid work parameters

      2-3 hours + time to gather employee feedback

      Use the guidelines on the preceding slides to gather final feedback and finalize work option selections.

      1. Summarize feasibility analysis. On the "Program Parameters" tab, record the main insights from your feasibility analysis. Finalize important elements, including eligibility for hybrid/remote work by employee segment. Additionally, record the standard parameters for the program (i.e. those that apply to all employee segments) and variable parameters (i.e. ones that differ by employee segment).

      Download the Fast-Track Hybrid Work Program Workbook

      Input

      • Hybrid work feasibility analysis

      Output

      • Final hybrid work program parameters

      Materials

      • Fast-Track Hybrid Work Program Workbook

      Participants

      • Flexible work program committee

      Step 3

      Implement selected option(s)

      1. Assess employee and organizational flexibility needs
      2. Identify potential flex options and assess feasibility
      3. Implement selected option(s)

      After completing this step, you will have:

      • Addressed implementation issues and cultural barriers
      • Equipped the organization to adopt flexible work options successfully
      • Piloted the program and assessed its success
      • Developed a plan for program rollout and communication
      • Established a program evaluation plan
      • Aligned HR programs to support the program

      Solve the implementation issues identified in your feasibility assessment

      1. Identify a solution for each implementation issue documented in the Targeted Flexible Work Program Workbook. Consider the following when identifying solutions:
        • Scope: Determine whether the solution will be applied to one or all employee segments.
        • Stakeholders: Identify stakeholders to consult and develop a solution. If the scope is one employee segment, work with organizational leaders of that segment. When the scope is the entire organization, consult with senior leaders.
        • Implementation: Collaborate with stakeholders to solve implementation issues. Balance the organizational and employee needs, referring to data gathered in Steps 1 and 2.

      Example:

      Issue

      Solution

      Option 1: Hybrid work

      Brainstorming at the beginning of product development benefits from face-to-face collaboration.

      Block off a "brainstorming day" when all team members are required in the office.

      Employee segment: Product innovation team

      One team member needs to meet weekly with the implementation team to conduct product testing.

      Establish a schedule with rotating responsibility for a team member to be at the office for product testing; allow team members to swap days if needed.

      Address cultural barriers by involving leaders

      To shift a culture that is not supportive of flexible work, involve leaders in setting an example for employees to follow.

      Misconceptions

      Tactics to overcome them

      • Flexible workers are less productive.
      • Flexible work disrupts operations.
      • Flexible workers are less committed to the organization.
      • Flexible work only benefits employees, not the organization.
      • Employees are not working if they aren't physically in the office.

      Make the case by highlighting challenges and expected benefits for both the organization and employees (e.g. same or increased productivity). Use data in the introductory section of this blueprint.

      Demonstrate operational feasibility by providing an overview of the feasibility assessment conducted to ensure operational continuity.

      Involve most senior leadership in communication.

      Encourage discovery and exploration by having managers try flexible work options themselves, which will help model it for employees.

      Highlight success stories within the organization or from competitors or similar industries.

      Invite input from managers on how to improve implementation and ownership, which helps to discover hidden options.

      Shift symbols, values, and behaviors

      • Work with senior leaders to identify symbols, values, and behaviors to modify to align with the selected flexible work options.
      • Validate that the final list aligns with your organization's mission, vision, and values.

      Info-Tech Insight

      Leaders' collective support of the flexible program determines the program's successful adoption. Don't sweep cultural barriers under the rug; acknowledge and address them to overcome them.

      Equip the organization for successful implementation

      Info-Tech recommends providing managers and employees with a guide to flexible work, introducing policies, and providing training for managers.

      Provide managers and employees with a guide to flexible work

      Introduce appropriate organization policies

      Equip managers with the necessary tools and training

      Use the guide to:

      • Familiarize employees and managers with the flexible work program.
      • Gain employee and manager buy-in and support for the program.
      • Explain the process and give guidance on selecting flexible work options and working with their colleagues to make it a success.

      Use Info-Tech's customizable policy templates to set guidelines, outline arrangements, and scope the organization's flexible work policies. This is typically done by, or in collaboration with, the HR department.

      Download the Guide to Flexible Work for Managers and Employees

      Download the Flex Location Policy

      Download the Flex Time-Off Policy

      Download the Flex Time Policy

      3.1 Prepare for implementation

      2-3 hours

      Use the guidelines on the preceding slides to brainstorm solutions to implementation issues and prepare to communicate program rollout to stakeholders.

      1. Solve implementation issues.
        • If you are working with the Targeted Flexible Work Program Workbook: For each implementation challenge identified on the "Final Options List" tab, brainstorm solutions. If you are working with the Fast-Track Hybrid Work Program Workbook: Work through the program enablement prompts on the "Program Enablement" tab.
        • You may need to involve relevant stakeholders to help you come up with appropriate solutions for each employee segment.
        • Ensure that any anticipated cultural barriers have been documented and are addressed during this step. Don't underestimate the importance of a supportive organizational culture to the successful rollout of flexible work.
      2. Prepare the employee guide. Modify the Guide to Flexible Work for Managers and Employees template to reflect your final work options list and the processes and expectations employees will need to follow.
      3. Create a communication plan. Use Info-Tech's Communicate Any IT Initiative blueprint and Appendix II to craft your messaging.

      Download the Guide to Flexible Work for Managers and Employees

      Download the Targeted Flexible Work Program Workbook

      Input

      • Flexible work options final list

      Output

      • Employee guide to flexible work
      • Flexible work rollout communication plan

      Materials

      • Guide to Flexible Work for Managers and Employees
      • Targeted Flexible Work Program Workbook
        Or
      • Fast-Track Hybrid Work Program Workbook

      Participants

      • Flexible work program committee
      • Employee segment managers

      Run an IT pilot for flexible work

      Prepare for pilot

      Launch Pilot

      Identify the flexible work options that will be piloted.

      • Refer to the final list of selected options for each priority segment to determine which options should be piloted.

      Select pilot participants.

      • If not rolling out to the entire IT department, look for the departments and/or team(s) where there is the greatest need and the biggest interest (e.g. team with lowest engagement scores).
      • Include all employees within the department, or team if the department is too large, in the pilot.
      • Start with a group whose managers are best equipped for the new flexibility options.

      Create an approach to collect feedback and measure the success of the pilot.

      • Feedback can be collected using surveys, focus groups, and/or targeted in-person interviews.

      The length of the pilot will greatly vary based on which flexible work options were selected (e.g. seasonal hours will require a shorter pilot period compared to implementing a compressed work week). Use discretion when deciding on pilot length and be open to extending or shortening the pilot length as needed.

      Launch pilot.

      • Launch the program through a town hall meeting or departmental announcement to build excitement and buy-in.
      • Develop separate communications for employee segments where appropriate. See Appendix II for key messaging to include.

      Gather feedback.

      • The feedback will be used to assess the pilot's success and to determine what modifications will be needed later for a full-scale rollout.
      • When gathering feedback, tailor questions based on the employee segment but keep themes similar. For example:
        • Employees: "How did this help your day-to-day work?"
        • Managers: "How did this improve productivity on your team?"

      Track metrics.

      • The success of the pilot is best communicated using your department's unique KPIs.
      • Metrics are critical for:
        • Accurately determining pilot success.
        • Getting buy-in to expand the pilot beyond IT.
        • Justifying to employees any changes made to the flexible work options.

      Assess the pilot's success and determine next steps

      Review the feedback collected on the previous slide and use this decision tree to decide whether to relaunch a pilot or proceed to a full-scale rollout of the program.

      This is an image of the flow chart used to assess the pilot's success and determine the next steps.  It will help you to determine whether you will Proceed to full-scale rollout on next slide, Major modifications to the option/launch (e.g. change operating time) – adjust and relaunch pilot or select a new employee segment and relaunch pilot, Minor modifications to the option/launch (e.g. introduce additional communications) – adjust and proceed to full scale rollout, or Return to shortlist (Step 2) and select a different option or launch pilot with a different employee segment.

      Prepare for full-scale rollout

      If you have run a team pilot prior to rolling out to all of IT, or run an IT pilot before an organizational rollout, use the following steps to transition from pilot to full rollout.

      1. Determine modifications
        • Review the feedback gathered during the pilot and determine what needs to change for a full-scale implementation.
        • Update HR policies and programs to support flexible work. Work closely with your HR business partner and other organizational leaders to ensure every department's needs are understood and compliance issues are addressed.
      2. Roll out and evaluate
        • Roll out the remainder of the program (e.g. to other employee segments or additional flexible work options) once there is significant uptake of the pilot by the target employee group and issues have been addressed.
        • Determine how feedback will be gathered after implementation, such as during engagement surveys, new hire and exit surveys, stay interviews, etc., and assess whether the program continues to meet employee and organizational needs.

      Rolling out beyond IT

      For a rollout beyond IT, HR will likely take over.

      However, this is your chance to remain at the forefront of your organization's flexible work efforts by continuing to track success and gather feedback within IT.

      Align HR programs and organizational policies to support flexible work

      Talent Management

      Learning & Development

      Talent Acquisition

      Reinforce managers' accountability for the success of flexible work in their teams:

      • Include "managing virtual teams" in the people management leadership competency.
      • Recognize managers who are modeling flexible work.

      Support flexible workers' career progression:

      • Monitor the promotion rates of flexible workers vs. non-flexible workers.
      • Make sure flexible workers are discussed during talent calibration meetings and have access to career development opportunities.

      Equip managers and employees with the knowledge and skills to make flexible work successful.

      • Provide guidance on selecting the right options and maintaining workflow.
      • If moving to a virtual environment, train managers on how to make it a success.

      Incorporate the flexible work program into the organization's employee value proposition to attract top talent who value flexible work options.

      • Highlight the program on the organization's career site and in job postings.

      Organizational policies

      Determine which organizational policies will be impacted as a result of the new flexible work options. For example, the introduction of flex time off can result in existing vacation policies needing to be updated.

      Plan to re-evaluate the program and make improvements

      Collect data

      Collect data

      Act on data

      Uptake

      Gather data on the proportion of employees eligible for each option who are using the option.

      If an option is tracking positively:

      • Maintain or expand the program to more of the organization.
      • Conduct a feasibility assessment (Step 2) for new employee segments.

      Satisfaction

      Survey managers and employees about their satisfaction with the options they are eligible for and provide an open box for suggestions on improvements.

      If an option is tracking negatively:

      • Investigate why. Gather additional data, interview organizational leaders, and/or conduct focus groups to gain deeper insight.
      • Re-assess the feasibility of the option (Step 2). If the costs outweigh the benefits based on new data, determine whether to cancel the option.
      • Take appropriate action based on the outcome of the evaluation, such as modifying or cancelling the option or providing employees with more support.
        • Note: Cancelling an option can impact the engagement of employees using the option. Ensure that the data, reasons for cancelling the option, and potential substitute options are communicated to employees in advance.

      Program goal progress

      Monitor progress against the program goals and metrics identified in Step 1 to evaluate the impact on issues that matter to the organization (e.g. retention, productivity, diversity).

      Career progression

      Evaluate flexible workers' promotion rates and development opportunities to determine if they are developing.

      Info-Tech Insight

      Negative performance of a flexible work option does not necessarily mean failure. Take the time to evaluate whether the option simply needs to be tweaked or whether it truly isn't working for the organization.

      Insight summary

      Overarching insight: IT excels at hybrid location work and is more effective as a business function when location, time, and time-off flexibility are an option for its employees.

      Introduction

      • Flexible work options are not a concession to lower productivity. Properly implemented, flex work enables employees to be more productive at reaching business goals.
      • Employees' lived experiences and needs determine if people use flexible work programs – a flex program that has limited use or excludes people will not benefit the organization.
      • Flexible work benefits everyone. IT employees experience greater engagement, motivation, and company loyalty. IT organizations realize benefits such as better service coverage, reduced facilities costs, and increased productivity.

      Step 1 insight

      • Hybrid work is a start. A comprehensive flex work program extends beyond flexible location to flexible time and time off. Organizations must understand the needs of unique employee groups to uncover the options that will attract and retain talent. Provide greater inclusivity to employees by broadening the scope to include flex location, flex time, and flex time off.
      • No two employee segments are the same. To be effective, flexible work options must align with the expectations and working processes of each segment.

      Step 2 insight

      • Every role is eligible for hybrid location work. If onsite work duties prevent an employee group from participating, see if processes can be digitized or automated. Flexible work is an opportunity to go beyond current needs to future proofing your organization.
      • Flexible work options must balance organizational and employee needs. If an option is beneficial to employees but there is little or no benefit to the organization, or if the cost of the option is too high, it will not support the long-term success of the organization.
      • Prioritize flexible work options that employees want. Providing too many options often leads to information overload and results in employees not understanding what is available, lowering adoption of the flexible work program.

      Step 3 insight

      • Leaders' collective support of the flexible program determines the program's successful adoption. Don't sweep cultural barriers under the rug; acknowledge and address them to overcome them.
      • Negative performance of a flexible work option does not necessarily mean failure. Take the time to evaluate whether the option simply needs to be tweaked or whether it truly isn't working for the organization.
      • A set of formal guidelines for IT ensures flexible work is:
        1. Administered fairly across all IT employees.
        2. Defensible and clear.
        3. Scalable to the rest of the organization.

      Research Contributors and Experts

      Quinn Ross
      CEO
      The Ross Firm Professional Corporation

      Margaret Yap
      HR Professor
      Ryerson University

      Heather Payne
      CEO
      Juno College

      Lee Nguyen
      HR Specialist
      City of Austin

      Stacey Spruell
      Division HR Director
      Travis County

      Don MacLeod
      Chief Administrative Officer
      Zorra Township

      Stephen Childs
      CHRO
      Panasonic North America

      Shawn Gibson
      Sr. Director
      Info Tech Research Group

      Mari Ryan
      CEO/Founder
      Advancing Wellness

      Sophie Wade
      Founder
      Flexcel Networks

      Kim Velluso
      VP Human Resources
      Siemens Canada

      Lilian De Menezes
      Professor of Decision Sciences
      Cass Business School, University of London

      Judi Casey
      WorkLife Consultant and former Director, Work and Family Researchers Network
      Boston College

      Chris Frame
      Partner – Operations
      LiveCA

      Rose M. Stanley, CCP, CBP, WLCP, CEBS
      People Services Manager
      Sunstate Equipment Co., LLC

      Shari Lava
      Director, Vendor Research
      Info-Tech Research Group

      Carol Cochran
      Director of People & Culture
      FlexJobs

      Kidde Kelly
      OD Practitioner

      Dr. David Chalmers
      Adjunct Professor
      Ted Rogers School of Management, Ryerson University

      Kashmira Nagarwala
      Change Manager
      Siemens Canada

      Dr. Isik U. Zeytinoglu
      Professor of Management and Industrial Relations McMaster University, DeGroote School of Business

      Claire McCartney
      Diversity & Inclusion Advisor
      CIPD

      Teresa Hopke
      SVP of Client Relations
      Life Meets Work – www.lifemeetswork.com

      Mark Tippey
      IT Leader and Experienced Teleworker

      Dr. Kenneth Matos
      Senior Director of Research
      Families and Work Institute

      1 anonymous contributor

      Appendix I: Sample focus group questions

      See Info-Tech's Focus Group Guidefor guidance on setting up and delivering focus groups. Customize the guide with questions specific to flexible work (see sample questions below) to gain deeper insight into employee preferences for the feasibility assessment in Step 2 of this blueprint.

      Document themes in the Targeted Flexible Work Program Workbook.

      • What do you need to balance/integrate your work with your personal life?
      • What challenges do you face in achieving work-life balance/integration?
      • What about your job is preventing you from achieving work-life balance/integration?
      • How would [flexible work option] help you achieve work-life balance/integration?
      • How well would this option work with the workflow of your team or department? What would need to change?
      • What challenges do you see in adopting [flexible work option]?
      • What else would be helpful for you to achieve work-life balance/integration?
      • How could we customize [flexible work option] to ensure it meets your needs?
      • If this program were to fail, what do you think would be the top reasons and why?

      Appendix II: Communication key messaging

      1. Program purpose

      Start with the name and high-level purpose of the program.

      2. Business reasons for the program

      Share data you gathered in Step 1, illustrating challenges causing the need for the program and the benefits.

      3. Options selection process

      Outline the process followed to select options. Remember to share the involvement of stakeholders and the planning around employees' feedback, needs, and lived experiences.

      4. Options and eligibility

      Provide a brief overview of the options and eligibility. Specify that the organization is piloting these options and will modify them based on feedback.

      5. Approval not guaranteed

      Qualify that employees need to be "flexible about flexible work" – the options are not guaranteed and may sometimes be unavailable for business reasons.

      6. Shared responsibility

      Highlight the importance of everyone (managers, flexible workers, the team) working together to make flexible work achievable.

      7. Next steps

      Share any next steps, such as where employees can find the organization's Guide to Flexible Work for Managers and Employees, how to make flexible work a success, or if managers will be providing further detail in a team meeting.

      8. Ongoing communications

      Normalize the program and embed it in organizational culture by continuing communications through various media, such as the organization's newsletter or announcements in town halls.

      Works Cited

      Baziuk, Jennifer, and Duncan Meadows. "Global Employee Survey - Key findings and implications for ICMIF." EY, June 2021. Accessed May 2022.
      "Businesses suffering 'commitment issues' on flexible working," EY, 21 Sep. 2021. Accessed May 2022.
      "IT Talent Trends 2022". Info-Tech Research Group, 2022.
      "Jabra Hybrid Ways of Working: 2021 Global Report." Jabra, Aug. 2021. Accessed May 2022.
      LinkedIn Talent Solutions. "2022 Global Talent Trends." LinkedIn, 2022. Accessed May 2022.
      Lobosco, Mark. "The Future of Work is Flexible: 71% of Leaders Feel Pressure to Change Working Models." LinkedIn, 9 Sep. 2021. Accessed May 2022.
      Ohm, Joy, et al. "Covid-19: Women, Equity, and Inclusion in the Future of Work." Catalyst, 28 May 2020. Accessed May 2022.
      Pelta, Rachel. "Many Workers Have Quit or Plan to After Employers Revoke Remote Work." FlexJobs, 2021. Accessed May 2022.
      Slack Future Forum. "Inflexible return-to-office policies are hammering employee experience scores." Slack, 19 April 2022. Accessed May 2022.
      "State of Hybrid Work in IT: A Trend Report". Info-Tech Research Group, 2023.
      Threlkeld, Kristy. "Employee Burnout Report: COVID-19's Impact and 3 Strategies to Curb It." Indeed, 11 March 2021. Accessed March 2022.

      Build Effective Enterprise Integration on the Back of Business Process

      • Buy Link or Shortcode: {j2store}360|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Enterprise Integration
      • Parent Category Link: /enterprise-integration
      • Organizations undergoing growth, either organically or through M&A, tend to develop integration capabilities in a piecemeal and short-sighted fashion to preserve their view of agility.
      • Integration strategies that are focused solely on technological solutions are likely to complicate rather than simplify, as not enough consideration is given to how other systems and processes will be impacted.

      Our Advice

      Critical Insight

      • Define a path for your EI strategy. Establish the more pressing goal of enterprise integration: improving operational integrity or adding business intelligence/predictive analytics capability.
      • Combine multiple views of integration for a comprehensive EI strategy. Assess business process, applications, and data in tandem to understand where enterprise integration will fit in your organization.
      • Don’t start by boiling the ocean and get bogged down in mapping out the entire organization. For the purposes of the strategy, narrow your focus to a set of related high-value processes to identify ways to improve integration.

      Impact and Result

      • Begin your enterprise strategy formation by identifying if your organization places emphasis on enabling operational excellence or predictive modeling/analytics.
      • Enterprise integration needs to bring together business process, applications, and data, in that order. Kick-start the process of identifying opportunities for improvement by creating business process maps that incorporate how applications and data are coordinated to support business activities.
      • Revisit the corporate drivers after integration mapping activities to identify the primary use cases for improvement.
      • Prepare for the next steps of carrying out the strategy by reviewing a variety of solution options.
      • Develop a compelling business case by consolidating the outputs of your mapping activities, establishing metrics for a specific process (or set of processes), and quantifying the benefits.

      Build Effective Enterprise Integration on the Back of Business Process Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should create an enterprise integration strategy; review Info-Tech’s methodology that encompasses business process, applications, and data; and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Position enterprise integration within the organization

      Begin strategy development by assigning roles and responsibilities for the team and establishing the initial direction for the strategy.

      • Build Effective Enterprise Integration on the Back of Business Process – Phase 1: Position Enterprise Integration Within Your Organization
      • Chief Enterprise Integration Officer
      • Enterprise Integration Strategy Drivers Assessment

      2. Explore the lenses of enterprise integration

      Create business process maps that incorporate how applications and data are coordinated to support business activities.

      • Build Effective Enterprise Integration on the Back of Business Process – Phase 2: Explore the Lenses of Enterprise Integration
      • Enterprise Integration Process Mapping Tool

      3. Develop the enterprise integration strategy

      Review your integration map to identify improvement opportunities, explore integration solutions, and consolidate activity outputs into a strategy presentation.

      • Build Effective Enterprise Integration on the Back of Business Process – Phase 3: Develop the Enterprise Integration Strategy
      • Enterprise Integration Strategy Presentation Template
      [infographic]

      Workshop: Build Effective Enterprise Integration on the Back of Business Process

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Position Enterprise Integration

      The Purpose

      Discuss the general approach for creating a holistic enterprise integration strategy.

      Define the initial direction and drivers.

      Key Benefits Achieved

      Strategy development team with responsibilities identified.

      Clear initial direction for the strategy based on senior stakeholder input.

      Activities

      1.1 Define the driving statements for your EI strategy.

      1.2 Develop a RACI chart.

      1.3 Discuss the current state of enterprise integration.

      1.4 Establish the initial direction of your strategy by surveying senior stakeholders.

      Outputs

      Vision, mission, and values for enterprise integration

      RACI chart for strategy development

      Documentation of past integration projects

      Chief Enterprise Integration Officer job description template

      2 Explore the Lenses of Enterprise Integration

      The Purpose

      Build a comprehensive map of what integration looks like for your target business processes.

      Key Benefits Achieved

      Clear documentation of the integration environment, encompassing process, data, and applications.

      Activities

      2.1 Develop level-0 and level-1 business capability diagrams.

      2.2 Identify the business processes of focus, based on relevance to overall corporate drivers.

      2.3 Complete process flow diagrams.

      2.4 Begin identifying the applications that are involved in each step of your process.

      2.5 Detail the connections/interactions between the applications in your business processes.

      2.6 Draw a current state diagram for application integration.

      2.7 Identify the data elements created, used, and stored throughout the processes, as well as systems of record.

      Outputs

      Business capability maps

      Business process flow diagrams

      Current state integration diagram

      Completed integration map

      3 Develop the Enterprise Integration Strategy

      The Purpose

      Review the outputs of the integration mapping activities.

      Educate strategy team on the potential integration solutions.

      Consolidate the findings of the activities into a compelling strategy presentation.

      Key Benefits Achieved

      Integration improvement opportunities are identified.

      Direction and drivers for enterprise integration are finalized.

      Understanding of the benefits and limitations of some integration solutions.

      Activities

      3.1 Discuss the observations/challenges and opportunities for improvement.

      3.2 Refine the focus of the strategy by conducting a more detailed stakeholder survey.

      3.3 Review the most common integration solutions for process, applications, and data.

      3.4 Create a future state integration architecture diagram.

      3.5 Define the IT and business critical success factors for EI.

      3.6 Articulate the risks with pursuing (and not pursuing) an EI strategy.

      3.7 Quantify the monetary benefits of the EI strategy.

      3.8 Discuss best practices for presenting the strategy and organize the presentation content.

      Outputs

      Critical success factors and risks for enterprise integration

      Monetary benefits of enterprise integration

      Completed enterprise integration strategy presentation

      Enterprise Storage Solution Considerations

      • Buy Link or Shortcode: {j2store}507|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Storage & Backup Optimization
      • Parent Category Link: /storage-and-backup-optimization
      • Enterprise storage technology and options are challenging to understand.
      • There are so many options. How do you decide what the best solution is for your storage challenge??
      • Where do you start when trying to solve your enterprise storage challenge?

      Our Advice

      Critical Insight

      Take the time to understand the various data storage formats, disk types, and associated technology, as well as the cloud-based and on-premises options. This will help you select the right tool for your needs.

      Impact and Result

      Look to existing use cases based on actual Info-Tech analyst calls to help in your decision-making process.

      Enterprise Storage Solution Considerations Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Enterprise Storage Solution Considerations – Narrow your focus with the right product type and realize efficiencies.

      Explore the building blocks of enterprise storage so you can select the best solution, narrow your focus with the correct product type, explore the features that should be considered when evaluating enterprise storage offerings, and examine use cases based on actual Info-Tech analyst calls to find a storage solution for your situation.

      • Enterprise Storage Solution Considerations Storyboard

      2. Modernize Enterprise Storage Workbook – Understand your data requirements.

      The first step in solving your enterprise storage challenge is identifying your data sources, data volumes, and growth rates. This information will give you insight into what data sources could be stored on premises or in the cloud, how much storage you will require for the coming five to ten years, and what to consider when exploring enterprise storage solutions. This tool can be a valuable asset for determining your current storage drivers and future storage needs, structuring a plan for future storage purchases, and determining timelines and total cost of ownership.

      • Modernize Enterprise Storage Workbook
      [infographic]

      Further reading

      Enterprise Storage Solution Considerations

      Narrow your focus with the right product type and realize efficiencies.

      Analyst Perspective

      The vendor landscape is continually evolving, as are the solutions they offer. The options and features are increasing and appealing.

      The image contains a picture of P.J. Ryan.

      To say that the current enterprise storage landscape looks interesting would be an understatement. The solutions offered by vendors continue to grow and evolve. Flash and NVMe are increasing the speed of storage media and reducing latency. Software-defined storage is finding the most efficient use of media to store data where it is best served while managing a variety of vendor storage and older storage area networks and network-attached storage devices.

      Storage as a service is taking on a new meaning with creative solutions that let you keep the storage appliance on premises or in a colocated data center while administration, management, and support are performed by the vendor for a nominal monthly fee.

      We cannot discuss enterprise storage without mentioning the cloud. Bring a thermometer because you must understand the difference between hot, warm, and cold storage when discussing the cloud options. Very hot and very cold may also come into play.

      Storage hardware can assume a higher total cost of ownership with support options that replace the controllers on a regular basis. The options with this type of service are also varied, but the concept of not having to replace all disks and chassis nor go through a data migration is very appealing to many companies.

      The cloud is growing in popularity when it comes to enterprise storage, but on-premises solutions are still in demand, and whether you choose cloud or on premises, you can be guaranteed an array of features and options to add stability, security, and efficiency to your enterprise storage.

      P.J. Ryan
      Research Director, Infrastructure & Operations
      Info-Tech Research Group

      Executive Summary

      Info-Tech Insight

      The vendor landscape is continually evolving, as are the solutions they offer.

      Storage providers are getting acquired by bigger players, “outside the box” thinking is disrupting the storage support marketplace, “as a service” storage offerings are evolving, and what is a data lake and do I need one? The traditional storage vendors are not alone in the market, and the solutions they offer are no longer traditional either. Explore the landscape and understand your options before you make any enterprise storage solution purchases.

      Understand the building blocks of storage so you can select the best solution.

      There are multiple storage formats for data, along with multiple hardware form factors and disk types to hold those various data formats. Software plays a significant role in many of these storage solutions, and cloud offerings take advantage of all the various formats, form factors, and disks. The challenge is matching your data type with the correct storage format and solution.

      Look to existing use cases to help in your decision-making process.

      Explore previous experiences from others by reading use cases to determine what the best solution is for your challenge. You’re probably not the first to encounter the challenge you’re facing. Another organization may have previously reached out for assistance and found a viable solution that may be just what you also need.

      Enterprise storage has evolved, with more options than ever

      Data is growing, data security will always be a concern, and vendors are providing more and more options for enterprise storage.

      “By 2025, it’s estimated that 463 exabytes of data will be created each day globally – that’s the equivalent of 212,765,957 DVDs per day!” (Visual Capitalist)

      “Modern criminal groups target not only endpoints and servers, but also central storage systems and their backup infrastructure.” (Continuity Software)

      Cloud or on premises? Maybe a hybrid approach with both cloud and on premises is best for you. Do you want to remove the headaches of storage administration, management, and support with a fully managed storage-as-a-service solution? Would you like to upgrade your controllers every three or four years without a major service interruption? The options are increasing and appealing.

      High-Level Considerations

      1. Understand Your Data

      Understand how much data you have and where it is located. This will be crucial when evaluating enterprise storage solutions.

      2. Plan for Growth

      Your enterprise storage considerations should include your data needs now and in the future.

      3. Understand the Mechanics

      Take the time to understand the various data storage formats, disk types, and associated technology, as well as the cloud-based and on-premises options. This will help you select the right tool for your needs.

      Storage formats, disk drives, and technology

      Common data storage formats, technology, and drive types are outlined below. Understanding how data is stored as well as the core building blocks for larger systems will help you decide which solution is best for your storage needs.

      Format

      What it is

      Disk Drives and Technology

      File Storage

      File storage is hierarchical storage that uses files, folders, subfolders, and directories. You enter a specific filename and path to access the file, such as P:\users\johndoe\strategy\cloud.doc. If you ever saved a file on a server, you used file storage. File storage is usually managed by some type of file manager, such as File Explorer in Windows. Network-attached storage (NAS) devices use file storage.

      Hard Disk Drives (HDD)

      HDD use a platter of spinning disks to magnetically store data. The disks are thick enough to make them rigid and are referred to as hard disks.

      HDD is older technology but is still in demand and offered by vendors.

      Object Storage

      Object storage is when data is broken into distinct units, called objects. These objects are stored in a flat, non-hierarchical structure in a single location or repository. Each object is identified by its associated ID and metadata. Objects are accessed by an application programming interface (API).

      Flash

      Flash storage uses flash memory chips to store data. The flash memory chips are written with electricity and contain no moving parts. Flash storage is very fast, which is how the technology got its name (“Flash vs. SSD Storage,” Enterprise Storage Forum, 2018).

      Block Storage

      Block storage is when data is divided up into fixed-size blocks and stored with a unique identifier. Blocks can be stored in different environments, such as Windows or Linux. Storage area networks (SANs) use block storage.

      Solid-State Drive (SSD)

      SSD is a storage mechanism that also does not use any moving parts. Most SSD drives use flash storage, but other options are available for SSD.

      Nonvolatile Memory Express (NVMe)

      NVMe is a communications standard developed specially for SSDs by a consortium of vendors including Intel, Samsung, SanDisk, Dell, and Seagate. It operates across the PCIe bus (hence the “Express” in the name), which allows the drives to act more like the fast memory that they are rather than the hard disks they imitate (PCWorld).

      Narrow your focus with the right product type

      On-premises enterprise storage solutions fit into a few distinct product types.

      Network-Attached Storage

      Storage Area Network

      Software-Defined Storage

      Hyperconverged Infrastructure

      NAS refers to a storage device that is connected directly to your network. Any user or device with access to your network can access the available storage provided by the NAS. NAS storage is easily scalable and can add data redundancy through RAID technology. NAS uses the file storage format.

      NAS storage may or may not be the first choice in terms of enterprise storage, but it does have a solid market appeal as an on-premises primary backup storage solution.

      A SAN is a dedicated network of pooled storage devices. The dedicated network, separate from the regular network, provides high speed and scalability without concern for the regular network traffic. SANs use block storage format and can be divided into logical units that can be shared between servers or segregated from other servers. SANs can be accessed by multiple servers and systems at the same time. SANs are scalable and offer high availability and redundancy through RAID technology.

      SANs can use a variety of disk types and sizes and are quite common among on-premises storage solutions.

      “Software-defined storage (SDS) is a storage architecture that separates storage software from its hardware. Unlike traditional network-attached storage (NAS) or storage area network (SAN) systems, SDS is generally designed to perform on any industry-standard or x86 system, removing the software’s dependence on proprietary hardware.” (RedHat)

      SDS uses software-based policies and rules to grow and protect storage attached to applications.

      SDS allows you to use server-based storage products to add management, protection, and better usage.

      Hyperconverged storage uses virtualization and software-defined storage to combine the storage, compute, and network resources along with a hypervisor into one appliance.

      Hyperconverged storage can scale out by adding more nodes or appliances, but scaling up, or adding more resources to each appliance, can have limitations. There is flexibility as hyperconverged storage can work with most network and compute manufacturers.

      Cloud storage

      • Cloud storage is online storage offered by a cloud provider. Cloud storage is available almost anywhere and is set up with high availability features such as data duplication, redundancy, backup, and power failure protection.
      • Cloud storage is very scalable and typically is offered as object storage, block storage, or file storage. Cloud storage vendors may have their own naming scheme for object, block, or file storage.
      • Cloud-hosted data is marketed according to the frequency of access and length of time in storage. There are typically three main levels of storage: hot, warm, or cold. Vendors may have their own naming convention for hot, warm, and cold storage. Some may also add more layers such as very hot or very cold.
        • Hot storage is for data that is frequently accessed and modified. It is available on demand and is the most costly of the storage levels.
        • Cold storage is for data that will sit for a long period of time and not need to be accessed. Cold storage is usually only available after several hours or days. Cold storage is very low cost and, in some cases, even free, but retrieval or restoration for the free services can be costly.
        • Warm storage sits in between hot and cold storage. It is for data that is infrequently needed. The cost of warm storage is also in between hot and cold storage costs, and access times are measured in terms of minutes or hours.
        • It is not uncommon for data to start in hot storage and, as it ages, move to warm and eventually cold storage.

      “Enterprise cloud storage offers nearly unlimited scalability. Enterprises can add storage quickly and easily as it is needed, eliminating the risk and cost of over-provisioning.”

      – Spectrum Enterprise

      “Hot data will operate on fresh data. Cold data will operate on less frequent data and [is] used mainly for reporting and planning. Warm data is a balance between the two.”

      – TechBlost

      Enterprise storage features

      The features listed below, while not intended to cover all features offered by all vendors, should be considered and could act as a baseline for discussions with storage providers when evaluating enterprise storage offerings.

      • Scalability
        • What are the options to expand, and how easy or difficult it is to expand capacity in the future?
      • Security
        • Does the solution offer data encryption options as well as ransomware protections?
      • Integration options
        • Can the solution support seamless connectivity with other solutions and applications, such as cloud-based storage or backup software?
      • Storage reduction
        • Does the solution offer space-reduction options such as deduplication or data compression?
      • Replication
        • Does the solution offer replication options such as device to device on premises, device to device when geographically separated, device to cloud, or a combination of these scenarios?
      • Performance
        • “Enterprise storage systems have two main ‘speed’ measurements: throughput and IOPS. Throughput is the data transfer rate to and from storage media, measured in bytes per second; IOPS measures the number of reads and writes – input/output (I/O) operations – per second.” (Computer Weekly)
      • Protocol support
        • Does the solution support object-based, block-based, and file-based storage protocols?
      • Storage Efficiency
        • How efficient is the solution? Can they prove it?
        • Storage efficiencies must be available and baselined.
      • Management platform
        • A management/reporting platform should be a component included in the system.
      • Multi-parity
        • Does the solution offer multi-level block “parity” for RAID 6 protection equivalency, which would allow for the simultaneous failure of two disks?
      • Proactive support
        • Features such as call home, dial in, or remote support must be available on the system.
      • Financial considerations
        • The cost is always a concern, but are there subscription-based or “as-a-service” options?
        • Internally, is it better for this expenditure to be a capital expenditure or an ongoing operating expense?

      What’s new in enterprise storage

      • Data warehouses are not a new concept, but the data storage evolution and growth of data means that data lakes and data lakehouses are growing in popularity.
        • “A data lake is a centralized repository that allows you to store all your structured and unstructured data at any scale. You can store your data as-is, without having to first structure the data” (Amazon Web Services).
        • Analytics with a data lake is possible, but manipulation of the data is hindered due to the nature of the data. A data lakehouse adds data management and analytics to a data lake, similar to the data warehouse functionality added to databases.
      • Options for on-premises hardware support is changing.
        • Pure Storage was the first to shake up the SAN support model with its Evergreen support option. Evergreen//Forever support allows for storage controller upgrades without having to migrate data or replace your disks or chassis (Pure Storage).
        • In response to the Pure Storage Evergreen offering, Dell, HPE, NetApp, and others have come out with similar programs that offer controller upgrades while maintaining the data, disks, and chassis.
      • “As a service” is available as a hybrid solution.
        • Storage as a service (STaaS) originally referred to hosted, fully cloud-based offerings without the need for any on-premises hardware.
        • The latest STaaS offerings provide on-premises or colocated hardware with pay-as-you-go subscription pricing for data consumption. Administration, management, and support are included. The vendor will supply support and manage everything on your behalf.
        • Most of the major storage vendors offer a variation of storage as a service.

      “Because data lakes mostly consist of raw unprocessed data, a data scientist with specialized expertise is typically needed to manipulate and translate the data.”

      – DevIQ

      “A Lakehouse is also a type of centralized data repository, integrated from heterogeneous sources. As can be expected from its name, It shares features with both datawarehouses and data lakes.”

      – Cesare

      “Storage as a service (STaaS) eliminates Capex, simplifies management and offers extensive flexibility.”

      – TechTarget

      Major vendors

      The current vendor landscape for enterprise storage solutions represents a range of industry veterans and the brands they’ve aggregated along the way, as well as some relative newcomers who have come to the forefront within the past ten years.

      Vendors like Dell EMC and HPE are longstanding veterans of storage appliances with established offerings and a back catalogue of acquisitions fueling their growth. Others such as Pure Storage offer creative solutions like all-flash arrays, which are becoming more and more appealing as flash storage becomes more commoditized.

      Cloud-based vendors have become popular options in recent years. Cloud storage provides many options and has attracted many other vendors to provide a cloud option in addition to their on-premises solutions. Some software and hardware vendors also partner with cloud vendors to offer a complete solution that includes storage.

      Info-Tech Insight

      Explore your current vendor’s solutions as a starting point, then use that understanding as a reference point to dive into other players in the market

      Key Players

      • Amazon
      • Cisco
      • Dell EMC
      • Google
      • Hewlett Packard Enterprise
      • Hitachi Vantara
      • IBM
      • Microsoft
      • NetApp
      • Nutanix
      • Pure Storage

      Enterprise Storage Use Cases

      Block, object, or file storage? NAS, SAN, SDS, or HCI? Cloud or on prem? Hot, warm, or cold?
      Which one do you choose?
      The following use cases based on actual Info-Tech analyst calls may help you decide.

      1. Offsite backup solution
      2. Infrastructure consolidation
      3. DR/BCP datacenter duplication
      4. Expansion of existing storage
      5. Complete backup solution
      6. Existing storage solution going out of support soon
      7. Video storage
      8. Classify and offload storage

      Offsite backup solution

      “Offsite” may make you think of geographical separation or even cloud-based storage, but what is the best option and why?

      Use Case: How a manufacturing company dealt with retired applications

      • A leading manufacturing company had to preserve older applications no longer in use.
      • The company had completed several acquisitions and ended up with multiple legacy applications that had been merged or migrated into replacement solutions. These legacy applications were very important to the original companies, and although the data they held had been migrated to a replacement solution, executives felt they should hold on to these applications for a period of time, just in case.
      • A modern archiving solution was considered, but a research advisor from Info-Tech Research joined a call with the manufacturing company and helped the client realize that the solution was a modified backup. The application data had already been preserved through the migration, so data could be accessed in the production environment.
      • The data could be exported from the legacy application into a nonsequential database, compressed, and stored in cloud-based cold storage for less than $5 per terabyte per month. The manufacturing company staff realized that they could apply this same approach to several of their legacy applications and save tens of thousands of dollars in the process.
      • Cold storage is inexpensive until you start retrieving that data frequently. The manufacturing company knew they did not have a requirement to retrieve the application and data for a very long time, so cloud-based cold storage was ideal.

      “Data retrieval from cold storage is harder and slower than it is from hot storage. … Because of the longer retrieval time, online cold storage plans are often much cheaper. … The downside is that you’d incur additional costs when retrieving the data.”

      – Ben Stockton, Cloudwards

      Infrastructure consolidation

      Hyperconverged infrastructure combines storage, virtual infrastructure, and associated management into one piece of equipment.

      Use Case: How one company dealt with equipment and storage needs

      • One Info-Tech client had recently started in the role of IT director and realized he had inherited aging infrastructure along with a serious data challenge. The storage appliances were old and out of support. The appliances were performing inadequately, and the client was in need of more data due to ongoing growth, but he also realized that the virtual environment was running on very old servers that were no longer supported. The IT director reached out to Info-Tech to find solutions to the virtualization challenge, but the storage problem also came up throughout the course of the conversation with an analyst.
      • The analyst quickly realized that the IT director was an ideal candidate for a hyperconverged infrastructure (HCI) storage solution, which would also provide the necessary virtual environment.
      • The analyst explained the benefits of having a single appliance that would provide virtualization needs as well as storage needs. The built-in management features would ease the burden of administration, and the software-defined nature of the HCI would allow for the migration of data as well as future expansion options.
      • Hyperconverged infrastructure is offered by many vendors under a variety of names. Most are similar but some may have a better interface or other features. The expansion process is simple, and HCI is a good fit for many organizations looking to consolidate virtual infrastructure and storage.

      “HCI environments use a hypervisor, usually running on a server that uses direct-attached storage (DAS), to create a data center pool of systems and resources.”

      – Samuel Greengard, Datamation

      Datacenter duplication

      SAN providers offer a varied range of options for their products, and those options are constantly evolving.

      Use Case: Independent school district provides better data access using SAN technology

      • An independent school district was expanding by adding a second data center in a new school. This new data center would be approximately 20 miles away from the original data center used by the district. The intent was not to replace the original data center but to use both centers to store data and provide services concurrently. The district’s ideal scenario would be that users would not know or care which data center they were reaching, and there would be no difference in the service received from each data center. The school district reached out to Info-Tech when planning discussions reached the topic of data duplication and replication software.
      • An Info-Tech analyst joined a call with the school district and guided the conversation toward the existing environment to understand what options might be available. The analyst quickly discovered that all the district’s servers were virtual, and all associated data was stored on a single SAN.
      • The analyst informed the school district staff about SAN options, including SAN-to-SAN replication. If the school district had a sufficient link between the two data centers, SAN-to-SAN replication would work for them and provide the two identical copies of data at two locations.
      • The analyst continued to offer explanations of other features that some vendors offer with their SANs, such as the ability to turn on or off deduplication and compression, as well as disk options such as flash or NVMe.
      • The school district was moving to the request for proposal (RFP) stage but hoped to have SAN-to-SAN replication implemented before the next academic year started.

      “SAN-to-SAN replication is a low-cost, highly efficient way to manage mounting quantities of stored data.”

      – Secure Infrastructure & Services

      Expansion of existing storage

      That old storage area network may still have some useful life left in it.

      Use Case: Municipality solves data storage aging and growth challenge

      • A municipality in the United States reached out to Info-Tech for guidance on its storage challenge. The municipality had accumulated multiple SANs from different vendors over the years. These SANs were running out of storage, and more data storage was needed. The municipality’s data was growing at a rapid pace, thanks to municipal growth and expansion of services. The IT team was also concerned with modernizing their storage and not hindering their long-term growth by making the wrong purchase decision for their current storage needs.
      • An analyst from Info-Tech discussed several options with the municipality but in the end advised that software-defined storage may be the best solution.
      • Software-defined storage (SDS) would allow the municipality to gain better visibility into existing storage while making more efficient use of existing and new storage. SDS could take over the management of the existing storage from multiple vendors and add additional storage as required. SDS would also be able to integrate cloud-based storage if that was the direction taken by the municipality in the future.
      • The municipality moved forward with an SDS solution and added some additional storage capacity. They used some of their existing SANs but retired the more troublesome ones. The SDS system managed all the storage instances and data management. The administration of the storage environment was easier for the storage admins, and long-term savings were achieved through better storage management.

      “Often enterprises have added storage on an ad hoc basis as they needed it for various applications. That can result in a mishmash of heterogenous storage hardware from a wide variety of vendors. SDS offers the ability to unify management of these different storage devices, allowing IT to be more efficient.”

      – Cynthia Harvey, Enterprise Storage Forum (“What Is Software Defined Storage?”, 2018)

      Complete backup solution

      Many backup software solutions can provide backups to multiple locations, making two-location backups simple.

      Use Case: How an oil refinery modernized its backup solution

      • A large oil refinery needed a better solution for the storage of backups. The refinery was replacing its backup software solution but also wanted to improve the backup storage situation and move away from tape-based storage. All other infrastructure was reasonably modern and not in need of replacement at this time.
      • A research analyst from Info-Tech helped the client realize that the solution was a modified backup. The general guidance for backups is have a least one copy offsite, so the cloud was the obvious focal point. The analyst also explained that it would be beneficial to have a recent copy of the backup available on site for common restoration requests in addition to having the offsite copy for disaster recovery (DR) purposes.
      • The refinery staff conducted a data analysis to determine how much data was being backed up on a daily basis. The solution proposed by the analyst included network-attached storage (NAS) with adequate storage to hold 30 days' worth of on-premises data. The backup software would also simultaneously copy each backup to a cloud-based storage repository. The backup software was smart enough to only back up and transfer data that had changed since the previous backup, so transfer time and capacity was not a factor.
      • The NAS would allow for the restoration of any local, on-premises data while the cloud storage would provide a safe location offsite for backup data. It could also serve as the backup location for other cloud-based services that required a backup.

      “Data protection demands that enterprises have multiple methods of keeping data safe and replicating it in case of disaster or loss.”

      – Drew Robb, Enterprise Storage Forum, 2021

      Storage going out of support

      SAN solutions have come a long way with improvements in how data is stored and what is used to store the data.

      Use Case: How one organization replaced its old storage with a similar solution

      • A government organization was looking for a solution for its aging storage area network appliances. The SANs were old and would be no longer supported by the manufacturer within four months. The SANs had slower spinning disks and their individual capacity was at its limit through the addition of extra shelves and disks over the years.
      • The organization reached out to Info-Tech for guidance. An analyst arranged a call with them, and they discussed the storage situation in detail, including desired benefits from a storage solution and growth requirements. They also discussed cloud storage, but the government organization was not in a position to move its data to the cloud for a variety of reasons.
      • Although the individual SANs were at their storage capacity limit, the total amount of data was well within the limits of many modern on-premises storage solutions. SSD and flash or NVMe storage can store large amounts of data in small footprints and form factors.
      • The analyst reviewed several vendors with the client and discussed some advantages and disadvantages of each. They explored the features offered as well as scalability options.
      • SANs have been around for a long time but the features and capabilities that come with them has evolved. They are still a very viable solution for many organizations in a variety of scenarios.

      “A rapidly growing portion of SAN deployments leverages all-flash storage to gain its high performance, consistent low latency, and lower total cost when compared to spinning disk.”

      – NetApp

      Video storage

      Cloud storage would not be sufficient if you were using a dial up connection, just as on-premises storage solutions would not suffice if they were using floppy disks.

      Use Case: Body cams and public cameras in municipalities are driving storage growth

      • Municipal law enforcement agencies are wearing body cameras more frequently, for their own protection as well as for the protection of the public. Camera footage can be useful in legal situations as well. Municipalities are also installing more and more public cameras for the purposes of public safety. The recorded video footage from these cameras can result in large data files, which in turn drive data storage requirements.
      • Info-Tech analysts are joining calls about video data storage with increasing frequency. The concerns are repetitive, and the guidance is similar on most of these calls.
      • The “object” storage format is ideal for video and media data. Most cloud-based storage solutions use object storage, but it is also available with on-premises solutions such as NAS or SAN. The challenges clients are expressing are typically related to inadequate bandwidth for cloud-based storage or other storage formats instead of “object” storage. Cloud-based storage can also grow beyond the budgeted numbers, causing an increase in the monthly cloud cost. Older, slower on-premises hardware sometimes reveals itself as the latency culprit.
      • Object storage is well suited for the unstructured data that is video footage. It uses metadata to tag the video file for future retrieval and is easily expandable, which also makes it cost effective.
      • Video data stored in a cloud-based repository will work fine as long as the bandwidth is adequate. On-premises storage of video data is also quite adequate on the right storage format, with fast disks and a reasonably up-to-date network infrastructure.

      “The captured video is stored for days, weeks, months and sometimes years and consumes a lot of space. Data storage plays a new and important role in these systems. Object storage is ideal to store the video data.”

      – Object-Storage.Info

      Classify and offload primary storage

      Some software products have storage options available as a result of agreements with other storage vendors. Several backup and archive software products fall into this category.

      Use Case: Enterprise storage can help reduce data sprawl

      • A large engineering firm was trying to manage its data sprawl. The team sampled a small percentage of their data and quickly realized that when they applied their findings on the 1% of data to their entire data estate, the sheer volume of personal files, older files, and unclassified data was going to be a challenge.
      • They found a solution in archiving software. The archiving software would tag data based on several factors. The software would move older files away from primary storage to an alternate storage platform but still leave a stub of the moved file in place and maintain limited access to those files. This would reduce primary storage requirements and allow the firm to eliminate multiple file servers
      • The engineering firm reached out to Info-Tech and participated in an analyst call. During that call, they laid out their plans, and the analyst made them aware of cloud storage. The positive and negative aspects of cloud storage were discussed, and the firm fully understood that the colder the storage tier, the slower the recovery. The firm's stance was if the files had not been accessed in the past six months, waiting a day or two for retrieval would not be a concern, and the firm was content with cold storage in the cloud.
      • The firm had not purchased the archiving software at the time of the analyst call, and the analyst also explained to them that the archiving software may have an existing agreement with a cloud provider for storage options, which could be more cost effective than purchasing cloud storage separately.
      • Cold cloud-based storage was the preferred solution for this firm, but this use case also highlights the option that some software products carry regarding storage. Several backup and archive products have a cloud storage option that should be investigated, as they may be cost-effective options.

      “Cold storage is perfect for archiving your data. Online backup providers offer low-cost, off-site data backups at the expense of fast speeds and easy access, even though data retrieval often comes at an added cost. If you need to keep your data long-term, but don’t need to access it often, this is the kind of storage you need.”

      – Ben Stockton, Cloudwards

      Understand your data requirements

      Activity

      The first step in solving your enterprise storage challenge is identifying your data sources or drivers, data volume size, and growth rates. This information will give you insight into what data sources could be stored on premises or in the cloud, how much storage you will require for the coming five to ten years, and what to consider when exploring enterprise storage solutions.

      • Info-Tech’s Modernize Enterprise Storage Workbook can be a valuable asset for determining your current storage drivers and future storage needs, structuring a plan for future storage purchases, and determining timelines and total cost of ownership.
      • An example of the Storage Capacity Calculator tab from that workbook is displayed on the right. Using the Storage Capacity Requirements Calculator requires minimal steps.
      1. Enter the current date and planning timeline (horizon) in months
      2. Identify the top sources of data within the business – the current data drivers. Areas of focus could include business applications, file shares, backup, and archives.
      3. For each of these data drivers, include your best estimate of:
      • Current data volume
      • Growth rate
    • Identify the top future data drivers, such as new applications or initiatives that will result from current business plans and priorities, and record the following details:
      • Initial data volumes
      • Projected growth rates
      • Planned implementation date
    • The spreadsheet will automatically calculate the data volume at the planning horizon based on the growth rate.
    • Download the Modernize Enterprise Storage Workbook and take the first step toward understanding your data requirements.

      The image contains a screenshot of the Modernize Enterprise Storage Workbook.

      Download the Modernize Enterprise Storage Workbook

      Related Info-Tech Research

      Modernize Enterprise Storage

      Current and emerging storage technologies are disrupting the status quo – prepare your infrastructure for the exponential rise in data and its storage requirements.

      Modernize Enterprise Storage Workbook

      This workbook will complement the discussions and activities found in the Modernize Enterprise Storage blueprint. Use this workbook in conjunction with the blueprint to develop a strategy for storage modernization.

      Bibliography

      Bakkianathan, Raghunathan. “What is the difference between Hot Warm and Cold data storage?” TechBlost, n.d.. Accessed 14 July 2022.
      Cesare. “Data warehouse vs Data lake vs Lakehouse… and DeltaLake?“ Medium, 14 June 2021. Accessed 26 July 2022.
      Davison, Shawn and Ryan Sappenfield. “Data Lake Vs Lakehouse Vs Data Mesh: The Evolution of Data Transformation.” DevIQ, May 2022. Accessed 23 July 2022.
      Desjardins, Jeff. “Infographic: How Much Data is Generated Each Day?” Visual Capitalist, 15 April 2019. Accessed 26 July 2022.
      Greengard, Samuel. “Top 10 Hyperconverged Infrastructure (HCI) Solutions.” Datamation, 22 December 2020. Accessed 23 July 2022.
      Harvey, Cynthia. “Flash vs. SSD Storage: Is there a Difference?” Enterprise Storage Forum, 10 July 2018. Accessed 23 July 2022.
      Harvey, Cynthia. “What Is Software Defined Storage? Features & Benefits.” Enterprise Storage Forum, 22 February 2018. Accessed 23 July 2022.
      Hecht, Gil. “4 Predictions for storage and backup security in 2022.” Continuity Software, 09 January 2022. Accessed 22 July 2022.
      Jacobi, Jonl. “NVMe SSDs: Everything you need to know about this insanely fast storage.” PCWorld, 10 March 2019. Accessed 22 July 2022
      Pritchard, Stephen. “Briefing: Cloud storage performance metrics.” Computer Weekly, 16 July 2021. Accessed 23 July 2022
      Robb, Drew. “Best Enterprise Backup Software & Solutions 2022.” Enterprise Storage Forum, 09 April 2021. Accessed 23 July 2022.
      Sheldon, Robert. “On-premises STaaS shifts storage buying to Opex model.” TechTarget, 10 August 2020. Accessed 22 July 2022.
      “Simplify Your Storage Ownership, Forever.” PureStorage. Accessed 20 July 2022.
      Stockton, Ben. “Hot Storage vs Cold Storage in 2022: Instant Access vs Long-Term Archives.” Cloudwards, 29 September 2021. Accessed 22 July 2022.
      “The Cost Savings of SAN-to-SAN Replication.” Secure Infrastructure and Services, 31 March 2016. Accessed 16 July 2022.
      “Video Surveillance.” Object-Storage.Info, 18 December 2019. Accessed 25 July 2022.
      “What is a Data Lake?” Amazon Web Services, n.d. Accessed 17 July 2022.
      “What is enterprise cloud storage?” Spectrum Enterprise, n.d. Accessed 28 July 2022.
      “What is SAN (Storage Area Network).” NetApp, n.d. Accessed 25 July 2022.
      “What is software-defined storage?” RedHat, 08 March 2018. Accessed 16 July 2022.

      Create a Horizontally Optimized SDLC to Better Meet Business Demands

      • Buy Link or Shortcode: {j2store}149|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Development
      • Parent Category Link: /development
      • While teams are used to optimizing their own respective areas of responsibility, there is lack of clarity on the overall core SDLC process resulting in applications being released that are of poor quality.
      • Software development teams are struggling to release on time and within budget.
      • Teams do not understand the overall process, are not communicating well, and traceability is hard to achieve.
      • Each team claims to be optimized yet the final deliverable doesn’t reflect the expected quality.

      Our Advice

      Critical Insight

      • Optimizing can make you worse. One cannot just optimize locally – the SDLC must be optimized in its entirety to ensure traceability across the process.
      • Separate process from framework.
        You don’t need to “Go Agile” or follow other industry jargon to effectively optimize your SDLC.
      • SDLC process improvement is ongoing.
        Start with your team’s current capabilities and optimize. You should set expectations that new improvements will always come in the future.

      Impact and Result

      • Use a systematic framework to bring out local optimizations as potential candidates for SDLC optimization.
      • Prioritize those candidates that will aid in optimizing the overall core SDLC process.
      • Create the necessary governance and control structures to sustain the changes.
      • Use Info-Tech tools and templates to accelerate your process optimization.

      Create a Horizontally Optimized SDLC to Better Meet Business Demands Research & Tools

      Start here – read the Executive Brief

      Read this Executive Brief to understand Info-Tech's approach to SDLC optimization and why the SDLC must be optimized in its entirety to ensure traceability across the process.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Document the current state of the SDLC

      This phase of the blueprint will help in understanding the organization's business priorities, documenting the current SDLC process, and identifing current SDLC challenges.

      • Create a Horizontally Optimized SDLC to Better Meet Business Demands – Phase 1: Document the Current State of the SDLC
      • SDLC Optimization Playbook

      2. Define root causes, determine optimization initiatives, and define target state

      This phase of the blueprint, will help with defining root causes, determining potential optimization initiatives, and defining the target state of the SDLC.

      • Create a Horizontally Optimized SDLC to Better Meet Business Demands – Phase 2: Define Root Causes, Determine Optimization Initiatives, and Define Target State

      3. Develop a rollout strategy for SDLC optimization

      This phase of the blueprint will help with prioritizing initiatives in order to develop a rollout strategy, roadmap, and communication plan for the SDLC optimization.

      • Create a Horizontally Optimized SDLC to Better Meet Business Demands – Phase 3: Develop a Rollout Strategy for SDLC Optimization
      • SDLC Communication Template
      [infographic]

      Workshop: Create a Horizontally Optimized SDLC to Better Meet Business Demands

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Document Your Current SDLC

      The Purpose

      Understand SDLC current state.

      Key Benefits Achieved

      Understanding of your current SDLC state and metrics to measure the success of your SDLC optimization initiative.

      Activities

      1.1 Document the key business objectives that your SDLC delivers upon.

      1.2 Document your current SDLC process using a SIPOC process map.

      1.3 Identify appropriate metrics in order to track the effectiveness of your SDLC optimization.

      1.4 Document the current state process flow of each SDLC phase.

      1.5 Document the control points and tools used within each phase.

      Outputs

      Documented business objectives

      Documented SIPOC process map

      Identified metrics to measure the effectiveness of your SDLC optimization

      Documented current state process flows of each SDLC phase

      Documented control points and tools used within each SDLC phase

      2 Assess Challenges and Define Root Causes

      The Purpose

      Understand current SDLC challenges and root causes.

      Key Benefits Achieved

      Understand the core areas of your SDLC that require optimization.

      Activities

      2.1 Identify the current challenges that exist within each SDLC phase.

      2.2 Determine the root cause of the challenges that exist within each SDLC phase.

      Outputs

      Identified current challenges

      Identified root causes of your SDLC challenges

      3 Determine Your SDLC Optimization Initiatives

      The Purpose

      Understand common best practices and the best possible optimization initiatives to help optimize your current SDLC.

      Key Benefits Achieved

      Understand the best ways to address your SDLC challenges.

      Activities

      3.1 Define optimization initiatives to address the challenges in each SDLC phase.

      Outputs

      Defined list of potential optimization initiatives to address SDLC challenges

      4 Define SDLC Target State

      The Purpose

      Define your SDLC target state while maintaining traceability across your overall SDLC process.

      Key Benefits Achieved

      Understand what will be required to reach your optimized SDLC.

      Activities

      4.1 Determine the target state of your SDLC.

      4.2 Determine the people, tools, and control points necessary to achieve your target state.

      4.3 Assess the traceability between phases to ensure a seamlessly optimized SDLC.

      Outputs

      Determined SDLC target state

      Identified people, processes, and tools necessary to achieve target state

      Completed traceability alignment map and prioritized list of initiatives

      5 Prioritize Initiatives and Develop Rollout Strategy

      The Purpose

      Define how you will reach your target state.

      Key Benefits Achieved

      Create a plan of action to achieve your desired target state.

      Activities

      5.1 Gain the full scope of effort required to implement your SDLC optimization initiatives.Gain the full scope of effort required to implement your SDLC optimization initiatives.

      5.2 Identify the enablers and blockers of your SDLC optimization.

      5.3 Define your SDLC optimization roadmap.

      5.4 Create a communication plan to share initiatives with the business.

      Outputs

      Level of effort required to implement your SDLC optimization initiatives

      Identified enablers and blockers of your SDLC optimization

      Defined optimization roadmap

      Completed communication plan to present your optimization strategy to stakeholders

      Craft a Customer-Driven Market Strategy With Unbiased Data

      • Buy Link or Shortcode: {j2store}611|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Selection & Implementation
      • Parent Category Link: /selection-and-implementation
      • Market strategies are informed by gut feel and endless brainstorming instead of market data to take their product from concept to customer.
      • Hiring independent market research firms results in a lack of unbiased third-party data. Research firms tell vendors what they want to hear instead of offering an agnostic view of software trends.
      • Dissatisfied customers don’t tell you directly why they are leaving, so there is no feedback loop back into product improvements.
      • Often a market strategy is built after a product is developed to force the product’s fit in the market. The product marketing team has no say in the product vision or future improvements.

      Our Advice

      Critical Insight

      • Adopt the 5 P’s to building a winning market strategy: Proposition, Product, Pricing, Placement, and Promotion.
      • You can’t be everything to everyone. Testing your proposition in the market to see what sticks is a risky move. Promise future value using past successes by gaining a deeper understanding of which customers and submarkets truly align to your product.
      • Customers have learned to avoid shiny new objects but still expect rapid feature releases. Differentiating features require a closer look at the underpinning vendor capabilities. Having intentional feature releases requires a feedback loop into the product roadmap and increases influence by the product marketing team.
      • Price transparency and sensitivity should drive what you offer to customers. Negotiating solely on price is a race to the bottom.

      Impact and Result

      • Leverage this report to gain insights on the software selection process and what top vendors do best.
      • Gain a bird’s-eye view on customer purchasing behavior using over 40,000 data points on satisfaction and importance collected directly from the source.
      • Build a winning market strategy influenced by real customer data that drives vendor success.

      Craft a Customer-Driven Market Strategy With Unbiased Data Research & Tools

      Read the storyboard

      Read our storyboard to find out why you should leverage SoftwareReviews data to craft your market strategy, review Info-Tech’s methodology, and understand unbiased customer data on software purchasing triggers.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Craft a Customer-Driven Market Strategy With Unbiased Data Storyboard
      [infographic]

      Agile Enterprise Architecture Operating Model

      • Buy Link or Shortcode: {j2store}581|cart{/j2store}
      • member rating overall impact: 9.6/10 Overall Impact
      • member rating average dollars saved: $31,106 Average $ Saved
      • member rating average days saved: 33 Average Days Saved
      • Parent Category Name: Strategy & Operating Model
      • Parent Category Link: /strategy-and-operating-model

      Establish an enterprise architecture practice that:

      • Leverages an operating model that promotes/supports agility within the organization.
      • Embraces business, data, application, and technology architectures in an optimal mix.
      • Is Agile in itself and will be sustainable and reactive to business needs, staying relevant and “profitable” – continuously delivering business value.

      Our Advice

      Critical Insight

      • Use your business and EA strategy and design principles to right-size standardized operating models to fit your EA organization’s needs.
      • You need to define a sound set of design principles before commencing with the design of your EA organization.
      • The EA operating model structure should be rigid but pliable enough to fit the needs of the stakeholders it provides services to.
      • A phased approach and a good communication strategy is key to the success of the new EA organization.
      • Start with one group and work out the hurdles before rolling it out organization-wide.
      • Make sure that you communicate regularly on wins but also on hurdles and how to overcome them.

      Impact and Result

      • The organization design approach proposed will aim to provide twofold agility: the ability to stretch and shrink depending on business requirements and the promotion of agility in architecture delivery.
      • By recognizing that agility comes in different flavors, organizations using more traditional design patterns will also benefit from the approach advocated by this blueprint.

      Agile Enterprise Architecture Operating Model Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out create an Agile EA operating model to execute the EA function, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Design your EA operating model

      You need to define a sound set of design principles before commencing with the design of your EA organization.

      • Agile EA Operating Model Communication Deck
      • Agile EA Operating Model Workbook
      • Business Architect
      • Application Architect
      • Data Architect
      • Enterprise Architect

      2. Define your EA organizational structure

      The EA operating model structure should be rigid but pliable enough to fit the needs of the stakeholders it provide services to.

      • EA Views Taxonomy
      • EA Operating Model Template
      • Architecture Board Charter Template
      • EA Policy Template
      • EA Compliance Waiver Form Template

      3. Implement the EA operating model

      A phased approach and a good communications strategy are key to the success of the new EA organization.

      • EA Roadmap
      • EA Communication Plan Template
      [infographic]

      Workshop: Agile Enterprise Architecture Operating Model

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 EA Function Design

      The Purpose

      Identify how EA looks within the organization and ensure all the necessary skills are accounted for within the function.

      Key Benefits Achieved

      EA is designed to be the most appropriately placed and structured for the organization.

      Activities

      1.1 Place the EA department.

      1.2 Define roles for each team member.

      1.3 Find internal and external talent.

      1.4 Create job descriptions with required proficiencies.

      Outputs

      EA organization design

      Role-based skills and competencies

      Talent acquisition strategy

      Job descriptions

      2 EA Engagement Model

      The Purpose

      Create a thorough engagement model to interact with stakeholders.

      Key Benefits Achieved

      An understanding of each process within the engagement model.

      Create stakeholder interaction cards to plan your conversations.

      Activities

      2.1 Define each engagement process for your organization.

      2.2 Document stakeholder interactions.

      Outputs

      EA Operating Model Template

      EA Stakeholder Engagement Model Template

      3 EA Governance

      The Purpose

      Develop EA boards, alongside a charter and policies to effectively govern the function.

      Key Benefits Achieved

      Governance that aids the EA function instead of being a bureaucratic obstacle.

      Adherence to governace.

      Activities

      3.1 Outline the architecture review process.

      3.2 Position the architecture review board.

      3.3 Create a committee charter.

      3.4 Make effective governance policy.

      Outputs

      Architecture Board Charter Template

      EA Policy Template

      4 Architecture Development Framework

      The Purpose

      Create an operating model that is influenced by universal standards including TOGAF, Zachmans, and DoDAF.

      Key Benefits Achieved

      A thoroughly articulated development framework.

      Understanding of the views that influence each domain.

      Activities

      4.1 Tailor an architecture development framework to your organizational context.

      Outputs

      EA Operating Model Template

      Enterprise Architecture Views Taxonomy

      5 Operational Plan

      The Purpose

      Create a change management and communication plan or roadmap to execute the operating model.

      Key Benefits Achieved

      Build a plan that takes change management and communication into consideration to achieve the wanted benefits of an EA program.

      Effectively execute the roadmap.

      Activities

      5.1 Create a sponsorship action plan.

      5.2 Outline a communication plan.

      5.3 Execute a communication roadmap.

      Outputs

      Sponsorship Action Plan

      EA Communication Plan Template

      EA Roadmap

      Human Resources Management

      • Buy Link or Shortcode: {j2store}31|cart{/j2store}
      • Related Products: {j2store}31|crosssells{/j2store}
      • member rating overall impact: 9.6/10
      • member rating average dollars saved: $13,367
      • member rating average days saved: 7
      • Parent Category Name: people and Resources
      • Parent Category Link: /people-and-resources
      Talent is the differentiator; availability is not.

      Establish a Sustainable ESG Reporting Program

      • Buy Link or Shortcode: {j2store}194|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: IT Governance, Risk & Compliance
      • Parent Category Link: /it-governance-risk-and-compliance

      Consistent, high-quality disclosure of ESG practices is the means by which organizations can demonstrate they are acting responsibly and in the best interest of their customers and society. Organizations may struggle with these challenges when implementing an ESG reporting program:

      • Narrowing down ESG efforts to material ESG issues
      • Building a sustainable reporting framework
      • Assessing and solving for data gaps and data quality issues
      • Being aware of the tools and best practices available to support regulatory and performance reporting

      Our Advice

      Critical Insight

      • A tactical approach to ESG reporting will backfire. The reality of climate change and investor emphasis is not going away. For long-term success, organizations need to design an ESG reporting program that is flexible, interoperable, and digital.
      • Implementing a robust reporting program takes time. Start early, remain focused, and make plans to continually improve data quality and collection and performance metrics.
      • The “G” in ESG may not be capturing the limelight under ESG legislation yet, but there are key factors within the governance component that are under the regulatory microscope, including data, cybersecurity, fraud, and diversity and inclusion. Be sure you stay on top of these issues and include performance metrics in your internal and external reporting frameworks.

      Impact and Result

      • Successful organizations recognize that transparent ESG disclosure is necessary for long-term corporate performance.
      • Taking the time up front to design a robust and proactive ESG reporting program will pay off in the long run.
      • Future-proof your ESG reporting program by leveraging new tools, technologies, and software applications.

      Establish a Sustainable ESG Reporting Program Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish a Sustainable ESG Reporting Program Storyboard – A comprehensive framework to define an ESG reporting program that supports your ESG goals and reporting requirements.

      This storyboard provides a three-phased approach to establishing a comprehensive ESG reporting framework to drive sustainable corporate performance. It will help you identify what to report, understand how to implement your reporting program, and review in-house and external software and tooling options.

      • Establish a Sustainable ESG Reporting Program Storyboard

      2. ESG Reporting Workbook – A tool to document decisions, rationale, and implications of key activities to support your ESG reporting program.

      The workbook allows IT and business leaders to document decisions as they work through the steps to establish a comprehensive ESG reporting framework.

      • ESG Reporting Workbook

      3. ESG Reporting Implementation Plan – A tool to document tasks required to deliver and address gaps in your ESG reporting program.

      This planning tool guides IT and business leaders in planning, prioritizing, and addressing gaps to build an ESG reporting program.

      • ESG Reporting Implementation Plan Template

      4. ESG Reporting Presentation Template – A guide to communicate your ESG reporting approach to internal stakeholders.

      Use this template to create a presentation that explains the drivers behind the strategy, communicates metrics, demonstrates gaps and costs, and lays out the timeline for the implementation plan.

      • ESG Reporting Presentation Template

      Infographic

      Workshop: Establish a Sustainable ESG Reporting Program

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Determine Material ESG Factors

      The Purpose

      Determine material ESG factors.

      Key Benefits Achieved

      Learn how to identify your key stakeholders and material ESG risks.

      Activities

      1.1 Create a list of stakeholders and applicable ESG factors.

      1.2 Create a materiality map.

      Outputs

      List of stakeholders and applicable ESG factors

      Materiality map

      2 Define Performance and Reporting Metrics

      The Purpose

      Define performance and reporting metrics.

      Key Benefits Achieved

      Align your ESG strategy with key performance metrics.

      Activities

      2.1 Create a list of SMART metrics.

      2.2 Create a list of reporting obligations.

      Outputs

      SMART metrics

      List of reporting obligations

      3 Assess Data and Implementation Gaps

      The Purpose

      Assess data and implementation gaps.

      Key Benefits Achieved

      Surface data and technology gaps.

      Activities

      3.1 Create a list of high-priority data gaps.

      3.2 Summarize high-level implementation considerations.

      Outputs

      List of high-priority data gaps

      Summary of high-level implementation considerations

      4 Consider Software and Tooling Options

      The Purpose

      Select software and tooling options and develop implementation plan.

      Key Benefits Achieved

      Complete your roadmap and internal communication document.

      Activities

      4.1 Review tooling and technology options.

      4.2 Prepare ESG reporting implementation plan.

      4.3 Prepare the ESG reporting program presentation.

      Outputs

      Selected tooling and technology

      ESG reporting implementation plan

      ESG reporting strategy presentation

      Further reading

      Establish a Sustainable ESG Reporting Program

      Strengthen corporate performance by implementing a holistic and proactive reporting approach.

      Analyst Perspective

      The shift toward stakeholder capitalism cannot be pinned on one thing; rather, it is a convergence of forces that has reshaped attitudes toward the corporation. Investor attention on responsible investing has pushed corporations to give greater weight to the achievement of corporate goals beyond financial performance.

      Reacting to the new investor paradigm and to the wider systemic risk to the financial system of climate change, global regulators have rapidly mobilized toward mandatory climate-related disclosure.

      IT will be instrumental in meeting the immediate regulatory mandate, but their role is much more far-reaching. IT has a role to play at the leadership table shaping strategy and assisting the organization to deliver on purpose-driven goals.

      Delivering high-quality, relevant, and consistent disclosure is the key to unlocking and driving sustainable corporate performance. IT leaders should not underestimate the influence they have in selecting the right technology and data model to support ESG reporting and ultimately support top-line growth.

      Photo of Yaz Palanichamy

      Yaz Palanichamy
      Senior Research Analyst
      Info-Tech Research Group

      Photo of Donna Bales

      Donna Bales
      Principal Research Director
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Your organization needs to define a ESG reporting strategy that is driven by corporate purpose.

      Climate-related disclosure mandates are imminent; you need to prepare for them by building a sustainable reporting program now.

      There are many technologies available to support your ESG program plans. How do you choose the one that is right for your organization?

      Common Obstacles

      Knowing how to narrow down ESG efforts to material ESG issues for your organization.

      Understanding the key steps to build a sustainable ESG reporting program.

      Assessing and solving for data gaps and data quality issues.

      Being aware of the tools and best practices available to support regulatory and performance reporting.

      Info-Tech’s Approach

      Learn best-practice approaches to develop and adopt an ESG reporting program approach to suit your organization’s unique needs.

      Understand the key features, tooling options, and vendors in the ESG software market.

      Learn through analyst insights, case studies, and software reviews on best-practice approaches and tool options.

      Info-Tech Insight

      Implementing a robust reporting program takes time. Start early, remain focused, and plan to continually improve data quality and collection and performance metrics

      Putting “E,” “S,” and “G” in context

      Corporate sustainability depends on managing ESG factors well

      Environmental, social, and governance are the components of a sustainability framework that is used to understand and measure how an organization impacts or is affected by society as a whole.

      Human activities, particularly fossil fuel burning since the middle of the twentieth century, have increased greenhouse gas concentration, resulting in observable changes to the atmosphere, ocean, cryosphere, and biosphere. The “E” in ESG relates to the positive and negative impacts an organization may have on the environment, such as the energy it takes in and the waste it discharges.

      The “S” in ESG is the most ambiguous component in the framework, as social impact relates not only to risks but also to prosocial behavior. It’s the most difficult to measure but can have significant financial and reputational impact on corporations if material and poorly managed.

      The “G” in ESG is foundational to the realization of “S” and “E.” It encompasses how well an organization integrates these considerations into the business and how well the organization engages with key stakeholders, receives feedback, and is transparent with its intentions.

      A diagram that shows common examples of ESG issues.

      The impact of ESG factors on investment decisions

      Alleviate Investment Risk

      Organizational Reputation: Seventy-four percent of those surveyed were concerned that failing to improve their corporate ESG performance would negatively impact their organization’s branding and overall reputation in the market (Intelex, 2022).

      Ethical Business Compliance: Adherence to well-defined codes of business conduct and implementation of anti-corruption and anti-bribery practices is a great way to distinguish between organizations with good/poor governance intentions.

      Shifting Consumer Preferences: ESG metrics can also largely influence consumer preferences in buying behavior intentions. Research from McKinsey shows that “upward of 70 percent” of consumers surveyed on purchases in multiple industries said they would pay an additional 5 percent for a green product if it met the same performance standards as a nongreen alternative (McKinsey, 2019).

      Responsible Supply Chain Management: The successful alignment of ESG criteria with supply chain operations can lead to several benefits (e.g. producing more sustainable product offerings, maintaining constructive relationships with more sustainability-focused suppliers).

      Environmental Stewardship: The growing climate crisis has forced companies of all sizes to rethink how they plan their corporate environmental sustainability practices.

      Compliance With Regulatory Guidelines: An increasing emphasis on regulations surrounding ESG disclosure rates may result in some institutional investors taking a more proactive stance toward ESG-related initiatives.

      Sustaining Competitive Advantage: Given today’s globalized economy, many businesses are constantly confronted with environmental issues (e.g. water scarcity, air pollution) as well as social problems (e.g. workplace wellness issues). Thus, investment in ESG factors is simply a part of maintaining competitive advantage.

      Leaders increasingly see ESG as a competitive differentiator

      The perceived importance of ESG has dramatically increased from 2020 to 2023

      A diagram that shows the perceived importance of ESG in 2020 and 2023.

      In a survey commissioned by Schneider Electric, researchers categorized the relative importance of ESG planning initiatives for global IT business leaders. ESG was largely identified as a critical factor in sustaining competitive advantage against competitors and maintaining positive investor/public relations.
      Source: S&P Market Intelligence, 2020; N=825 IT decision makers

      “74% of finance leaders say investors increasingly use nonfinancial information in their decision-making.”
      Source: EY, 2020

      Regulatory pressure to report on carbon emission is building globally

      The Evolving Regulatory Landscape

      Canada

      • Canadian Securities Administrators (CSA) NI 51-107 Disclosure of Climate-related Matters

      United States

      • Securities and Exchange Commission (SEC) 33-11042 – The Enhancement and Standardization of Climate-Related Disclosures for Investors
      • SEC 33-11038 Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
      • Nasdaq Board Diversity Rule (5605(f))

      Europe

      • European Commission Sustainable Finance Disclosure Regulation (SFDR)
      • European Commission EU Supply Chain Act
      • The German Supply Chain Act (GSCA)
      • Financial Conduct Authority UK Proposal (DP 21/4) Sustainability Disclosure Requirements and investment labels
      • UK Modern Slavery Act, 2015

      New Zealand

      • The Financial Sector (Climate-related Disclosures and Other Matters) Amendment Act 2021

      Accurate ESG reporting will be critical to meet regulatory requirements

      ESG reporting is the disclosure of environmental, social, and governance (ESG) data via qualitative and quantitative reports.

      It is how organizations make their sustainability commitments and strategies transparent to stakeholders.

      For investors it provides visibility into a company's ESG activities, enabling them to align investments to their values and avoid companies that cause damage to the environment or are offside on social and governance issues.

      Despite the growing practice of ESG reporting, reporting standards and frameworks are still evolving and the regulatory approach for climate-related disclosure is inconsistent across jurisdictions, making it challenging for organizations to develop a robust reporting program.

      “Environmental, social and governance (ESG) commitments are at the core a data problem.”

      Source: EY, 2022

      However, organizations will struggle to meet reporting requirements

      An image that shows 2 charts: How accurately can your organization report on the impact of its ESG Initiatives; and More specifically, if it was required to do so, how accurately could your organization report on its carbon footprint.

      Despite the commitment to support an ESG Initiative, less than a quarter of IT professionals say their organization can accurately report on the impact of its ESG initiatives, and 44% say their reporting on impacts is not accurate.

      Reporting accuracy was even worse for reporting on carbon footprint with 46% saying their organization could not report on its carbon footprint accurately. This despite most IT professionals saying they are working to support environmental mandates.

      Global sustainability rankings based on ESG dimensions

      Global Country Sustainability Ranking Map

      An image of Global Country Sustainability Ranking Map, with a score of 0 to 10.

      Country Sustainability Scores (CSR) as of October 2021
      Scores range from 1 (poor) to 10 (best)
      Source: Robeco, 2021

      ESG Performance Rankings From Select Countries

      Top ESG and sustainability performer

      Finland has ranked consistently as a leading sustainability performer in recent years. Finland's strongest ESG pillar is the environment, and its environmental ranking of 9.63/10 is the highest out of all 150 countries.

      Significant score deteriorations

      Brazil, France, and India are among the countries whose ESG score rankings have deteriorated significantly in the past three years.

      Increasing political tensions and risks as well as aftershock effects of the COVID-19 pandemic (e.g. high inequality and insufficient access to healthcare and education) have severely impacted Brazil’s performance across the governance and social pillars of the ESG framework, ultimately causing its overall ESG score to drop to a CSR value of 5.31.

      Largest gains and losses in ESG scores

      Canada has received worse scores for corruption, political risk, income inequality, and poverty over the past three years.

      Taiwan has seen its rankings improve in terms of overall ESG scores. Government effectiveness, innovation, a strong semiconductor manufacturing market presence, and stronger governance initiatives have been sufficient to compensate for a setback in income and economic inequality.

      Source: Robeco, 2021

      Establish a Sustainable Environmental, Social, and Governance (ESG) Reporting Program

      A diagram of establishing a sustainable ESG reporting program.

      Blueprint benefits

      Business Benefits

      • Clarity on technical and organizational gaps in the organization’s ability to deliver ESG reporting strategy.
      • Transparency on the breadth of the change program, internal capabilities needed, and accountable owners.
      • Reduced likelihood of liability.
      • Improved corporate performance and top-line growth.
      • Confidence that the organization is delivering high-quality, comprehensive ESG disclosure.

      IT Benefits

      • Understanding of IT’s role as strategic enabler for delivering high-quality ESG disclosure and sustainable corporate performance.
      • Transparency on primary data gaps and technology and tools needed to support the ESG reporting strategy.
      • Clear direction of material ESG risks and how to prioritize implementation efforts.
      • Awareness of tool selection options.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Photo of Executive Presentation.

      Key deliverable: Executive Presentation

      Leverage this presentation deck to improve corporate performance by implementing a holistic and proactive ESG reporting program.

      Photo of Workbook

      Workbook

      As you work through the activities, use this workbook to document decisions and rationale and to sketch your materiality map.

      Photo of Implementation Plan

      Implementation Plan

      Use this implementation plan to address organizational, technology, and tooling gaps.

      Photo of RFP Template

      RFP Template

      Leverage Info-Tech’s RFP Template to source vendors to fill technology gaps.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit
      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation
      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop
      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting
      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      What does a typical GI on this topic look like?

      A diagram that shows Guided Implementation in 3 phases.

      Workshop Overview

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Activities

      Determine Material ESG Factors

      1.1 Review ESG drivers.
      1.2 Identify key stakeholders and what drives their behavior.
      1.3 Discuss materiality frameworks options and select baseline model.
      1.4 Identify material risks and combine and categorize risks.
      1.5 Map material risks on materiality assessment map.

      Define Performance and Reporting Metrics

      2.1 Understand common program metrics for each ESG component.
      2.2 Consider and select program metrics.
      2.3 Discuss ESG risk metrics.
      2.4 Develop SMART metrics.
      2.5 Surface regulatory reporting obligations.

      Assess Data and Implementation Gaps

      3.1 Assess magnitude and prioritize data gaps.
      3.2 Discuss high-level implementation considerations and organizational gaps.

      Software and Tooling Options

      4.1 Review technology options.
      4.2 Brainstorm technology and tooling options and the feasibility of implementing.
      4.3 Prepare implementation plan.
      4.4 Draft ESG reporting program communication.
      4.5 Optional – Review software selection options.

      Next Steps and Wrap-Up (offsite)

      5.1 Complete in-progress deliverables from previous four days.
      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. Customized list of key stakeholders and material ESG risks
      2. Materiality assessment map

      1. SMART metrics
      2. List of regulatory reporting obligations

      1. High-priority data gaps
      2. High-level implementation considerations

      1. Technology and tooling opportunities
      2. Implementation Plan
      3. ESG Reporting Communication

      1. ESG Reporting Workbook
      2. Implementation Plan

      Contact your account representative for more information.
      workshops@infotech.com
      1-888-670-8889

      Phase 1

      Explore ESG Reporting

      A diagram that shows phase 1 to 3 of establishing ESG reporting program.

      This phase will walk you through the following:

      • Define key stakeholders and material ESG factors.
      • Identify material ESG issues.
      • Develop SMART program metrics.
      • List reporting obligations.
      • Surface high-level data gaps.
      • Record high-level implementation considerations.

      This phase involves the following participants: CIO, CCO, CSO, business leaders, legal, marketing and communications, head of ESG reporting, and any dedicated ESG team members

      Practical steps for ESG disclosure

      Measuring and tracking incremental change among dimensions such as carbon emissions reporting, governance, and diversity, equity, and inclusion (DEI) requires organizations to acquire, analyze, and synthesize data from beyond their internal organizational ecosystems

      A diagram that shows 5 steps of identify, assess, implement, report & communicate, and monitor & improve.

      1.1 Ensure your reporting requirements are comprehensive

      A diagram of reporting lifecycle.

      This section will walk you through some key considerations for establishing your ESG reporting strategy. The first step in this process is to identify the scope of your reporting program.

      Defining the scope of your reporting program

      1. Stakeholder requirements: When developing a reporting program consider all your stakeholder needs as well as how they want to consume the information.
      2. Materiality assessment: Conduct a materiality assessment to identify the material ESG issues most critical to your organization. Organizations will need to report material risks to internal and external stakeholders.
      3. Purpose-driven goals: Your ESG reporting must include metrics to measure performance against your purpose-driven strategy.
      4. Regulatory requirements & industry: Work with your compliance and legal teams to understand which reporting requirements apply. Don’t forget requirements under the “S” and “G” components. Some jurisdictions require DEI reporting, and the Securities and Exchange Commission (SEC) in the US recently announced cybersecurity disclosure of board expertise and management oversight practices.

      Factor 1: Stakeholder requirements

      Work with key stakeholders to determine what to report

      A diagram that shows internal and external stakeholders.

      Evaluate your stakeholder landscape

      Consider each of these areas of the ESG Stakeholder Wheel and identify your stakeholders. Once stakeholders are identified, consider how the ESG factors might be perceived by delving into the ESG factors that matter to each stakeholder and what drives their behavior.

      A diagram of ESG impact, including materiality assessment, interviews, benchmark verses competitors, metrics and trend analysis.

      Determine ESG impact on stakeholders

      Review materiality assessment frameworks for your industry to surface ESG factors for your segment and stakeholder group(s).

      Perform research and analysis of the competition and stakeholder trends, patterns, and behavior

      Support your findings with stakeholder interviews.

      Stakeholders will prioritize ESG differently. Understanding their commitment is a critical success factor.

      Many of your stakeholders care about ESG commitments…

      27%: Support for social and environmental proposals at shareholder meetings of US companies rose to 27% in 2020 (up from 21% in 2017).
      Source: Sustainable Investments Institute, 2020.

      79%: of investors consider ESG risks and opportunities an important factor in investment decision making.
      Source: “Global Investor Survey,” PwC, 2021.

      ...Yet

      33%: of survey respondents cited that a lack of attention or support from senior leadership was one of the major barriers preventing their companies from making any progress on ESG issues.
      Source: “Consumer Intelligence Survey,” PwC, 2021.

      Info-Tech Insight

      To succeed with ESG reporting it is essential to understand who we hold ourselves accountable to and to focus ESG efforts in areas with the optimal balance between people, the planet, and profits

      Activity 1: Define stakeholders

      Input: Internal documentation (e.g. strategy, annual reports), ESG Stakeholder Wheel
      Output: List of key stakeholders and applicable ESG factors
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Head of ESG Reporting, Business leaders

      2 hours

      1. Using the ESG Stakeholder Wheel as a baseline, consider the breadth of your organization’s value chain and write down all your stakeholders.
      2. Discuss what drives their behavior. Be as detailed as you can be. For example, if it’s a consumer, delve into their age group and the factors that may drive their behavior.
      3. List the ESG factors that may be important to each stakeholder.
      4. Write down the communication channels you expect to use to communicate ESG information to this stakeholder group.
      5. Rate the priority of this stakeholder to your organization.
      6. Record this information in ESG Reporting Workbook.
      7. Optional – consider testing the results with a targeted survey.

      Download the ESG Reporting Workbook

      Activity 1: Example

      An example of activity 1 (defining stakeholders)

      Factor 2: Materiality assessments

      Conduct a materiality assessment to inform company strategy and establish targets and metrics for risk and performance reporting

      The concept of materiality as it relates to ESG is the process of gaining different perspectives on ESG issues and risks that may have significant impact (both positive and negative) on or relevance to company performance.

      The objective of a materiality assessment is to identify material ESG issues most critical to your organization by looking at a broad range of social and environmental factors. Its purpose is to narrow strategic focus and enable an organization to assess the impact of financial and non-financial risks aggregately.

      It helps to make the case for ESG action and strategy, assess financial impact, get ahead of long-term risks, and inform communication strategies.

      Organizations can use assessment tools from Sustainalytics or GRI, SASB Standards, or guidance and benchmarking information from industry associations to help assess ESG risks .

      An image of materiality matrix to understand ESG exposure

      Info-Tech Insight

      The materiality assessment informs your risk management approach. Material ESG risks identified should be integrated into your organization’s risk reporting framework.

      Supplement your materiality assessment with stakeholder interviews

      A diagram that shows steps of stakeholder interviews.

      How you communicate the results of your ESG assessment may vary depending on whether you’re communicating to internal or external stakeholders and their communication delivery preferences.

      Using the results from your materiality assessment, narrow down your key stakeholders list. Enhance your strategy for disclosure and performance measurement through direct and indirect stakeholder engagement.

      Decide on the most suitable format to reach out to these stakeholders. Smaller groups lend themselves to interviews and forums, while surveys and questionnaires work well for larger groups.

      Develop relevant questions tailored to your company and the industry and geography you are in.

      Once you receive the results, decide how and when you will communicate them.

      Determine how they will be used to inform your strategy.

      Steps to determine material ESG factors

      Step 1

      Select framework

      A diagram of framework

      Review reporting frameworks and any industry guidance and select a baseline reporting framework to begin your materiality assessment.

      Step 2

      Begin to narrow down

      A diagram of narrowing down stakeholders

      Work with stakeholders to narrow down your list to a shortlist of high-priority material ESG issues.

      Step 3

      Consolidate and group

      A diagram of ESG grouping

      Group ESG issues under ESG components, your company’s strategic goals, or the UN’s Sustainable Development Goals.

      Step 4

      Rate the risks of ESG factors

      A diagram of rating the risks of ESG factors

      Assign an impact and likelihood scale for each risk and assign your risk threshold.

      Step 5

      Map

      A diagram of material map

      Use a material map framework such as GRI or SASB or Info-Tech’s materiality map to visualize your material ESG risks.

      Materiality assessment

      The materiality assessment is a strategic tool used to help identify, refine, and assess the numerous ESG issues in the context of your organization.

      There is no universally accepted approach to materiality assessments. Although the concept of materiality is often embedded within a reporting standard, your approach to conducting the materiality assessment does not need to link to a specific reporting standard. Rather, it can be used as a baseline to develop your own.

      To arrive at the appropriate outcome for your organization, careful consideration is needed to tailor the materiality assessment to meet your organization’s objectives.

      When defining the scope of your materiality assessment consider:

      • Your corporate ESG purpose and sustainability strategy
      • Your audience and what drives their behavior
      • The relevance of the ESG issues to your organization. Do they impact strategy? Increase risk?
      • The boundaries of your materiality assessment (e.g. regions or business departments, supply chains it will cover)
      • Whether you want to assess from a double materiality perspective

      A diagram of framework

      Consider your stakeholders and your industry when selecting your materiality assessment tool – this will ensure you provide relevant disclosure information to the stakeholders that need it.

      Double materiality is an extension of the financial concept of materiality and considers the broader impact of an organization on the world at large – particularly to people and climate.

      Prioritize and categorize

      A diagram of narrowing down stakeholders

      Using internal information (e.g. strategy, surveys) and external information (e.g. competitors, industry best practices), create a longlist of ESG issues.

      Discuss and narrow down the list. Be sure to consider opportunities – not just material risks!

      A diagram of ESG grouping

      Group the issues under ESG components or defined strategic goals for your organization. Another option is to use the UN’s Sustainable Development Goals to categorize.

      Differentiate ESG factors that you already measure and report.

      The benefit of clustering is that it shows related topics and how they may positively or negatively influence one another.

      Internal risk disclosure should not be overlooked

      Bank of America estimates ESG disputes have cost S&P companies more than $600 billion in market capitalization in the last seven years alone.

      ESG risks are good predictors of future risks and are therefore key inputs to ensure long-term corporate success.

      Regardless of the size of your organization, it’s important to build resilience against ESG risks.

      To protect an organization against an ESG incident and potential liability risk, ESG risks should be treated like any other risk type and incorporated into risk management and internal reporting practices, including climate scenario analysis.

      Some regulated entities will be required to meet climate-related financial disclosure expectations, and sound risk management practices will be prescribed through regulatory guidance. However, all organizations should instill sound risk practices.

      ESG risk management done right will help protect against ESG mishaps that can be expensive and damaging while demonstrating commitment to stakeholders that have influence over all corporate performance.

      Source: GreenBiz, 2022.

      A diagram of risk landscape.

      IT has a role to play to provide the underlying data and technology to support good risk decisions.

      Visualize your material risks

      Leverage industry frameworks or use Info-Tech’s materiality map to visualize your material ESG risks.

      GRI’s Materiality Matrix

      A photo of GRI’s Materiality Matrix

      SASB’s Materiality Map

      A photo of SASB’s Materiality Map

      Info-Tech’s Materiality Map

      A diagram of material map

      Activity 2: Materiality assessment

      Input: ESG corporate purpose or any current ESG metrics; Customer satisfaction or employee engagement surveys; Materiality assessment tools from SASB, Sustainalytics, GRI, or industry frameworks; Outputs from stakeholder outreach/surveys
      Output: Materiality map, a list of material ESG issues
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Head of ESG Reporting, Business leaders, Participants from marketing and communications

      2-3 hour

      1. Begin by reviewing various materiality assessment frameworks to agree on a baseline framework. This will help to narrow down a list of topics that are relevant to your company and industry.
      2. As a group, discuss the potential impact and start listing material issues. At first the list will be long, but the group will work collectively to prioritize and consolidate the list.
      3. Begin to combine and categorize the results by aligning them to your ESG purpose and strategic pillars.
      4. Treat each ESG issue as a risk and map against the likelihood and impact of the risk.
      5. Map the topics on your materiality map. Most of the materiality assessment tools have materiality maps – you may choose to use their map.
      6. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      Case Study: Novartis

      Logo of Novartis

      • INDUSTRY: Pharmaceuticals
      • SOURCE: Novartis, 2022

      Novartis, a leading global healthcare company based in Switzerland, stands out as a leader in providing medical consultancy services to address the evolving needs of patients worldwide. As such, its purpose is to use science and technologically innovative solutions to address some of society’s most debilitating, challenging, and ethically significant healthcare issues.

      The application of Novartis’ materiality assessment process in understanding critical ESG topics important to their shareholders, stakeholder groups, and society at large enables the company to better quantify references to its ESG sustainability metrics.

      Novartis applies its materiality assessment process to better understand relevant issues affecting its underlying business operations across its entire value chain. Overall, employing Novartis’s materiality assessment process helps the company to better manage its societal, environmental, and economic impacts, thus engaging in more socially responsible governance practices.

      Novartis’ materiality assessment is a multitiered process that includes three major elements:

      1. Identifying key stakeholders, which involves a holistic analysis of internal colleagues and external stakeholders.
      2. Collecting quantitative feedback and asking relevant stakeholders to rank a set of issues (e.g. climate change governance, workplace culture, occupational health and safety) and rate how well Novartis performs across each of those identified issues.
      3. Eliciting qualitative insights by coordinating interviews and workshops with survey participants to better understand why the issues brought up during survey sessions were perceived as important.

      Results

      In 2021, Novartis had completed its most recent materiality assessment. From this engagement, both internal and external stakeholders had ranked as important eight clusters that Novartis is impacting on from an economic, societal, and environmental standpoint. The top four clusters were patient health and safety, access to healthcare, innovation, and ethical business practices.

      Factor 3: ESG program goals

      Incorporate ESG performance metrics that support your ESG strategy

      Another benefit of the materiality assessment is that it helps to make the case for ESG action and provides key information for developing a purpose-led strategy.

      An internal ESG strategy should drive toward company-specific goals such as green-house gas emission targets, use of carbon neutral technologies, focus on reusable products, or investment in DEI programs.

      Most organizations focus on incremental goals of reducing negative impacts to existing operations or improving the value to existing stakeholders rather than transformative goals.

      Yet, a strategy that is authentic and aligned with key stakeholders and long-term goals will bring sustainable value.

      The strategy must be supported by an accountability and performance measurement framework such as SMART metrics.

      A fulsome reporting strategy should include performance metrics

      A photo of SMART metrics: Specific, Measurable, Actionable, Realistic, Time-bound.

      Activity 3: SMART metrics

      Input: ESG corporate purpose or any current ESG metrics, Outputs from activities 1 and 2, Internally defined metrics (i.e. risk metrics or internal reporting requirements)
      Output: SMART metrics
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Chief Risk officer/Risk leaders, Head of ESG Reporting, Business leaders, Participants from marketing and communications

      1-2 hours

      1. Document a list of appropriate metrics to assess the success of your ESG program.
      2. Use the sample metrics listed in the table on the next slide as a starting point.
      3. Fill in the chart to indicate the:
        1. Name of the success metric
        2. Method for measuring success
        3. Baseline measurement
        4. Target measurement
        5. Actual measurements at various points throughout the process of improving the risk management program
        6. A deadline for each metric to meet the target measurement
      4. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      Sample ESG metrics

      Leverage industry resources to help define applicable metrics

      Environmental

      • Greenhouse gas emissions – total corporate
      • Carbon footprint – percent emitted and trend
      • Percentage of air and water pollution
      • Renewable energy share per facility
      • Percentage of recycled material in a product
      • Ratio of energy saved to actual use
      • Waste creation by weight
      • Circular transition indicators

      Social

      • Rates of injury
      • Lost time incident rate
      • Proportion of spend on local suppliers
      • Entry-level wage vs. local minimum wage
      • Percentage of management who identify with specific identity groups (i.e. gender and ethnic diversity)
      • Percentage of suppliers screened for accordance to ESG vs. total number of suppliers
      • Consumer responsiveness

      Governance

      • Annual CEO compensation compared to median
      • Percentage of employees trained in conflict-of-interest policy
      • Number of data breaches using personally identifiable information (PII)
      • Number of incidents relating to management corruption
      • Percentage of risks with mitigation plans in place

      Activity 3: Develop SMART project metrics

      1-3 hours

      Attach metrics to your goals to gauge the success of the ESG program.

      Sample Metrics

      An image of sample metrics

      Factor 4: Regulatory reporting obligations

      Identify your reporting obligations

      High-level overview of reporting requirements:

      An image of high-level reporting requirements in Canada, the United Kingdom, Europe, and the US.

      Refer to your legal and compliance team for the most up-to-date and comprehensive requirements.

      The focus of regulators is to move to mandatory reporting of material climate-related financial information.

      There is some alignment to the TCFD* framework, but there is a lack of standardization in terms of scope across jurisdictions.
      *TCFD is the Task Force on Climate-Related Financial Disclosures.

      Activity 4: Regulatory obligations

      Input: Corporate strategy documents; Compliance registry or internal governance, risk, and compliance (GRC) tool
      Output: A list of regulatory obligations
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Chief Legal Officer, Head of ESG Reporting, Business leaders

      1-2 hours

      1. Begin by listing the jurisdictions in which you operate or plan to operate.
      2. For each jurisdiction, list any known current or future regulatory requirements. Consider all ESG components.
      3. Log whether the requirements are mandatory or voluntary and the deadline to report.
      4. Write any details about reporting framework; for example, if a reporting framework such as TCFD is prescribed.
      5. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      1.2 Assess impact and weigh options

      A diagram of reporting lifecycle.

      Once the scope of your ESG reporting framework has been identified, further assessment is needed to determine program direction and to understand and respond to organizational impact.

      Key factors for further assessment and decisions include

      1. Reporting framework options. Consider mandated reporting frameworks and any industry standards when deciding your baseline reporting framework. Strive to have a common reporting methodology that serves all your reporting needs: regulatory, corporate, shareholders, risk reporting, etc.
      2. Perform gap analysis. The gap analysis will reveal areas where data may need to be sourced or where tools or external assistance may be needed to help deliver your reporting strategy.
      3. Organizational impact and readiness. The gap analysis will help to determine whether your current operating model can support the reporting program or whether additional resources, tools, or infrastructure will be needed.

      1.2.1 Decide on baseline reporting framework

      1. Determine the appropriate reporting framework for your organization

      Reporting standards are available to enable relevant, high-quality, and comparable information. It’s the job of the reporting entity to decide on the most suitable framework for their organization.

      The most established standard for sustainability reporting is the Global Reporting Initiative (GRI), which has supported sustainability reporting for over 20 years.

      The Task Force on Climate-Related Financial Disclosures (TCFD) was created by the Financial Stability Board to align ESG disclosure with financial reporting. Many global regulators support this framework.

      The International Sustainability Standards Board (ISSB) is developing high-quality, understandable, and enforceable global standards using the Sustainability Accounting Standards Board (SASB) as a baseline. It is good practice to use SASB Standards until the ISSB standards are available.

      2. Decide which rating agencies you will use and why they are important

      ESG ratings are provided by third-party agencies and are increasingly being used for financing and transparency to investors. ESG ratings provide both qualitative and quantitative information.

      However, there are multiple providers, so organizations need to consider which ones are the most important and how many they want to use.

      Some of the most popular rating agencies include Sustainalytics, MSCI, Bloomberg, Moody's, S&P Global, and CDP.

      Reference Appendix Below

      1.2.2 Determine data gaps

      The ESG reporting mandate is built on the assumption of consistent, good-quality data

      To meet ESG objectives, corporations are challenged with collecting non-financial data from across functional business and geographical locations and from their supplier base and supply chains.

      One of the biggest impediments to ESG implementation is the lack of high-quality data and of mature processes and tools to support data collection.

      An important step for delivering reporting requirements is to perform a gap analysis early on to surface gaps in the primary data needed to deliver your reporting strategy.

      The output of this exercise will also inform and help prioritize implementation, as it may show that new data sets need to be sourced or tools purchased to collect and aggregate data.

      Conduct a gap analysis to determine gaps in primary data

      A diagram of gap analysis to determine gaps in primary data.

      Activity 5: Gap analysis

      Input: Business (ESG) strategy, Data inventory (if exists), Output from Activity 1: Key stakeholders, Output from Activity 2: Materiality map, Output of Activity 3: SMART metrics, Output of Activity 4: Regulatory obligations
      Output: List of high-priority data gaps
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Chief Legal Officer, Head of ESG Reporting, Business leaders, Data analysts

      1-3 hours

      1. Using the outputs from activities 1-4, list your organization’s ESG issues in order of priority. You may choose to develop your priority list by stakeholder group or by material risks.
      2. List any defined SMART metric from Activity 3.
      3. Evaluate data availability and quality of the data (if existing) as well as any impediments to sourcing the data.
      4. Make note if this is a common datapoint, i.e. would you disclose this data in more than one report?
      5. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      1.3 Take a holistic implementation approach

      Currently, 84 percent of businesses don’t integrate their ESG performance with financial and risk management reporting.

      Source: “2023 Canadian ESG Reporting Insights,” PwC.

      A diagram of reporting lifecycle.

      When implementing an ESG reporting framework, it is important not to implement in silos but to take a strategic approach that considers the evolving nature of ESG and the link to value creation and sound decision making.

      Key implementation considerations include

      1. Setting clear metrics and targets. Key performance indicators (KPIs) and key risk indicators (KRIs) are used to measure ESG factor performance. It’s essential that they are relevant and are constructed using high-quality data. Your performance metrics should be continually assessed and adapted as your ESG program evolves.
      2. Data challenges. Without good-quality data it is impossible to accurately measure ESG performance, generate actionable insights on ESG performance and risk, and provide informative metrics to investors and other stakeholders. Design your data model to be flexible and digital where possible to enable data interoperability.
      3. Architectural approach. IT will play a key role in the design of your reporting framework, including the decision on whether to build, buy, or deliver a hybrid solution. Every organization will build their reporting program to suit their unique needs; however, taking a holistic and proactive approach will support and sustain your strategy long term.

      1.3.1 Metrics and targets for climate-related disclosure

      “The future of sustainability reporting is digital – and tagged.”
      Source: “XBRL Is Coming,” Novisto, 2022.

      In the last few years, global regulators have proposed or effected legislation requiring public companies to disclose climate-related information.

      Yet according to Info-Tech’s 2023 Trends and Priorities survey, most IT professionals expect to support environmental mandates but are not prepared to accurately report on their organization’s carbon footprint.

      IT groups have a critical role to play in helping organizations develop strategic plans to meet ESG goals, measure performance, monitor risks, and deliver on disclosure requirements.

      To future-proof your reporting structure, your data should be readable by humans and machines.

      eXtensible Business Reporting Language (XBRL) tagging is mandated in several jurisdictions for financial reporting, and several reporting frameworks are adopting XBRL for sustainability reporting so that non-financial and financial disclosure frameworks are aligned.

      Example environmental metrics

      • Amount of scope 1, 2, or 3 GHG emissions
      • Total energy consumption
      • Total water consumption
      • Progress toward net zero emission
      • Percentage of recycled material in a product

      1.3.1 Metrics and targets for social disclosure

      “59% of businesses only talk about their positive performance, missing opportunities to build trust with stakeholders through balanced and verifiable ESG reporting.”
      Source: “2023 Canadian ESG Reporting Insights,” PwC.

      To date, regulatory focus has been on climate-related disclosure, although we are beginning to see signals in Europe and the UK that they are turning their attention to social issues.

      Social reporting focuses on the socioeconomic impacts of an organization’s initiatives or activities on society (indirect or direct).

      The “social” component of ESG can be the most difficult to quantify, but if left unmonitored it can leave your organization open to litigation from consumers, employees, and activists.

      Although organizations have been disclosing mandated metrics such as occupational health and safety and non-mandated activities such as community involvement for years, the scope of reporting is typically narrow and hard to measure in financial terms.

      This is now changing with the recognition by companies of the value of social reporting to brand image, traceability, and overall corporate performance.

      Example social metrics

      • Rate of injury
      • Lost time incident rate
      • Proportion of spend on local suppliers
      • Entry-level wage versus local minimum wage
      • Percentage of management within specific identity groups (i.e. gender and ethnic diversity)
      • Number of workers impacted by discrimination

      Case Study: McDonald’s Corporation (MCD)

      Logo of McDonald’s

      • INDUSTRY: Food service retailer
      • SOURCE: RBC Capital Markets, 2021; McDonald’s, 2019

      McDonald’s Corporation is the leading global food service retailer. Its purpose is not only providing burgers to dinner tables around the world but also serving its communities, customers, crew, farmers, franchisees, and suppliers alike. As such, not only is the company committed to having a positive impact on communities and in maintaining the growth and success of the McDonald's system, but it is also committed to conducting its business operations in a way that is mindful of its ESG commitments.

      An image of McDonald’s Better Together

      McDonald’s Better Together: Gender Balance & Diversity strategy and Women in Tech initiative

      In 2019, MCD launched its Better Together: Gender Balance & Diversity strategy as part of a commitment to improving the representation and visibility of women at all levels of the corporate structure by 2023.

      In conjunction with the Better Together strategy, MCD piloted a “Women in Tech” initiative through its education and tuition assistance program, Archways to Opportunity. The initiative enabled women from company-owned restaurants and participating franchisee restaurants to learn skills in areas such as data science, cybersecurity, artificial intelligence. MCD partnered with Microsoft and Colorado Technical University to carry out the initiative (McDonald’s, 2019).

      Both initiatives directly correlate to the “S” of the ESG framework, as the benefits of gender-diverse leadership continue to be paramount in assessing the core strengths of a company’s overreaching ESG portfolio. Hence, public companies will continue to face pressure from investors to act in accordance with these social initiatives.

      Results

      MCD’s Better Together and Women in Tech programs ultimately helped improve recruitment and retention rates among its female employee base. After the initialization of the gender balance and diversification strategy, McDonald’s signed on to the UN Women’s Empowerment Principles to help accelerate global efforts in addressing the gender disparity problem.

      1.3.1 Metrics and targets for governance disclosure

      Do not lose sight of regulatory requirements

      Strong governance is foundational element of a ESG program, yet governance reporting is nascent and is often embedded in umbrella legislation pertaining to a particular risk factor.

      A good example of this is the recent proposal by the Securities and Exchange Commission in the US (CFR Parts 229, 232, 239, 240, and 249, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure), which will require public companies to:

      • Disclosure of board oversight of cyber risk.
      • Disclose management’s role in managing and accessing cybersecurity-related risks.

      The "G” component includes more than traditional governance factors and acts as a catch-all for other important ESG factors such as fraud, cybersecurity, and data hygiene. Make sure you understand how risk may manifest in your organization and put safeguards in place.

      Example governance metrics

      • Annual CEO compensation compared to median
      • Percentage of employees trained in conflict-of-interest policy
      • Completed number of supplier assessments
      • Number of data breaches using PII
      • Number of material cybersecurity breaches

      Info-Tech Insight

      The "G" in ESG may not be capturing the limelight under ESG legislation yet, but there are key governance factors that are that are under regulatory radar, including data, cybersecurity, fraud, and DEI. Be sure you stay on top of these issues and include performance metrics into your internal and external reporting frameworks.

      1.3.2 Conquering data management challenges

      48% of investment decision makers, including 58% of institutional investors, say companies’ self-reported ESG performance data is “much more important” than companies’ conventional financial data when informing their investment decisions (Benchmark ESG, 2021).

      Due to the nascent nature of climate-related reporting, data challenges such as the availability, usability, comparability, and workflow integration surface early in the ESG program journey when sourcing and organizing data:

      • It is challenging to collect non-financial data across functional business and geographical locations and from supplier base and supply chains.
      • The lack of common standards leads to comparability challenges, hindering confidence in the outputs.

      In addition to good, reliable inputs, organizations need to have the infrastructure to access new data sets and convert raw data into actionable insights.

      The establishment of data model and workflow processes to track data lineage is essential to support an ESG program. To be successful, it is critical that flexibility, scalability, and transparency exist in the architectural design. Data architecture must scale to capture rapidly growing volumes of unstructured raw data with the associated file formats.

      A photo of conceptual model for data lineage.

      Download Info-Tech’s Create and Manage Enterprise Data Models blueprint

      1.3.3 Reporting architecture

      CIOs play an important part in formulating the agenda and discourse surrounding baseline ESG reporting initiatives

      Building and operating an ESG program requires the execution of a large number of complex tasks.

      IT leaders have an important role to play in selecting the right technology approach to support a long-term strategy that will sustain and grow corporate performance.

      The decision to buy a vendor solution or build capabilities in-house will largely depend on your organization’s ESG ambitions and the maturity of in-house business and IT capabilities.

      For large, heavily regulated entities an integrated platform for ESG reporting can provide organizations with improved risk management and internal controls.

      Example considerations when deciding to meet ESG reporting obligations in-house

      • Size and type of organization
      • Extent of regulatory requirements and scrutiny
      • The amount of data you want to report
      • Current maturity of data architecture, particularly your ability to scale
      • Current maturity of your risk and control program – how easy is it to enhance current processes?
      • The availability and quality of primary data
      • Data set gaps
      • In-house expertise in data, model risk, and change management
      • Current operating model – is it siloed or integrated?
      • Implementation time
      • Program cost
      • The availability of vendor solutions that may address gaps

      Info-Tech Insight

      Executive leadership should take a more holistic and proactive stance to not only accurately reporting upon baseline corporate financial metrics but also capturing and disclosing relevant ESG performance metrics to drive alternative streams of valuation across their respective organizational environments.

      Activity 6: High-level implementation considerations

      Input: Business (ESG) strategy, Data inventory (if exists), Asset inventory (if exists), Output from Activity 5
      Output: Summary of high-level implementation considerations
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Head of ESG Reporting, Business leaders, Data analysts, Data and IT architect/leaders,

      2-3 hours

      1. Review the implementation considerations on the previous slide to help determine the appropriate technology approach.
      2. For each implementation consideration, describe the current state.
      3. Discuss and draft the implications of reaching the desired future state by listing implications and organizational gaps.
      4. Discuss as a group if there is an obvious implementation approach.
      5. At this point, further analysis may be needed. Form a subcommittee or assign a leader to conduct further analysis.
      6. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      1.3.4 Ensure your implementation team has a high degree of trust and communication

      If external partners are needed, dedicate an internal resource to managing the vendor and partner relationships.

      Communication: Teams must have some type of communication strategy. This can be broken into:

      • Regularity: Having a set time each day to communicate progress and a set day to conduct retrospectives.
      • Ceremonies: Injecting awards and continually emphasizing delivery of value to encourage relationship building and constructive motivation.
      • Escalation: Voicing any concerns and having someone responsible for addressing those concerns.

      Proximity: Distributed teams create complexity as communication can break down. This can be mitigated by:

      • Location: Placing teams in proximity to close the barrier of geographical distance and time zone differences.
      • Inclusion: Making a deliberate attempt to pull remote team members into discussions and ceremonies.
      • Communication tools: Having the right technology (e.g. videoconference) to help bring teams closer together virtually.

      Trust: Members should trust other members are contributing to the project and completing their required tasks on time. Trust can be developed and maintained by:

      • Accountability: Having frequent quality reviews and feedback sessions. As work becomes more transparent, people become more accountable.
      • Role clarity: Having a clear definition of what everyone’s role is.

      1.4 Clear effective communication

      Improving investor transparency is one of the key drivers behind disclosure, so making the data easy to find and consumable is essential

      A diagram of reporting lifecycle.

      Your communication of ESG performance is intricately linked to corporate value creation. When designing your communications strategy, consider:

      • Your message – make it authentic and tell a consistent story.
      • How data will be used to support the narrative.
      • How your ESG program may impact internal and external programs and build a communication strategy that is fit for purpose. Example programs are:
        • Employee recruitment
        • New product rollout
        • New customer campaign
      • The design of the communication and how well it suits the audience. Communications may take the form of campaigns, thought leadership, infographics, etc.
      • The appropriateness of communication channels to your various audiences and the messages you want to convey. For example, social media, direct outreach, shareholder circular, etc.

      1.5 Continually evaluate

      A diagram of reporting lifecycle.

      A recent BDC survey of 121 large companies and public-sector buyers found that 82% require some disclosure from their suppliers on ESG, and that's expected to grow to 92% by 2024.
      Source: BDC, 2023

      ESG's link to corporate performance means that organizations must stay on top of ESG issues that may impact the long-term sustainability of their business.

      ESG components will continue to evolve, and as they do so will stakeholder views. It is important to continually survey your stakeholders to ensure you are optimally managing ESG risks and opportunities.

      To keep ESG on the strategy agenda, we recommend that organizations:

      • Appoint a chief sustainability officer (CSO) with a seat on executive leadership committees.
      • Embed ESG into existing governance and form a tactical ESG working group committee.
      • Ensure ESG risks are integrated into the enterprise risk management program.
      • Continually challenge your ESG strategy.
      • Regularly review risks and opportunities through proactive outreach to stakeholders.

      Download The ESG Imperative and Its Impact on Organizations

      Phase 2

      Streamline Requirements and Tool Selection

      A diagram that shows phase 1 to 3 of establishing ESG reporting program.

      This phase will walk you through the following activities:

      • Assess technology and tooling opportunities.
      • Prepare ESG reporting implementation plan.
      • Write ESG reporting presentation document.

      This phase involves the following participants: CIO, CCO, CSO, EA, IT application and data leaders, procurement, business leaders, marketing and communications, head of ESG reporting, and any dedicated ESG team members

      2.1 Streamline your requirements and tool section

      Spend the time up front to enable success and meet expectations

      Before sourcing any technology, it’s important to have a good understanding of your requirements.

      Key elements to consider:

      1. ESG reporting scope. Large enterprises will have more complex workflow requirements, but they also will have larger teams to potentially manage in-house. Smaller organizations will need easy-to-use, low-cost solutions.
      2. Industry and value chain. Look for industry-specific solutions, as they will be more tailored to your needs and will enable you to be up and running quicker.
      3. Coverage. Ensure the tool has adequate regulatory coverage to meet your current and future needs.
      4. Gap in functionality. Be clear on the problem you are trying to solve and/or the gap in workflow. Refer to the reporting lifecycle and be clear on your needs before sourcing technology.
      5. Resourcing. Factor in capacity during and after implementation and negotiate the appropriate support.

      Industry perspective

      The importance of ESG is something that will need to be considered for most, if not every decision in the future, and having reliable and available information is essential. While the industry will continue to see investment and innovation that drives operational efficiency and productivity, we will also see strong ESG themes in these emerging technologies to ensure they support both sustainable and socially responsible operations.

      With the breadth of technology Datamine already has addressing the ESG needs for the mining industry combined with our new technology, our customers can make effective and timely decisions through incorporating ESG data into their planning and scheduling activities to meet customer demands, while staying within the confines of their chosen ESG targets.

      Photo of Chris Parry

      Chris Parry
      VP of ESG, Datamine

      Photo of Datamine Photo of isystain

      Activity 7: Brainstorm tooling options

      Use the technology feature list below to identify areas along the ESG workflow where automated tools or third-party solutions may create efficiencies

      Technological Solutions Feature Bucket

      Basic Feature Description

      Advanced Feature Description

      Natural language processing (NLP) tools

      Ability to use NLP tools to track and monitor sentiment data from news and social media outlets.

      Leveraging NLP toolsets can provide organizations granular insights into workplace sentiment levels, which is a core component of any ESG strategy. A recent study by MarketPsych, a company that uses NLP technologies to analyze sentiment data from news and social media feeds, linked stock price performance to workplace sentiment levels.

      Distributed ledger technologies (DLTs)

      DLTs can help ensure greater reporting transparency, in line with stringent regulatory reporting requirements.

      DLT as an ESG enabler, with advanced capabilities such as an option to provide demand response services linked to electricity usage and supply forecasting.

      Cloud-based data management and reporting systems

      Cloud-based data management and reporting can support ESG initiatives by providing increased reporting transparency and a better understanding of diverse social and environmental risks.

      Leverage newfound toolsets such as Microsoft Cloud for Sustainability – a SaaS offering that enables organizations to seamlessly record, report, and reduce their emissions on a path toward net zero.

      IoT technologies

      Integration of IoT devices can help enhance the integrity of ESG reporting through the collection of descriptive and accurate ESG metrics (e.g. energy efficiency, indoor air quality, water quality and usage).

      Advanced management of real-time occupancy monitoring: for example, the ability to reduce energy consumption rates by ensuring energy is only used when spaces and individual cubicles are occupied.

      2.2 Vendors tools and technologies to support ESG reporting

      In a recent survey of over 1,000 global public- and private-sector leaders, 87% said they see AI as a helpful tool to fight climate change.
      Source: Boston Consulting Group

      Technology providers are part of the solution and can be leveraged to collect, analyze, disclose, track, and report on the vast amount of data.

      Increasingly organizations are using artificial intelligence to build climate resiliency:

      • AI is useful for the predictive modelling of potential climate events due to its ability to gather and analyze and synthesize large complete data sets.

      And protect organizations from vulnerabilities:

      • AI can be used to identify and assess vulnerabilities that may lead to business disruption or risks in production or the supply chain.

      A diagram of tooling, including DLT, natural language processing, cloud-based data management and IoT.

      2.3 ESG reporting software selection

      What Is ESG Reporting Software?

      Our definition: ESG reporting software helps organizations improve the transparency and accountability of their ESG program and track, measure, and report their sustainability efforts.

      Key considerations for reporting software selection:

      • While there are boutique ESG vendors in the market, organizations with existing GRC tools may first want to discuss ESG coverage with their existing vendor as it will enable better integration.
      • Ensure that the vendors you are evaluating support the requirements and regulations in your region, industry, and geography. Regulation is moving quickly – functionality needs to be available now and not just on the roadmap.
      • Determine the level of software integration support you need before meeting with vendors and ensure they will be able to provide it – when you need it!

      Adoption of ESG reporting software has historically been low, but these tools will become critical as organizations strive to meet increasing ESG reporting requirements.

      In a recent ESG planning and performance survey conducted by ESG SaaS company Diligent Corporation, it was found that over half of all organizations surveyed do not publish ESG metrics of any kind, and only 9% of participants are actively using software that supports ESG data collection, analysis, and reporting.

      Source: Diligent, 2021.

      2.3.1 Elicit and prioritize granular requirements for your ESG reporting software

      Understanding business needs through requirements gathering is the key to defining everything about what is being purchased. However, it is an area where people often make critical mistakes.

      Poorly scoped requirements

      Fail to be comprehensive and miss certain areas of scope.

      Focus on how the solution should work instead of what it must accomplish.

      Have multiple levels of detail within the requirements that are inconsistent and confusing.

      Drill all the way down into system-level detail.

      Add unnecessary constraints based on what is done today rather than focusing on what is needed for tomorrow.

      Omit constraints or preferences that buyers think are obvious.

      Best practices

      Get a clear understanding of what the system needs to do and what it is expected to produce.

      Test against the principle of MECE – requirements should be “mutually exclusive and collectively exhaustive.”

      Explicitly state the obvious and assume nothing.

      Investigate what is sold on the market and how it is sold. Use language that is consistent with that of the market and focus on key differentiators – not table stakes.

      Contain the appropriate level of detail – the level should be suitable for procurement and sufficient for differentiating vendors.

      Download Info-Tech's Improve Requirements Gathering blueprint

      2.3.1 Identify critical and nice-to-have features

      Central Data Repository: Collection of stored data from existing databases merged into one location that can then be shared, analyzed, or updated.

      Automatic Data Collection: Ability to automate data flows, collect responses from multiple sources at specified intervals, and check them against acceptance criteria.

      Automatic KPI Calculations, Conversions, and Updates: Company-specific metrics can be automatically calculated, converted, and tracked.

      Built-In Indicator Catalogs and Benchmarking: Provides common recognized frameworks or can integrate a catalog of ESG indicators.

      Custom Reporting: Ability to create reports on company emissions, energy, and asset data in company-branded templates.

      User-Based Access and Permissions: Ability to control access to specific content or data sets based on the end user’s roles.

      Real-Time Capabilities: Ability to analyze and visualize data as soon as it becomes available in underlying systems.

      Version Control: Tracking of document versions with each iteration of document changes.

      Intelligent Alerts and Notifications: Ability to create, manage, send, and receive notifications, enhancing efficiency and productivity.

      Audit Trail: View all previous activity including any recent edits and user access.

      Encrypted File Storage and Transfer: Ability to encrypt a file before transmitting it over the network to hide content from being viewed or extracted.

      Activity 7: Technology and tooling options

      Input: Business (ESG) strategy, Data inventory (if exists), Asset inventory (if exists), Output from Activity 5, Output from Activity 6,
      Output: List of tooling options
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Head of ESG Reporting, Business leaders, Data analysts, Data and IT architect/leaders

      1-2 hours

      1. Begin by listing key requirements and features for your ESG reporting program.
      2. Use the outputs from activities 5 and 6 and the technology feature list on the previous slide to help brainstorm technology and tooling options.
      3. Discuss the availability and readiness of each option. Note that regulatory requirements will have an effective date that will impact the time to market for introducing new tooling.
      4. Discuss and assign a priority.
      5. At this point, further analysis may be needed. Form a subcommittee or assign a leader to conduct further analysis.
      6. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      Activity 8: Implementation plan

      Input: Business (ESG) strategy, Output from Activity 5, Output from Activity 6, Output from Activity 7
      Output: ESG Reporting Implementation Plan
      Materials: Whiteboard/flip charts, ESG Reporting Implementation Plan Template
      Participants: Chief Sustainability Officer, Head of ESG Reporting, Business leaders, Data analysts, PMO, Data and IT architect/leaders

      1-2 hours

      1. Use the outputs from activities 5 to 7 and list required implementation tasks. Set a priority for each task.
      2. Assign the accountable owner as well as the group responsible. Larger organizations and large, complex change programs will have a group of owners.
      3. Track any dependencies and ensure the project timeline aligns.
      4. Add status as well as start and end dates.
      5. Complete in the ESG Reporting Implementation Plan Template.

      Download the ESG Reporting Implementation Plan Template

      Activity 9: Internal communication

      Input: Business (ESG) strategy, ESG Reporting Workbook, ESG reporting implementation plan
      Output: ESG Reporting Presentation Template
      Materials: Whiteboard/flip charts, ESG Reporting Presentation Template, Internal communication templates
      Participants: Chief Sustainability Officer, Head of Marketing/ Communications, Business leaders, PMO

      1-2 hours

      Since a purpose-driven ESG program presents a significant change in how organizations operate, the goals and intentions need to be understood throughout the organization. Once you have developed your ESG reporting strategy it is important that it is communicated, understood, and accepted. Use the ESG Reporting Presentation Template as a guide to deliver your story.

      1. Consider your audience and discuss and agree on the key elements you want to convey.
      2. Prepare the presentation.
      3. Test the presentation with smaller group before communicating to senior leadership/board

      Download the ESG Reporting Presentation Template

      Phase 3

      Select ESG Reporting Software

      A diagram that shows phase 1 to 3 of establishing ESG reporting program.

      This phase will provide additional material on Info-Tech’s expertise in the following areas:

      • Info-Tech’s approach to RFPs
      • Info-Tech tools for software selection
      • Example ESG software assessments

      3.1 Leverage Info-Tech’s expertise

      Develop an inclusive and thorough approach to the RFP process

      An image that a process of 7 steps.

      The Info-Tech difference:

      1. The secret to managing an RFP is to make it as manageable and as thorough as possible. The RFP process should be like any other aspect of business – with a standard process in place, you are better able to handle whatever comes your way, because you know the steps you need to follow to produce a top-notch RFP.
      2. The business then identifies the need for more information about a product/service or determines that a purchase is required.
      3. A team of stakeholders from each area impacted gather all business, technical, legal, and risk requirements. What are the expectations of the vendor relationship post-RFP? How will the vendors be evaluated?
      4. Based on predetermined requirements, either an RFI or an RFP is issued to vendors with a due date.

      Info-Tech Insight

      Review Info-Tech’s process and understand how you can prevent your organization from leaking negotiation leverage while preventing vendors from taking control of your RFP.

      Software Selection Engagement

      5 Advisory Calls Over a 5-Week Period to Accelerate Your Selection Process

      Expert Analyst Guidance over5 weeks on average to select and negotiate software.

      Save Money, Align Stakeholders, Speed Up the Process & make better decisions.

      Use a Repeatable, Formal Methodology to improve your application selection process.

      Better, Faster Results, guaranteed, included in membership.

      A diagram of selection engagement over a 5-week period.

      CLICK HERE to Book Your Selection Engagement

      Leverage the Contract Review Service to level the playing field with your shortlisted vendors

      You may be faced with multiple products, services, master service agreements, licensing models, service agreements, and more.

      Use the Contract Review Service to gain insights on your agreements.

      Consider the aspects of a contract review:

      1. Are all key terms included?
      2. Are they applicable to your business?
      3. Can you trust that results will be delivered?
      4. What questions should you be asking from an IT perspective?

      Validate that a contract meets IT’s and the business’ needs by looking beyond the legal terminology. Use a practical set of questions, rules, and guidance to improve your value for dollar spent.

      A photo of Contract Review Service.

      Click here to book The Contract Review Service

      Download blueprint Master Contract Review and Negotiation for Software Agreements

      3.2 Vendor spotlight assessments

      See above for a vendor landscape overview of key ESG reporting software providers

      The purpose of this section is to showcase various vendors and companies that provide software solutions to help users manage and prioritize their ESG reporting initiatives.

      This section showcases the core capabilities of each software platform to provide Info-Tech members with industry insights regarding some of the key service providers that operate within the ESG vendor market landscape.

      Info-Tech members who are concerned with risks stemming from the inability to sort and disseminate unstructured ESG data reporting metrics or interested in learning more about software offerings that can help automate the data collection, processing, and management of ESG metrics will find high-level insights into the ESG vendor market space.

      Vendor spotlight

      A photo of Datamine Isystain

      The establishment of the Datamine ESG unit comes at the same time the mining sector is showing an increased interest in managing ESG and its component systems as part of a single scope.

      With miners collecting and dealing with ever-increasing quantities of data and looking for ways to leverage it to make data-driven decisions that enhance risk management and increase profitability, integrated software solutions are – now more than ever – essential in supporting continuous improvement and maintaining data fidelity and data integrity across the entire mining value chain.

      An example of Datamine Isystain An example of Datamine Isystain An example of Datamine Isystain

      Key Features:

      • Discover GIS for geochemical, water, erosion, and vegetation modelling and management.
      • Qmed for workforce health management, COVID testing, and vaccine administration.
      • MineMarket and Reconcilor for traceability and auditing, giving visibility to chain of custody and governance across the value chain, from resource modelling to shipping and sales.
      • Centric Mining Systems – intelligence software for real-time transparency and governance across multiple sites and systems, including key ESG performance indicator reporting.
      • Zyght – a leading health, safety, and environment solution for high-impact industries that specializes in environment, injury, risk management, safe work plans, document management, compliance, and reporting.
      • Isystain – a cloud-based platform uniquely designed to support health, safety & environment, sustainability reporting, compliance and governance, and social investment reporting. Designed for seamless integration within an organization’s existing software ecosystems providing powerful analytics and reporting capabilities to streamline the production of sustainability and performance reporting.

      Vendor spotlight

      A logo of Benchmark ESG

      Benchmark ESG provides industry-leading ESG data management and reporting software that can assist organizations in managing operational risk and compliance, sustainability, product stewardship, and ensuring responsible sourcing across complex global operations.

      An example of Benchmark ESG An example of Benchmark ESG

      Key Features:

      Vendor spotlight

      A logo of PWC

      PwC’s ESG Management Solution provides quick insights into ways to improve reporting transparency surrounding your organization’s ESG commitments.

      According to PwC’s most recent CEO survey, the number one motivator for CEOs in mitigating climate change risks is their own desire to help solve this global problem and drive transparency with stakeholders.
      Source: “Annual Global CEO Survey,” PwC, 2022.

      An example of PWC An example of PWC

      Key Features:

      • Streamlined data mining capabilities. PwC’s ESG solution provides the means to streamline, automate, and standardize the input of sustainability data based on non-financial reporting directive (NFRD) and corporate sustainability reporting directive (CSRD) regulations.
      • Company and product carbon footprint calculation and verification modules.
      • Robust dashboarding capabilities. Option to create custom-tailored sustainability monitoring dashboards or integrate existing ESG data from an application to existing dashboards.
      • Team management functionalities that allow for more accessible cross-departmental communication and collaboration. Ability to check progress on tasks, assign tasks, set automatic notifications/deadlines, etc.

      Vendor spotlight

      A logo of ServiceNow

      ServiceNow ESG Management (ESGM) and reporting platform helps organizations transform the way they manage, visualize, and report on issues across the ESG spectrum.

      The platform automates the data collection process and the organization and storage of information in an easy-to-use system. ServiceNow’s ESGM solution also develops dashboards and reports for internal user groups and ensures that external disclosure reports are aligned with mainstream ESG standards and frameworks.

      We know that doing well as a business is about more than profits. One workflow at a time, we believe we can change the world – to be more sustainable, equitable, and ethical.
      Source: ServiceNow, 2021.

      An example of ServiceNow

      Key Features:

      1. An executive dashboard to help coherently outline the status of various ESG indicators, including material topics, goals, and disclosure policies all in one centralized hub
      2. Status review modules. Ensure that your organization has built-in modules to help them better document and monitor their ESG goals and targets using a single source of truth.
      3. Automated disclosure modules. ESGM helps organizations create more descriptive ESG disclosure reports that align with industry accountability standards (e.g. SASB, GRI, CDP).

      Other key vendors to consider

      An image of other 12 key vendors

      Related Info-Tech Research

      Photo of The ESG Imperative and Its Impact on Organizations

      The ESG Imperative and Its Impact on Organizations

      Use this blueprint to educate yourself on ESG factors and the broader concept of sustainability.

      Identify changes that may be needed in your organizational operating model, strategy, governance, and risk management approach.

      Learn about Info-Tech’s ESG program approach and use it as a framework to begin your ESG program journey.

      Photo of Private Equity and Venture Capital Growing Impact of ESG Report

      Private Equity and Venture Capital Growing Impact of ESG Report

      Increasingly, new capital has a social mandate attached to it due to the rise of ESG investment principles.

      Learn about how the growing impact of ESG affects both your organization and IT specifically, including challenges and opportunities, with expert assistance.

      Definitions

      Terms

      Definition

      Corporate Social Responsibility

      Management concept whereby organizations integrate social and environmental concerns in their operations and interactions with their stakeholders.

      Chief Sustainability Officer

      Steers sustainability commitments, helps with compliance, and helps ensure internal commitments are met. Responsibilities may extend to acting as a liaison with government and public affairs, fostering an internal culture, acting as a change agent, and leading delivery.

      ESG

      An acronym that stands for environment, social, and governance. These are the three components of a sustainability program.

      ESG Standard

      Contains detailed disclosure criteria including performance measures or metrics. Standards provide clear, consistent criteria and specifications for reporting. Typically created through consultation process.

      ESG Framework

      A broad contextual model for information that provides guidance and shapes the understanding of a certain topic. It sets direction but does not typically delve into the methodology. Frameworks are often used in conjunction with standards.

      ESG Factors

      The factors or issues that fall under the three ESG components. Measures the sustainability performance of an organization.

      ESG Rating

      An aggregated score based on the magnitude of an organization’s unmanaged ESG risk. Ratings are provided by third-party rating agencies and are increasingly being used for financing, transparency to investors, etc.

      ESG Questionnaire

      ESG surveys or questionnaires are administered by third parties and used to assess an organization’s sustainability performance. Participation is voluntary.

      Key Risk Indicator (KRI)

      A measure to indicate the potential presence, level, or trend of a risk.

      Key Performance Indicator (KPI)

      A measure of deviation from expected outcomes to help a firm see how it is performing.

      Materiality

      Material topics are topics that have a direct or indirect impact on an organization's ability to create, preserve, or erode economic, environmental, and social impact for itself and its stakeholder and society as a whole.

      Materiality Assessment

      A tool to identify and prioritize the ESG issues most critical to the organization.

      Risk Sensing

      The range of activities carried out to identify and understand evolving sources of risk that could have a significant impact on the organization (e.g. social listening).

      Sustainability

      The ability of an organization and broader society to endure and survive over the long term by managing adverse impacts well and promoting positive opportunities.

      Sustainalytics

      Now part of Morningstar. Sustainalytics provides ESG research, ratings, and data to institutional investors and companies.

      UN Guiding Principles on Business and Human Rights (UNGPs)

      An essential methodological foundation for how impacts across all dimensions should be assessed.

      Reporting and standard frameworks

      Standard

      Definition and focus

      CDP
      (Formally Carbon Disclosure Project)

      CDP has created standards and metrics for comparing sustainability impact. Focuses on environmental data (e.g. carbon, water, and forests) and on data disclosure and benchmarking.

      Audience: All stakeholders

      Dow Jones Sustainability Indices (DJSI)

      Heavy on corporate governance and company performance. Equal balance of economic, environmental, and social.

      Audience: All stakeholders

      Global Reporting Initiative (GRI)

      International standards organization that has a set of standards to help organizations understand and communicate their impacts on climate change and social responsibility. The standard has a strong emphasis on transparency and materiality, especially on social issues.

      Audience: All stakeholders

      International Sustainability Standards Board (ISSB)

      Standard-setting board that sits within the International Financial Reporting Standards (IFRS) Foundation. The IFRS Foundation is a not-for-profit, public-interest organization established to develop high-quality, understandable, enforceable, and globally accepted accounting and sustainability disclosure standards.

      Audience: Investor-focused

      United Nations Sustainable Development Goals (SDGs)

      Global partnership across sectors and industries that sets out 17 goals to achieve sustainable development for all.

      Audience: All stakeholders

      Sustainability Accounting Standards Board (SASB)
      Now part of IFSR foundation

      Industry-specific standards to help corporations select topics that may impact their financial performance. Focus on material impacts on financial condition or operating performance.

      Audience: Investor-focused

      Task Force on Climate-Related Financial Disclosures (TCFD; created by the Financial Stability Board)

      Standards framework focused on the impact of climate risk on financial and operating performance. More broadly the disclosures inform investors of positive and negative measures taken to build climate resilience and make transparent the exposure to climate-related risk.

      Audience: Investors, financial stakeholders

      Bibliography

      "2021 Global Investor Survey: The Economic Realities of ESG." PwC, Dec. 2021. Accessed May 2022.

      "2023 Canadian ESG Reporting Insights." PwC, Nov. 2022. Accessed Dec. 2022.

      Althoff, Judson. "Microsoft Cloud for Sustainability: Empowering Organizations On Their Path To Net Zero." Microsoft Blog, 14 July 2021. Accessed May 2022.

      "Balancing Sustainability and Profitability." IBM, Feb. 2022. Accessed June. 2022.

      "Beyond Compliance: Consumers and Employees Want Business to Do More on ESG." PwC, Nov. 2021. Accessed July 2022.

      Bizo, Daniel. "Multi-Tenant Datacenters and Sustainability: Ambitions and Reality." S&P Market Intelligence, Sept. 2020. Web.

      Bolden, Kyle. "Aligning nonfinancial reporting with your ESG strategy to communicate long-term value." EY, 18 Dec. 2020. Web.

      Carril, Christopher, et al. "Looking at Restaurants Through an ESG Lens: ESG Stratify – Equity Research Report." RBC Capital Markets, 5 Jan. 2021. Accessed Jun. 2022.

      "Celebrating and Advancing Women." McDonald’s, 8 March 2019. Web.

      Clark, Anna. "Get your ESG story straight: A sustainability communication starter kit." GreenBiz, 20 Dec. 2022, Accessed Dec. 2022.

      Courtnell, Jane. “ESG Reporting Framework, Standards, and Requirements.” Corporate Compliance Insights, Sept. 2022. Accessed Dec. 2022.

      “Country Sustainability Ranking. Country Sustainability: Visibly Harmed by Covid-19.” Robeco, Oct. 2021. Accessed June 2022.

      “Defining the “G” in ESG Governance Factors at the Heart of Sustainable Business.” World Economic Forum, June 2022. Web.

      “Digital Assets: Laying ESG Foundations.” Global Digital Finance, Nov. 2021. Accessed April 2022.

      “Dow Jones Sustainability Indices (DJCI) Index Family.” S&P Global Intelligence, n.d. Accessed June 2022.

      "ESG in Your Business: The Edge You Need to Land Large Contracts." BDC, March 2023, Accessed April 2023.

      “ESG Performance and Its Impact on Corporate Reputation.” Intelex Technologies, May 2022. Accessed July 2022.

      “ESG Use Cases. IoT – Real-Time Occupancy Monitoring.” Metrikus, March 2021. Accessed April 2022.

      Fanter, Tom, et al. “The History & Evolution of ESG.” RMB Capital, Dec. 2021. Accessed May 2022.

      Flynn, Hillary, et al. “A guide to ESG materiality assessments.” Wellington Management, June 2022, Accessed September 2022

      “From ‘Disclose’ to ‘Disclose What Matters.’” Global Reporting Initiative, Dec. 2018. Accessed July 2022.

      “Getting Started with ESG.” Sustainalytics, 2022. Web.

      “Global Impact ESG Fact Sheet.” ServiceNow, Dec. 2021. Accessed June 2022.

      Gorley, Adam. “What is ESG and Why It’s Important for Risk Management.” Sustainalytics, March 2022. Accessed May 2022.

      Hall, Lindsey. “You Need Near-Term Accountability to Meet Long-Term Climate Goals.” S&P Global Sustainable1, Oct. 2021. Accessed April 2022.

      Henisz, Witold, et al. “Five Ways That ESG Creates Value.” McKinsey, Nov. 2019. Accessed July 2022.

      “Integrating ESG Factors in the Investment Decision-Making Process of Institutional Investors.” OECD iLibrary, n.d. Accessed July 2022.

      “Investor Survey.” Benchmark ESG, Nov. 2021. Accessed July 2022.

      Jackson, Brian. Tech Trends 2023, Info-Tech Research Group, Dec. 2022, Accessed Dec. 2022.

      Keet, Lior. “What Is the CIO’s Role in the ESG Equation?” EY, 2 Feb. 2022. Accessed May 2022.

      Lev, Helee, “Understanding ESG risks and why they matter” GreenBiz, June 2022. Accessed Dec 2022.

      Marsh, Chris, and Simon Robinson. “ESG and Technology: Impacts and Implications.” S&P Global Market Intelligence, March 2021. Accessed April 2022.

      Martini, A. “Socially Responsible Investing: From the Ethical Origins to the Sustainable Development Framework of the European Union.” Environment, Development and Sustainability, vol. 23, Nov. 2021. Web.

      Maher, Hamid, et al. “AI Is Essential for Solving the Climate Crisis.” Boston Consulting Group, 7 July 2022. Web.

      “Materiality Assessment. Identifying and Taking Action on What Matters Most.” Novartis, n.d. Accessed June. 2022.

      Morrow, Doug, et al. “Understanding ESG Incidents: Key Lessons for Investors.” Sustainalytics, July 2017. Accessed May 2022.

      “Navigating Climate Data Disclosure.” Novisto, July 2022. Accessed Nov. 2022.

      Nuttall, Robin, et al. “Why ESG Scores Are Here to Stay.” McKinsey & Company, May 2020. Accessed July 2022.

      “Opportunities in Sustainability – 451 Research’s Analysis of Sustainability Perspectives in the Data Center Industry.” Schneider Electric, Sept. 2020. Accessed May 2022.

      Peterson, Richard. “How Can NLP Be Used to Quantify ESG Analytics?” Refinitiv, Feb. 2021. Accessed June 2022.

      “PwC’s 25th Annual Global CEO Survey: Reimagining the Outcomes That Matter.” PwC, Jan. 2022. Accessed June 2022.

      “SEC Proposes Rules on Cybersecurity, Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” Securities and Exchange Commission, 9 May 2022. Press release.

      Serafeim, George. “Social-Impact Efforts That Create Real Value.” Harvard Business Review, Sept. 2020. Accessed May 2022.

      Sherrie, Gonzalez. “ESG Planning and Performance Survey.” Diligent, 24 Sept. 2021. Accessed July 2022.

      “Special Reports Showcase, Special Report: Mid-Year Report on Proposed SEC Rule 14-8 Change.” Sustainable Investments Institute, July 2020. Accessed April 2022.

      “State of European Tech. Executive Summary Report.” Atomico, Nov. 2021. Accessed June 2022.

      “Top Challenges in ESG Reporting, and How ESG Management Solution Can Help.” Novisto, Sept. 2022. Accessed Nov. 2022.

      Vaughan-Smith, Gary. “Navigating ESG data sets and ‘scores’.” Silverstreet Capital, 23 March 2022. Accessed Dec. 2022.

      Waters, Lorraine. “ESG is not an environmental issue, it’s a data one.” The Stack, 20 May 2021. Web.

      Wells, Todd. “Why ESG, and Why Now? New Data Reveals How Companies Can Meet ESG Demands – And Innovate Supply Chain Management.” Diginomica, April 2022. Accessed July 2022.

      “XBRL is coming to corporate sustainability Reporting.” Novisto, Aug. 2022. Accessed Dec. 2022.

      Research Contributors and Experts

      Photo of Chris Parry

      Chris Parry
      VP of ESG, Datamine

      Chris Parry has recently been appointed as the VP of ESG at Datamine Software. Datamine’s dedicated ESG division provides specialized ESG technology for sustainability management by supporting key business processes necessary to drive sustainable outcomes.

      Chris has 15 years of experience building and developing business for enterprise applications and solutions in both domestic and international markets.

      Chris has a true passion for business-led sustainable development and is focused on helping organizations achieve their sustainable business outcomes through business transformation and digital software solutions.

      Datamine’s comprehensive ESG capability supports ESG issues such as the environment, occupational health and safety, and medical health and wellbeing. The tool assists with risk management, stakeholder management and business intelligence.

      COVID-19 Work Status Tracking Guide

      • Buy Link or Shortcode: {j2store}594|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Manage & Coach
      • Parent Category Link: /manage-coach
      • Keeping track of the multiple and frequently changing work arrangements on your team.
      • Ensuring you have a fast and easy way to keep an up-to-date record of where and how employees are working.

      Our Advice

      Critical Insight

      • During these critical times, keeping track of employees’ work status doesn’t have to be complicated – the right tool is one that does the job.
      • Keeping track of your employees is a health and safety issue – deployed well, it is an aid in keeping the business running and an additional communication channel, not a sign of lack of trust.

      Impact and Result

      • An Excel spreadsheet is all you need to ensure you have a way to record work arrangements that can change by the day.
      • An easy-to-use tool means minimal administrative overhead to ensuring you have this critical information at hand.

      COVID-19 Work Status Tracking Guide Research & Tools

      Start here – read the Work Status Tracking Guide

      Read our recommendations and use the accompanying tool to quickly get a handle on your team’s work arrangements.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • COVID-19 Work Status Tracking Guide Storyboard
      • COVID-19 Work Status Tracking Tool
      [infographic]

      Build a Data Warehouse

      • Buy Link or Shortcode: {j2store}200|cart{/j2store}
      • member rating overall impact: 8.7/10 Overall Impact
      • member rating average dollars saved: $94,499 Average $ Saved
      • member rating average days saved: 30 Average Days Saved
      • Parent Category Name: Big Data
      • Parent Category Link: /big-data
      • Relational data warehouses, although reliable, centralized repositories for corporate data, were not built to handle the speed and volume of data and analytics today.
      • IT is under immense pressure from business units to provide technology that will yield greater agility and insight.
      • While some organizations are benefitting from modernization technologies, the majority of IT departments are unfamiliar with the technologies and have not yet defined clear use cases.

      Our Advice

      Critical Insight

      • The vast majority of your corporate data is not being properly leveraged. Modernize the data warehouse to get value from the 80% of unstructured data that goes unused.
      • Avoid rip and replace. Develop a future state that complements your existing data warehouse with emerging technologies.
      • Be flexible in your roadmap. Create an implementation roadmap that’s incremental and adapts to changing business priorities.

      Impact and Result

      • Establish both the business and IT perspectives of today’s data warehouse environment.
      • Explore the art-of-the-possible. Don’t get stuck trying to gather technical requirements from business users who don’t know what they don’t know. Use Info-Tech’s interview guide to discuss the pains of the current environment, and more importantly, where stakeholders want to be in the future.
      • Build an internal knowledgebase with respect to emerging technologies. The technology landscape is constantly shifting and often difficult for IT staff to keep track of. Use Info-Tech’s Data Warehouse Modernization Technology Education Deck to ensure that IT is able to appropriately match the right tools to the business’ use cases.
      • Create a compelling business case to secure investment and support.

      Build a Data Warehouse Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should be looking to modernize the relational data warehouse, review Info-Tech’s framework for identifying modernization opportunities, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Assess the current data warehouse environment

      Review the business’ perception and architecture of the current data warehouse environment.

      • Drive Business Innovation With a Modernized Data Warehouse Environment – Phase 1: Assess the Current Data Warehouse Environment
      • Data Warehouse Maturity Assessment Tool

      2. Define modernization drivers

      Collaborate with business users to identify the strongest motivations for data warehouse modernization.

      • Drive Business Innovation With a Modernized Data Warehouse Environment – Phase 2: Define Modernization Drivers
      • Data Warehouse Modernization Stakeholder Interview Guide
      • Data Warehouse Modernization Technology Education Deck
      • Data Warehouse Modernization Initiative Building Tool

      3. Create the modernization future state

      Combine business ideas with modernization initiatives and create a roadmap.

      • Drive Business Innovation With a Modernized Data Warehouse Environment – Phase 3: Create the Modernization Future State
      • Data Warehouse Modernization Technology Architectural Template
      • Data Warehouse Modernization Deployment Plan
      [infographic]

      Workshop: Build a Data Warehouse

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Assess the Current Data Warehouse Environment

      The Purpose

      Discuss the general project overview for data warehouse modernization.

      Establish the business and IT perspectives of the current state.

      Key Benefits Achieved

      Holistic understanding of the current data warehouse.

      Business user engagement from the start of the project.

      Activities

      1.1 Review data warehouse project history.

      1.2 Evaluate data warehouse maturity.

      1.3 Draw architecture diagrams.

      1.4 Review supporting data management practices.

      Outputs

      Data warehouse maturity assessment

      Data architecture diagrams

      2 Explore Business Opportunities

      The Purpose

      Conduct a user workshop session to elicit the most pressing needs of business stakeholders.

      Key Benefits Achieved

      Modernization technology selection is directly informed by business drivers.

      In-depth IT understanding of the business pains and opportunities.

      Activities

      2.1 Review general trends and drivers in your industry.

      2.2 Identify primary business frustrations, opportunities, and risks.

      2.3 Identify business processes to target for modernization.

      2.4 Capture business ideas for the future state.

      Outputs

      Business ideas for modernization

      Defined strategic direction for data warehouse modernization

      3 Review the Technology Landscape

      The Purpose

      Educate IT staff on the most common technologies for data warehouse modernization.

      Key Benefits Achieved

      Improved ability for IT to match technology with business ideas.

      Activities

      3.1 Appoint Modernization Advisors.

      3.2 Hold an open education and discussion forum for modernization technologies.

      Outputs

      Modernization Advisors identified

      Modernization technology education deck

      4 Define Modernization Solutions

      The Purpose

      Consolidate business ideas into modernization initiatives.

      Key Benefits Achieved

      Refinement of the strategic direction for data warehouse modernization.

      Activities

      4.1 Match business ideas to technology solutions.

      4.2 Group similar ideas to create modernization initiatives.

      4.3 Create future-state architecture diagrams.

      Outputs

      Identified strategic direction for data warehouse modernization

      Defined modernization initiatives

      Future-state architecture for data warehouse

      5 Establish a Modernization Roadmap

      The Purpose

      Validate and build out initiatives with business users.

      Define benefits and costs to establish ROI.

      Identify enablers and barriers to modernization.

      Key Benefits Achieved

      Completion of materials for a compelling business case and roadmap.

      Activities

      5.1 Validate use cases with business users.

      5.2 Define initiative benefits.

      5.3 Identify enablers and barriers to modernization.

      5.4 Define preliminary activities for initiatives.

      5.5 Evaluate initiative costs.

      5.6 Determine overall ROI.

      Outputs

      Validated modernization initiatives

      Data warehouse modernization roadmap

      Make Sense of Strategic Portfolio Management

      • Buy Link or Shortcode: {j2store}447|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Portfolio Management
      • Parent Category Link: /portfolio-management
      • As an IT leader, you’re responsible for steering the realization of business strategy through wise investments in and responsible stewardship of assets, applications, portfolios, programs, products, and projects.
      • You need a tool to help align goals and facilitate processes across business units. You’re aware of a tool space called Strategic Portfolio Management, and it looks like it could help, but you’re unsure of how it’s different from some of the existing tools you already pay for and don’t use to their full functionality.

      Our Advice

      Critical Insight

      As a software space, strategic portfolio management lacks a unified definition. In the same way that it took many years for project portfolio management to stabilize as a concept distinct from traditional enterprise project management, strategic portfolio management is experiencing a similar period of formational uncertainty. Unpacking what’s truly new and valuable in helping to define strategy and drive strategic outcomes versus what’s just repackaged as SPM is an important first step, but it's not an easy undertaking.

      Impact and Result

      In this concise publication, we will cut through the marketing to unpack what strategic portfolio management is, and what makes it distinct from similar capabilities. We’ll help to situate you in the space and assess the extent to which your tooling needs can be met by a strategic portfolio management offering.

      Make Sense of Strategic Portfolio Management Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Make Sense of Strategic Portfolio Management Storyboard – A guide to help you drive strategic outcomes.

      In this concise publication we introduce you to strategic portfolio management and consider the extent to which your organization can leverage an SPM application to help drive strategic outcomes.

      • Make Sense of Strategic Portfolio Management Storyboard

      2. Strategic Portfolio Management Needs Assessment Tool – Use this tool to determine if your organization can benefit from the features and functionality of an SPM approach.

      Use this Excel workbook to determine if your organization can benefit from the features and functionality of an SPM approach or whether you need something more like a traditional project portfolio management tool.

      • Strategic Portfolio Management Needs Assessment
      [infographic]

      Further reading

      Make Sense of Strategic Portfolio Management

      Separate what's new and valuable from bloated claims on the hype cycle.

      Analyst Perspective

      Do you need strategic portfolio management, or do you need to do portfolio management more strategically?

      Travis Duncan, Research Director, PPM and CIO Strategy

      Travis Duncan
      Research Director, PPM and CIO Strategy
      Info-Tech Research Group

      While the market is eager to get users into what they're calling "strategic portfolio management," there's a lot of uncertainty out there about what this market is and how it's different from other, more established portfolio disciplines – most significantly, project portfolio management.

      Indeed, if you look at how the space is covered within the industry, you'll encounter a dog's breakfast of players, a comparison of apples and oranges: Jira in the same quadrants as Planisware, Smartsheets in the same profiles as Planview and ServiceNow. While each of the individual players is impressive, their areas of focus are unique and the extent to which they should be compared together under the category of strategic portfolio management is questionable.

      It speaks to some of the grey area within the SPM space more generally, which is at a bit of a crossroads: Will it formally shed the guardrails of its antecedents to become its own space, or will it devolve into a bait and switch through which capabilities that struggled to gain much traction beyond IT settings seek to infiltrate the business and grow their market share under a different name?

      Part of it is up to the rest of us as users and potential customers. Clarifying what we need before we jump into something simply because our prior attempts failed will help determine whether we need a unique space for strategic portfolio management or whether we simply need to do portfolio management more strategically.

      Executive Summary

      Your Challenge Common Obstacles Info-Tech's Approach
      • As an IT leader, you're responsible for steering the realization of business strategy through wise investments in/ and responsible stewardship of: assets, applications, portfolios, programs, products, and projects.
      • You need a tool to help align goals and facilitate processes and communications across business units. You're aware of a tool space called strategic portfolio management, and it looks like it could help, but you're unsure of how it's different from some of the existing tools you already license.
      • As a software space, strategic portfolio management lacks a unified definition. Unpacking what's truly new in helping to define strategy and drive strategic outcomes versus what's just repackaged as SPM is no small undertaking.
      • Because SPM can span different business units, ways of working, and roles, getting buy-in, alignment, and adoption can be even more precarious than it is when implementing other types of solutions.
      • In this concise publication, we will cut through the marketing to unpack what strategic portfolio management is and what makes it distinct from similar capabilities.
      • Assess the extent to which your tooling needs can be met by a strategic portfolio management offering or the extent to which you may need to look at other software categories.
      • With a better understanding of the space, we hope to help facilitate better internal discussions around the value of SPM for your business needs.

      Info-Tech Insight
      In the same way that it took many years for PPM to stabilize as a concept distinct from traditional enterprise project management, strategic portfolio management is experiencing a similar period of formational uncertainty. In a space that can be all things to all users, clarify your actual needs before jumping onto a bandwagon and ending up with something that you don't need, and that the organization can't adopt.

      Strategic portfolio management is enterprise portfolio management

      Evolved from various other capabilities and vendor solutions, strategic portfolio management (SPM) seeks to connect strategy to execution.

      While the concept of 'strategic portfolio management' has been written about within project portfolio management circles for nearly 20 years, SPM, as a distinct organizational competence and software category, is a relatively new and largely vendor-driven capability.

      First emerging in the discourse during the mid-to-late 2010s, SPM has evolved from its roots in traditional enterprise project portfolio management. Though, as we will discuss, it has other antecedents not limited to PPM.

      In this publication, we'll unpack what SPM is, how it is distinct (and, in turn, how it is not distinct) from PPM and other capabilities, and we will consider the extent to which your organization can and should leverage an SPM application to help drive strategic outcomes.

      –The increasing need to deliver value from digital initiatives is giving rise to strategic portfolio management, a digital investment management discipline that enables strategy realization in complex dynamic environments."
      – OnePlan, "Is Strategic Portfolio Management the Future of PPM?"

      Only 2% of business leaders are confident that they will achieve 80% to 100% of their strategic objectives.
      Source: Smith, 2022

      Put strategic portfolio management in context

      SPM is a new stage in the history of project portfolio management more generally. While it's emerging as a distinct capability, and it borrows from capabilities beyond PPM, unpacking its distinctiveness is best done by first understanding its source.

      Understand the recent triggers for strategic portfolio management

      Triggers for the emergence of strategic portfolio management in the discourse include the pace of technology-introduced change, the waning of enterprise project management, and challenges around enterprise PPM tool adoption.

      Spot the difference?

      Scope, focus, and audience are just a few of the factors distinguishing what the market calls "SPM" from traditional PPM.

      Project Portfolio Management Differentiator Strategic Portfolio Management
      Work-Level (Tactical) Primary Orientation High-Level (Strategic)
      CIO Accountable for Outcomes CxO
      Project Manager Responsible for Outcomes Product Management Organization
      Project Managers, PMO Staff Targeted Users Business Leaders, ePMO Staff
      Project Portfolio(s) Essential Scope Multi-Portfolio (Project, Application, Product, Program, etc.)
      IT Project Delivery and Business Results Delivery Core Focus Business Strategy and Change Delivery
      Project Scope Change Impact Sensitivity Enterprise Scope
      IT and/or Business Benefit Language of Value Value Stream
      Project Timelines Main View Strategy Roadmaps
      Resource Capacity Primary Currency Money
      Work-Assignment Details Modalities of Planning Value Milestones & OKRs
      Work Management Modalities of Execution Governance (Project, Product, Strategy, Program, etc.)
      Project Completion Definitions of "Done" Business Capability Realization

      Info-Tech Insight
      The distinction between the two capabilities is not necessarily as black and white as the table above would have it (some "PPM" tools offer what we're identifying above as "SPM" capabilities), but it can be helpful to think in these binaries when trying to distinguish the two capabilities. At the very least, SPM broadens its scope to target more executive and business users, and functions best when it's speaking at a higher level, to a business audience.

      Strategic portfolio management offers a more holistic view of the enterprise

      At its best, strategic portfolio management can accommodate various paradigms of work management and incorporate different types of portfolio management.

      Perhaps the biggest evolution from traditional PPM that strategic portfolio management promises is that it casts a wider net in terms of the types of work it tracks (and how it tracks that work) and the types of portfolios it accommodates.

      Not bound to the concepts of "projects" and a "project portfolio" specifically, SPM broadens its scope to encompass capabilities like product and product portfolio management, enterprise architecture management, security and risk management, and more.

      • Where a PPM solution only shows one piece of the puzzle, SPM looks at the entire investment ecosystem, tracking strategic goals, the ideas generated to help achieve those goals, and all the various kinds of investments made in the service of those goals.
      • what's more, where traditional PPM tools required users to adhere to a certain way of working and managing tasks, SPM is more flexible, relying on integrations across various ways of working to provide higher-level insight on the progress of work and the achievement of goals.

      Deliver business strategy and change effectively

      Info-Tech's Strategic Portfolio Management Framework

      "An SPM tool will capture business strategy, business capabilities, operating models, the enterprise architecture and the project portfolio with unmatched visibility into how they all relate. This will give...a robust understanding of the impact of a proposed IT change " and enable IT and business to act like cocreators driving innovation."
      – Paula Ziehr

      You might need a strategic portfolio management tool if–

      If you find yourself facing any of these situations, it might be time to step away from your PPM tool and into an SPM approach:

      • Your organization is facing a large implementation that will cross multiple departmental units and requires alignment across senior leadership (e.g. a digital transformation initiative).
      • You currently have disparate systems tracking different portfolios (project, product, applications, etc.) and types of investments, but lack insight into the whole in terms of how work efforts and investments tie back to strategy realization.
      • You are an ePMO or a strategy realization office that doesn't manage work necessarily, but that rather ensures that the work, assets, and capabilities that are funded connect to strategy and drive the realization of strategy.

      Sixty one percent of leaders acknowledge their companies struggle to bridge the gap between creating a strategy and executing on that strategy.
      Source: StrategyBlocks, 2020

      Get to know your strategic portfolio management stakeholders

      In terms of users, SPM's focus is further up the org chart than most applications, relying on high-level but usable outputs to help drive decision making.

      ePMO or Strategy Realization Office Senior Leadership and Executive Stakeholders Business Leads and IT Directors and Managers
      SPM tools are best facilitated through enterprise PMOs or strategy realization offices. After all, in enterprises, these are the entities charged with the planning, execution, and tracking of strategy.

      Their roles within the tool typically entail:

      • Helping to facilitate processes and collect data.
      • Data quality and curation.
      • Report distribution and consumption.
      As those with the accountability and authority to drive the organization's strategy, you could argue that these stakeholders are the primary stakeholders for an SPM tool.

      Their roles within the tool typically entail:

      • Using strategy map and ideation functionalities.
      • Using reports to steward strategy realization.
      SPM targets more business users as well as senior IT managers and directors.

      Their roles within the tool typically entail:

      • Using strategy map and ideation functionalities.
      • Providing updates to ePMOs on progress.

      What should you look for in a strategic portfolio management tool? (1 of 2)

      Standard features for SPM include:

      Name Description
      Analytics and Reporting SPM should provide access to real-time dashboards and data interpretation, which can be exported as reports in a range of formats.
      Strategy Mapping and Road Mapping SPM should provide access to up-to-date timeline views of strategies and initiatives, including the ability to map such things as dependencies, market needs, funding, priorities, governance, and accountabilities.
      Value Tracking and Measurement SPM should include the ability to forecast, track, and measure return on investment for strategic investments. This includes accommodations for various paradigms of value delivery (e.g. traditional value delivery and measurement, OKRs, as well as value mapping and value streams).
      Ideation and Innovation Management SPM should include the ability to facilitate innovation management processes across the organization, including the ability to support stage gates from ideation through to approval; to articulate, socialize, and test ideas; perform impact assessments; create value canvas and OKR maps; and prioritize.
      Multi-Portfolio Management SPM should include the ability to perform various modalities of portfolio management and portfolio optimization, including project portfolio management, applications portfolio management, asset portfolio management, etc.
      Interoperability/APIs An SPM tool should enable seamless integration with other applications for data interoperability.

      What should you look for in a strategic portfolio management tool? (2 of 2)

      Advanced features for SPM can include:

      Name Description
      Product Management SPM can include product-management-specific functionality, including the ability to connect product families, roadmaps, and backlogs to enterprise goals and priorities, and track team-level activities at the sprint, release, and campaign levels.
      Enterprise Architecture Management SPM can include the ability to define and map the structure and operation of an organization in order to effectively coordinate various domains of architecture and governance (e.g. business architecture, data architecture, application architecture, security architecture, etc.) in order to effectively plan and introduce change.
      Security and Risk Management SPM can include the ability to identify and track enterprise risks and ensure compliance controls are met.
      Lean Portfolio Management SPM can include the ability to plan and report on portfolio performance independent from task level details of product, program, or project delivery.
      Investment and Financial Management SPM can include the ability to forecast, track, and report on financials at various levels (strategy, product, program, project, etc.).
      Multi-Methodology Delivery SPM can include the ability to plan and execute work in a way that accommodates various planning and delivery paradigms (predictive, iterative, Kanban, lean, etc.).

      What's promising within the space?

      As this space continues to stabilize, the following are some promising associations for business and IT enablement.

      1. SPM accommodates various ways of working.
      • Where traditional PPM and work management tools required that users change their processes and tasking paradigms to fit within the tool's rigid task management and data structures, the best SPM tools are those that are adaptable to various ways of working and can accommodate many tasking and work management models.
      • Sometimes this is done through extensive integrations and APIs that pull data from existing work management applications into a single view within the SPM tool, and other times, this is done by abstracting the task-level details into a higher-level reporting structure (it can depend on the solution). In any event, the best SPMs are bound to one work management model.
      2. SPM puts the focus on value and change.
      • With its focus on the planning and execution of strategy, SPM can't avoid putting a spotlight on value and value realization. The best SPM tools include the ability to forecast, track, and measure return on investment for strategic investments, and they accommodate for various paradigms of value delivery (e.g. traditional value delivery and measurement, OKRs, as well as value mapping and value streams).
      • Of course, you can't realize value without successfully fostering change. And while SPM tools don't necessarily offer functionality explicitly identifiable as organizational change management, they can act as agents of change in putting the spotlight on the execution of change at the executive level.
      3. SPM fosters a coherent approach to demand management.
      • With its goal of ensuring that strategy informs the organization of portfolios and guides the selection of projects and delivery of products, SPM can potentially bring some order to what is often a chaotic demand-management landscape, ensuring that planned and in-progress work is well justified from an ROI perspective.

      What's of concern within the space?

      As a progeny from other capabilities, SPM has some risks and connotations potential users should be wary of.

      1. The space is rife with IT buzzwords and, as a concept, is sometimes used as a repackaging of failing concepts.
      • You don't need to spend too much time engaging with the literature around SPM before you notice the marketing appeals heavily to concepts like "digitalization," "digital transformation," "continual innovation," "agility/Agile," and the like. While these are all important concepts, and the pursuit of them is worthwhile in many cases, there's no denying they're used as consultant and vendor buzzwords, deployed to excite our imaginations, without necessarily providing much meat around what they mean or how they're deployed and successfully sustained.
      • Indeed, many concepts and capabilities that appear in relation to SPM are on the downward swing of industry hype cycles, suggesting that SPM may be being used by vendors and consultants as another attempt to repackage and capitalize on these concepts even as practitioners grow weary and suspicious of the marketing claims built up around them.
      2. Some solutions that identify as SPM are not.
      • Because it's on the upward swing of its place in the hype cycle, many established PPM and service management vendors are applying the 'strategic portfolio management" label to their products without necessarily doing anything different from a functionality perspective to fit within the space. As a result, SPM vendor landscapes can compare work management, project management, demand management tools, and more. Users who want SPM functionality need to stay frosty to ensure they get what they pay for.
      3. SPM tools may have a capacity blind spot.
      • The biggest barrier to getting things done and done well in modern enterprises is approving more work than you have the capacity to deliver. While SPM offerings can help with better demand management, not many of them cover the capacity side with the same level of improvement.

      Does your organization need a strategic portfolio management tool?

      Use Info-Tech's Strategic Portfolio Management Needs Assessment to gauge your readiness for SPM.

      • As noted in previous places in this deck, there is often a grey area in the market between project portfolio management tools and strategic portfolio management tools.
      • Some PPM tools offer SPM functionality, while some SPM tools avoid traditional PPM outcomes and stay at a higher, strategic level.
      • Depending on the scope of your PMO or portfolio optimization needs, you may need a tool that has just one, or both, of these capabilities.
      • Use Info-Tech's Strategic Portfolio Management Needs Assessment to help you assess whether you require a high-level strategy management tool, a more low-level project portfolio management tool, or a mix of both.

      Download Info-Tech's Strategic Portfolio Management Needs Assessment

      1.1 Assess your needs

      10 to 20 minutes

      1. The Strategic Portfolio Management Needs Assessment is a 41-question survey broken up into three parts: (1) PMO Type, (2) Features and Functionality, (3) Roles.
      2. Go through each section using the provided dropdowns to help identify the orientation of your PMO, the feature and functionality needs of your office, as well as the roles whose needs will need to be serviced through the potential tool implementation.

      This screenshot shows a sample output from the assessment. Based upon your inputs, you'll be grouped within three ranges:

      1. Green: Based upon your inputs, you will benefit from an SPM tool.
      2. Yellow: You may benefit from an SPM tool, but you may also require something more traditional. Clarify your requirements before proceeding.
      3. Red: you're unlikely to leverage many of the benefits of an SPM tool at this time. Look for a more tactical solution.

      Sample Output from the assessment tool

      Input Output
      • Understanding of existing project management, project portfolio management, and work management applications.
      • Recommendation on PPM/SPM tool type
      Materials Participants
      • Strategic Portfolio Management Needs Assessment tool
      • Portfolio managers and/or ePMO directors
      • Project managers and product managers
      • Business stakeholders

      Explore the SPM vendor landscape

      Use Info-Tech's application selection resources to help find the right solution for your organization.

      If the analysis in the previous slides suggested you can benefit from an SPM tool, you can quick-start your vendor evaluation process with SoftwareReviews.

      SoftwareReviews has extensive coverage of not just the SPM space, but of the project portfolio management (pictured to the top right) and project management spaces as well. So, from the tactical to the strategic, SoftwareReviews can help you find the right tools.

      Further, as you settle in on a shortlist, you can begin your vendor analysis using our rapid application selection methodology (see framework on bottom right). For more information see our The Rapid Application Selection Framework blueprint.

      Info-Tech's Rapid Application Selection Framework

      Info-Tech's Rapid Application Selection Framework (RASF)

      Related Info-Tech Research

      Develop a Project Portfolio Management Strategy
      Drive IT project throughput by throttling resource capacity.

      Prepare an Actionable Roadmap for your PMO
      Turn planning into action with a realistic PMO timeline.

      Maintain an Organized Portfolio
      Align portfolio management practices with COBIT (APO05: Manage Portfolio)

      Bibliography

      Angliss, Katy, and Pete Harpum. Strategic Portfolio Management: In the Multi-Project and Program Organization. Book. Routledge. 30 Dec. 2022.

      Anthony, James. "95 Essential Project Management Statistics: 2022 Market Share & Data Analysis." Finance Online. 2022. Web. Accessed 21 March 2022

      Banham, Craig. "Integrating strategic planning with portfolio management." Sopheon. Webinar. Accessed 6 Feb. 2023.

      Garfein, Stephen J. "Executive Guide to Strategic Portfolio Management: roadmap for closing the gap between strategy and results." PMI. Conference Paper. Oct. 2007. Accessed 6 Feb. 2023.

      Garfein, Stephen J. "Strategic Portfolio Management: A smart, realistic and relatively fast way to gain sustainable competitive advantage." PMI. Conference Paper. 2 March 2005. Accessed 6 Feb. 2023.

      Hontar, Yulia. "Strategic Portfolio Management." PPM Express. Blog 16 June 2022. Accessed 6 Feb. 2023.

      Milsom, James. "6 Strategic Portfolio Management Trends for 2023." i-nexus. Blog. 25 Jan. 2022. Accessed 6 Feb. 2023.

      Milsom, James. "Strategic Portfolio Management 101." i-nexus. 8 Dec. 2021. Blog . Accessed 6 Feb. 2023.

      OnePlan, "Is Strategic Portfolio Management the Future of PPM?" YouTube. 17 Nov. 2022. Accessed 6 Feb. 2023.

      OnePlan. "Strategic Portfolio Management for Enterprise Agile." YouTube. 27 May 2022. Accessed 6 Feb. 2023.

      Piechota, Frank. "Strategic Portfolio Management: Enabling Successful Business Outcomes." Shibumi. Blog . 31 May 2022. Accessed 6 Feb. 2023.

      ServiceNow. "Strategic Portfolio Management—The Thing You've Been Missing." ServiceNow. Whitepaper. 2021. Accessed 6 Feb. 2023.

      Smith, Shepherd, "50+ Eye-Opening Strategic Planning Statistics" ClearPoint Strategy. Blog. 13 Sept. 2022. Accessed 6 Feb. 2023.

      SoftwareAG. "What is Strategic Portfolio Management (SPM)?" SoftwareAG. Blog. Accessed 6 Feb. 2023.

      Stickel, Robert. "What It Means to be Adaptive." OnePlan. Blog. 24 May 2021. Accessed 6 Feb. 2023.

      UMT360. "What is Strategic Portfolio Management?" YouTube. Webinar. 22 Oct. 2020. Accessed 6 Feb. 2023.

      Wall, Caroline. "Elevating Strategy Planning through Strategic Portfolio Management." StrategyBlocks. Blog. 26 Feb. 2020. Accessed 6 Feb. 2023.

      Westmoreland, Heather. "What is Strategic Portfolio Management." Planview. Blog. 19 Oct 2002. Accessed 6 Feb. 2023.

      Wiltshire, Andrew. "Shibumi Included in Gartner Magic Quadrant for Strategic Portfolio Management for the 2nd Straight Year." Shibumi. Blog. 20 Apr. 2022. Accessed 6 Feb. 2023.

      Ziehr, Paula. "Keep your eye on the prize: Align your IT investments with business strategy." SoftwareAG. Blog. 5 Jul. 2022. Accessed 6 Feb. 2023.

      Improve IT-Business Alignment Through an Internal SLA

      • Buy Link or Shortcode: {j2store}455|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Operations Management
      • Parent Category Link: /i-and-o-process-management
      • The business is rarely satisfied with IT service levels, yet there is no clear definition of what is acceptable.
      • Dissatisfaction with service levels is often based on perception. Your uptime might be four 9s, but the business only remembers the outages.
      • IT is left trying to hit a moving target with a limited budget and no agreement on where services levels need to improve.

      Our Advice

      Critical Insight

      • Business leaders have service level expectations regardless of whether there is a formal agreement. The SLA process enables IT to manage those expectations.
      • Track current service levels and report them in plain language (e.g. hours and minutes of downtime, not “how many 9s” which then need to be translated) to gain a clearer mutual understanding of current versus desired service levels.
      • Use past incidents to provide context (how much that hour of downtime actually impacted the business) in addition to a business impact analysis to define appropriate target service levels based on actual business need.

      Impact and Result

      Create an effective internal SLA by following a structured process to report current service levels and set realistic expectations with the business. This includes:

      • Defining the current achievable service level by establishing a metrics tracking and monitoring process.
      • Determining appropriate (not ideal) business needs.
      • Creating an SLA that clarifies expectations to reduce IT-business friction.

      Improve IT-Business Alignment Through an Internal SLA Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should create an internal SLA, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Scope the pilot project

      Establish the SLA pilot project and clearly document the problems and challenges that it will address.

      • Improve IT-Business Alignment Through an Internal SLA – Phase 1: Scope the Pilot Project
      • Internal SLA Process Flowcharts (PDF)
      • Internal SLA Process Flowcharts (Visio)
      • Build an Internal SLA Project Charter Template
      • Internal SLA Maturity Scorecard Tool

      2. Establish current service levels

      Expedite the SLA process by thoroughly, carefully, and clearly defining the current achievable service levels.

      • Improve IT-Business Alignment Through an Internal SLA – Phase 2: Determine Current Service Levels
      • Availability and Reliability SLA Metrics Tracking Template
      • Service Desk SLA Metrics Tracking Template
      • Service Catalog SLA Metrics Tracking Template

      3. Identify target service levels and create the SLA

      Create a living document that aligns business needs with IT targets by discovering the impact of your current service level offerings through a conversation with business peers.

      • Improve IT-Business Alignment Through an Internal SLA – Phase 3: Set Target Service Levels and Create the SLA
      • SLA Project Roadmap Tool
      • Availability Internal Service Level Agreement Template
      • Service Catalog Internal Service Level Agreement Template
      • Service Desk Internal Service Level Agreement Template
      • Internal SLA Executive Summary Presentation Template
      [infographic]

      Demystify Oracle Licensing and Optimize Spend

      • Buy Link or Shortcode: {j2store}136|cart{/j2store}
      • member rating overall impact: 9.9/10 Overall Impact
      • member rating average dollars saved: $85,754 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Licensing
      • Parent Category Link: /licensing
      • License keys are not needed with optional features accessible upon install. Conducting quarterly checks of the Oracle environment is critical because if products or features are installed, even if they are not actively in use, it constitutes use by Oracle and requires a license.
      • Ambiguous license models and definitions abound: terminology and licensing rules can be vague, making it difficult to purchase licensing even with the best of intentions to keep compliant.
      • Oracle has aggressively started to force new Oracle License and Service Agreements (OLSA) on customers that slightly modify language and remove pre-existing allowances to tilt the contract terms in Oracle's favor.

      Our Advice

      Critical Insight

      • Focus on needs first. Conduct a thorough requirements assessment and document the results. Well-documented license needs will be your core asset in navigating Oracle licensing and negotiating your agreement.
      • Communicate effectively. Be aware that Oracle will reach out to employees at your organization at various levels. Having your executives on the same page will help send a strong message.
      • Manage the relationship. If Oracle is managing you, there is a high probability you are over paying or providing information that may result in an audit.

      Impact and Result

      • Conducting business with Oracle is not typical compared to other vendors. To emerge successfully from a commercial transaction with Oracle, customers must learn the "Oracle way" of conducting business, which includes a best-in-class sales structure, highly unique contracts and license use policies, and a hyper-aggressive compliance function.
      • Map out the process of how to negotiate from a position of strength, examining terms and conditions, discount percentages, and agreement pitfalls.
      • Develop a strategy that leverages and utilizes an experienced Oracle DBA to gather accurate information, and then optimizes it to mitigate and meet the top challenges.

      Demystify Oracle Licensing and Optimize Spend Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you need to understand and document your Oracle licensing strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish licensing requirements

      Begin your proactive Oracle licensing journey by understanding which information to gather and assessing the current state and gaps.

      • Demystify Oracle Licensing and Optimize Spend – Phase 1: Establish Licensing Requirements
      • Oracle Licensing Purchase Reference Guide
      • Oracle Database Inventory Tool
      • Effective Licensing Position Tool
      • RASCI Chart

      2. Evaluate licensing options

      Review current licensing models and determine which licensing models will most appropriately fit your environment.

      • Demystify Oracle Licensing and Optimize Spend – Phase 2: Evaluate Licensing Options

      3. Evaluate agreement options

      Review Oracle’s contract types and assess which best fit the organization’s licensing needs.

      • Demystify Oracle Licensing and Optimize Spend – Phase 3: Evaluate Agreement Options
      • Oracle TCO Calculator

      4. Purchase and manage licenses

      Conduct negotiations, purchase licensing, and finalize a licensing management strategy.

      • Demystify Oracle Licensing and Optimize Spend – Phase 4: Purchase and Manage Licenses
      • Oracle Terms & Conditions Evaluation Tool
      • Controlled Vendor Communications Letter
      • Vendor Communication Management Plan
      [infographic]

      Workshop: Demystify Oracle Licensing and Optimize Spend

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Licensing Requirements

      The Purpose

      Assess current state and align goals; review business feedback

      Interview key stakeholders to define business objectives and drivers

      Key Benefits Achieved

      Have a baseline for requirements

      Assess the current state

      Determine licensing position

      Examine cloud options

      Activities

      1.1 Gather software licensing data

      1.2 Conduct a software inventory

      1.3 Perform manual checks

      1.4 Reconcile licenses

      1.5 Create your Oracle licensing team

      1.6 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation

      Outputs

      Copy of your Oracle License Statement

      Software inventory report from software asset management (SAM) tool

      Oracle Database Inventory Tool

      RASCI Chart

      Oracle Licensing Effective License Position (ELP) Template

      Oracle Licensing Purchase Reference Guide

      2 Evaluate Licensing Options

      The Purpose

      Review licensing options

      Review licensing rules

      Key Benefits Achieved

      Understand how licensing works

      Determine if you need software assurance

      Discuss licensing rules, application to current environment.

      Examine cloud licensing

      Understand the importance of documenting changes

      Meet with desktop product owners to determine product strategies

      Activities

      2.1 Review full, limited, restricted, and AST use licenses

      2.2 Calculate license costs

      2.3 Determine which database platform to use

      2.4 Evaluate moving to the cloud

      2.5 Examine disaster recovery strategies

      2.6 Understand purchasing support

      2.7 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation

      Outputs

      Oracle TCO Calculator

      Oracle Licensing Purchase Reference Guide

      3 Evaluate Agreement Options

      The Purpose

      Review contract option types

      Review vendors

      Key Benefits Achieved

      Understand why a type of contract is best for you

      Determine if ULA or term agreement is best

      The benefits of other types and when you should change

      Activities

      3.1 Prepare to sign or renew your ULA

      3.2 Decide on an agreement type that nets the maximum benefit

      Outputs

      Type of contract to be used

      Oracle TCO Calculator

      Oracle Licensing Purchase Reference Guide

      4 Purchase and Manage Licenses

      The Purpose

      Finalize the contract

      Prepare negotiation points

      Discuss license management

      Evaluate and develop a roadmap for future licensing

      Key Benefits Achieved

      Negotiation strategies

      Licensing management

      Introduction of SAM

      Leverage the work done on Oracle licensing to get started on SAM

      Activities

      4.1 Control the flow of communication terms and conditions

      4.2 Use Info-Tech’s readiness assessment in preparation for the audit

      4.3 Assign the right people to manage the environment

      4.4 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation

      Outputs

      Controlled Vendor Communications Letter

      Vendor Communication Management Plan

      Oracle Terms & Conditions Evaluation Tool

      RASCI Chart

      Oracle Licensing Purchase Reference Guide

      Recruit IT Talent

      • Buy Link or Shortcode: {j2store}574|cart{/j2store}
      • member rating overall impact: 9.6/10 Overall Impact
      • member rating average dollars saved: $17,565 Average $ Saved
      • member rating average days saved: 8 Average Days Saved
      • Parent Category Name: Attract & Select
      • Parent Category Link: /attract-and-select
      • Changing workforce dynamics and increased transparency have shifted the power from employers to job seekers, stiffening the competition for talent.
      • Candidate expectations match high consumer expectations and affect the employer brand, the consumer brand, and overall organizational reputation. Delivering a positive candidate experience (CX2) is no longer optional.

      Our Advice

      Critical Insight

      • Think about your candidates as consumers. Truly understanding their needs will attract great talent and build positive brand perceptions.
      • The CX2 starts sooner than you think. It encompasses all candidate interactions with an organization and begins before the formal application process.
      • Don’t try to emulate competitors. By differentiating your CX2, you build a competitive advantage.

      Impact and Result

      • Design a candidate-centric talent acquisition process that addresses candidate feedback from both unsuccessful and successful candidates.
      • Use design-thinking principles to focus your redesign on moments that matter to candidates to reduce unnecessary work or ad-hoc initiatives that don’t matter to candidates.

      Recruit IT Talent Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should redesign your CX2, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish your current process and set redesign goals

      Map the organization’s current state for CX2 and set high-level objectives and metrics.

      • Win the War for Talent With a Killer Candidate Experience – Phase 1: Establish Your Current Process and Set Redesign Goals
      • Candidate Experience Project Charter
      • Talent Metrics Library
      • Candidate Experience Process Mapping Template
      • Candidate Experience Assessment Tool

      2. Use design thinking to assess the candidate experience

      Strengthen the candidate lifecycle by improving upon pain points through design thinking methods and assessing the competitive landscape.

      • Win the War for Talent With a Killer Candidate Experience – Phase 2: Use Design Thinking to Assess the Candidate Experience
      • Design Thinking Primer
      • Empathy Map Template
      • Journey Map Guide

      3. Redesign the candidate experience

      Create action, communications, and training plans to establish the redesigned CX2 with hiring process stakeholders.

      • Win the War for Talent With a Killer Candidate Experience – Phase 3: Redesign the Candidate Experience
      • Candidate Experience Best Practices Action Guide
      • Candidate Experience Action and Communication Plan
      • Candidate Experience Service Level Agreement Template

      4. Appendix

      Leverage data collection and workshop activities.

      • Win the War for Talent With a Killer Candidate Experience – Appendix: Data Collection and Workshop Activities
      • Candidate Experience Phase One Data Collection Guide
      [infographic]

      Workshop: Recruit IT Talent

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Your Current Process and Set Redesign Goals

      The Purpose

      Assess the organization’s current state for CX2.

      Set baseline metrics for comparison with new initiatives.

      Establish goals to strengthen the CX2.

      Key Benefits Achieved

      Gained understanding of where the organization is currently.

      Established where the organization would like to be and goals to achieve the new state.

      Activities

      1.1 Review process map of current candidate lifecycle.

      1.2 Analyze qualitative and quantitative data gathered.

      1.3 Set organizational objectives and project goals.

      1.4 Set metrics to measure progress on high-level goals.

      Outputs

      Process map

      CX2 data analyzed

      Candidate Experience Project Charter

      2 Use Design Thinking to Assess the Candidate Experience

      The Purpose

      Apply design thinking methods to identify pain points in your candidate lifecycle.

      Assess the competition and analyze results.

      Empathize with candidates and their journey.

      Key Benefits Achieved

      Segments with pain points have been identified.

      Competitor offering and differentiation has been analyzed.

      Candidate thoughts and feelings have been synthesized.

      Activities

      2.1 Identify extreme users.

      2.2 Conduct an immersive empathy session or go through the process as if you were a target candidate.

      2.3 Identify talent competitors.

      2.4 Analyze competitive landscape.

      2.5 Synthesize research findings and create empathy map.

      2.6 Journey map the CX2.

      Outputs

      Extreme users identified

      Known and unknown talent competitor’s CX2 analyzed

      Empathy map created

      Journey map created

      3 Redesign the Candidate Experience

      The Purpose

      Create a communications and action plan and set metrics to measure success.

      Set expectations with hiring managers and talent acquisition specialists through a service level agreement.

      Key Benefits Achieved

      Action plan created.

      Metrics set to track progress and assess improvement.

      Service level agreement completed and expectations collaboratively set.

      Activities

      3.1 Assess each stage of the lifecycle.

      3.2 Set success metrics for priority lifecycle stages.

      3.3 Select actions from the Candidate Experience Best Practices Action Guide.

      3.4 Brainstorm other potential (organization-specific) solutions.

      3.5 Set action timeline and assign accountabilities.

      3.6 Customize service level agreement guidelines.

      Outputs

      CX2 lifecycle stages prioritized

      Metrics to measure progress set

      CX2 best practices selected

      Candidate Experience Assessment Tool

      Candidate Experience Action and Communication Plan

      Service level agreement guidelines.

      IT Organizational Design

      • Buy Link or Shortcode: {j2store}32|cart{/j2store}
      • Related Products: {j2store}32|crosssells{/j2store}
      • member rating overall impact: 9.1/10
      • member rating average dollars saved: $83,392
      • member rating average days saved: 21
      • Parent Category Name: People and Resources
      • Parent Category Link: /people-and-resources

      The challenge

      • IT can ensure full business alignment through an organizational redesign.
      • Finding the best approach for your company is difficult due to many frameworks and competing priorities.
      • External competitive influences and technological trends exacerbate this.

      Our advice

      Insight

      • Your structure is the critical enabler of your strategic direction. Structure dictates how people work together and how they can fill in their roles to create the desired business value. 
      • Constant change is killing for an organization. You need to adapt, but you need a stable baseline and make sure the change is in line with the overall strategy and company context.
      • A redesign is only successful if it really happens. Shifting people into new positions is not enough to implement a redesign. 

      Impact and results 

      • Define your redesign principles. They will act as a manifesto to your change. It also provides for a checklist, ensuring that the structure does not deviate from the business strategy.
      • Visualize the new design with a customized operating model for your company. It must demonstrate how IT creates value and supports the business value creation chains.
      • Define the future-state roles, functions, and responsibilities to enable your IT department to support the business effectively.

      The roadmap

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Get started

      Our concise executive brief explains to you the challenges associated with the organizational redesign. We'll show you our methodology and the ways we can help you in completing this.

      Define your organizational design principles and select your operating model

      The design principles will govern your organizational redesign; Align the principles with your business strategy.

      • Redesign Your IT Organizational Structure – Phase 1: Craft Organizational Design Principles and Select an IT Operating Model (ppt)
      • Organizational Design Communications Deck (ppt)

      Customize the selected IT operating model to your company

      Your operating model must account for the company's nuances and culture.

      • Redesign Your IT Organizational Structure – Phase 2: Customize the IT Operating Model (ppt)
      • Operating Models and Capability Definition List (ppt)

      Design the target-state of your IT organizational structure

      Go from an operating model to the structure fit for your company.

      • Redesign Your IT Organizational Structure – Phase 3: Architect the Target-State IT Organizational Structure (ppt)
      • Organizational Design Capability RACI Chart (xls)
      • Work Unit Reference Structures (Visio)
      • Work Unit Reference Structures (pdf)

      Communicate the benefits of the new structure

      Change does not come easy. People will be anxious. Craft your communications to address critical concerns and obtain buy-in from the organization. If the reorganization will be painful, be up-front on that, and limit the time in which people are uncertain.

      • Redesign Your IT Organizational Structure – Phase 4: Communicate the Benefits of the New Organizational Structure (ppt)

       

      Data security consultancy

      Data security consultancy

      Based on experience
      Implementable advice
      human-based and people-oriented

      Data security consultancy makes up one of Tymans Group’s areas of expertise as a corporate consultancy firm. We are happy to offer our insights and solutions regarding data security and risk to businesses, both through online and offline channels. Read on and discover how our consultancy company can help you set up practical data security management solutions within your firm.

      How our data security consultancy services can help your company

      Data security management should be an important aspect of your business. As a data security consultancy firm, Tymans Group is happy to assist your small or medium-sized enterprise with setting up clear protocols to keep your data safe. As such, we can advise on various aspects comprising data security management. This ranges from choosing a fit-for-purpose data architecture to introducing IT incident management guidelines. Moreover, we can perform an external IT audit to discover which aspects of your company’s data security are vulnerable and which could be improved upon.

      Security and risk management

      Our security and risk services

      Security strategy

      Security Strategy

      Embed security thinking through aligning your security strategy to business goals and values

      Read more

      Disaster Recovery Planning

      Disaster Recovery Planning

      Create a disaster recovey plan that is right for your company

      Read more

      Risk Management

      Risk Management

      Build your right-sized IT Risk Management Program

      Read more

      Check out all our services

      Discover our practical data security management solutions

      Data security is just one aspect with which our consultancy firm can assist your company. Tymans Group offers its extensive expertise in various corporate management domains, such as quality management and risk management. Our solutions all stem from our vast expertise and have proven their effectiveness. Moreover, when you choose to employ our consultancy firm for your data security management, you benefit from a holistic, people-oriented approach.

      Set up an appointment with our experts

      Do you wish to learn more about our data security management solutions and services for your company? We are happy to analyze any issues you may be facing and offer you a practical solution if you contact us for an appointment. You can book a one-hour online talk or elect for an on-site appointment with our experts. Contact us to set up your appointment now.

      Register to read more …

      Mergers & Acquisitions: The Buy Blueprint

      • Buy Link or Shortcode: {j2store}325|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: 5 Average Days Saved
      • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
      • Parent Category Name: IT Strategy
      • Parent Category Link: /it-strategy

      There are four key scenarios or entry points for IT as the acquiring organization in M&As:

      • IT can suggest an acquisition to meet the business objectives of the organization.
      • IT is brought in to strategy plan the acquisition from both the business’ and IT’s perspectives.
      • IT participates in due diligence activities and valuates the organization potentially being acquired.
      • IT needs to reactively prepare its environment to enable the integration.

      Consider the ideal scenario for your IT organization.

      Our Advice

      Critical Insight

      Acquisitions are inevitable in modern business, and IT’s involvement in the process should be too. This progression is inspired by:

      • The growing trend for organizations to increase, decrease, or evolve through these types of transactions.
      • A maturing business perspective of IT, preventing the difficulty that IT is faced with when invited into the transaction process late.
      • Transactions that are driven by digital motivations, requiring IT’s expertise.
      • There never being such a thing as a true merger, making the majority of M&A activity either acquisitions or divestitures.

      Impact and Result

      Prepare for a growth/integration transaction by:

      • Recognizing the trend for organizations to engage in M&A activity and the increased likelihood that, as an IT leader, you will be involved in a transaction in your career.
      • Creating a standard strategy that will enable strong program management.
      • Properly considering all the critical components of the transaction and integration by prioritizing tasks that will reduce risk, deliver value, and meet stakeholder expectations.

      Mergers & Acquisitions: The Buy Blueprint Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how your organization can excel its growth strategy by engaging in M&A transactions. Review Info-Tech’s methodology and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Proactive Phase

      Be an innovative IT leader by suggesting how and why the business should engage in an acquisition or divestiture.

      • One-Pager: M&A Proactive
      • Case Study: M&A Proactive
      • Information Asset Audit Tool
      • Data Valuation Tool
      • Enterprise Integration Process Mapping Tool
      • Risk Register Tool
      • Security M&A Due Diligence Tool

      2. Discovery & Strategy

      Create a standardized approach for how your IT organization should address acquisitions.

      • One-Pager: M&A Discovery & Strategy – Buy
      • Case Study: M&A Discovery & Strategy – Buy

      3. Due Diligence & Preparation

      Evaluate the target organizations to minimize risk and have an established integration project plan.

      • One-Pager: M&A Due Diligence & Preparation – Buy
      • Case Study: M&A Due Diligence & Preparation – Buy
      • IT Due Diligence Charter
      • Technical Debt Business Impact Analysis Tool
      • IT Culture Diagnostic
      • M&A Integration Project Management Tool (SharePoint)
      • SharePoint Template: Step-by-Step Deployment Guide
      • M&A Integration Project Management Tool (Excel)
      • Resource Management Supply-Demand Calculator

      4. Execution & Value Realization

      Deliver on the integration project plan successfully and communicate IT’s transaction value to the business.

      • One-Pager: M&A Execution & Value Realization – Buy
      • Case Study: M&A Execution & Value Realization – Buy

      Infographic

      Workshop: Mergers & Acquisitions: The Buy Blueprint

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Pre-Transaction Discovery & Strategy

      The Purpose

      Establish the transaction foundation.

      Discover the motivation for acquiring.

      Formalize the program plan.

      Create the valuation framework.

      Strategize the transaction and finalize the M&A strategy and approach.

      Key Benefits Achieved

      All major stakeholders are on the same page.

      Set up crucial elements to facilitate the success of the transaction.

      Have a repeatable transaction strategy that can be reused for multiple organizations.

      Activities

      1.1 Conduct the CIO Business Vision and CEO-CIO Alignment Diagnostics.

      1.2 Identify key stakeholders and outline their relationship to the M&A process.

      1.3 Identify the rationale for the company's decision to pursue an acquisition.

      1.4 Assess the IT/digital strategy.

      1.5 Identify pain points and opportunities tied to the acquisition.

      1.6 Create the IT vision and mission statements and identify IT guiding principles and the transition team.

      1.7 Document the M&A governance.

      1.8 Establish program metrics.

      1.9 Create the valuation framework.

      1.10 Establish the integration strategy.

      1.11 Conduct a RACI.

      1.12 Create the communication plan.

      1.13 Prepare to assess target organization(s).

      Outputs

      Business perspectives of IT

      Stakeholder network map for M&A transactions

      Business context implications for IT

      IT’s acquiring strategic direction

      Governance structure

      M&A program metrics

      IT valuation framework

      Integration strategy

      RACI

      Communication plan

      Prepared to assess target organization(s)

      2 Mid-Transaction Due Diligence & Preparation

      The Purpose

      Establish the transaction foundation.

      Discover the motivation for integration.

      Assess the target organization(s).

      Create the valuation framework.

      Plan the integration roadmap.

      Key Benefits Achieved

      All major stakeholders are on the same page.

      Methodology identified to assess organizations during due diligence.

      Methodology can be reused for multiple organizations.

      Integration activities are planned and assigned.

      Activities

      2.1 Gather and evaluate the stakeholders involved, M&A strategy, future-state operating model, and governance.

      2.2 Review the business rationale for the acquisition.

      2.3 Establish the integration strategy.

      2.4 Create the due diligence charter.

      2.5 Create a list of IT artifacts to be reviewed in the data room.

      2.6 Conduct a technical debt assessment.

      2.7 Assess the current culture and identify the goal culture.

      2.8 Identify the needed workforce supply.

      2.9 Create the valuation framework.

      2.10 Establish the integration roadmap.

      2.11 Establish and align project metrics with identified tasks.

      2.12 Estimate integration costs.

      Outputs

      Stakeholder map

      IT strategy assessment

      IT operating model and IT governance structure defined

      Business context implications for IT

      Integration strategy

      Due diligence charter

      Data room artifacts

      Technical debt assessment

      Culture assessment

      Workforce supply identified

      IT valuation framework

      Integration roadmap and associated resourcing

      3 Post-Transaction Execution & Value Realization

      The Purpose

      Establish the transaction foundation.

      Discover the motivation for integration.

      Plan the integration roadmap.

      Prepare employees for the transition.

      Engage in integration.

      Assess the transaction outcomes.

      Key Benefits Achieved

      All major stakeholders are on the same page.

      Integration activities are planned and assigned.

      Employees are set up for a smooth and successful transition.

      Integration strategy and roadmap executed to benefit the organization.

      Review what went well and identify improvements to be made in future transactions.

      Activities

      3.1 Identify key stakeholders and determine IT transaction team.

      3.2 Gather and evaluate the M&A strategy, future-state operating model, and governance.

      3.3 Review the business rationale for the acquisition.

      3.4 Establish the integration strategy.

      3.5 Prioritize integration tasks.

      3.6 Establish the integration roadmap.

      3.7 Establish and align project metrics with identified tasks.

      3.8 Estimate integration costs.

      3.9 Assess the current culture and identify the goal culture.

      3.10 Identify the needed workforce supply.

      3.11 Create an employee transition plan.

      3.12 Create functional workplans for employees.

      3.13 Complete the integration by regularly updating the project plan.

      3.14 Begin to rationalize the IT environment where possible and necessary.

      3.15 Confirm integration costs.

      3.16 Review IT’s transaction value.

      3.17 Conduct a transaction and integration SWOT.

      3.18 Review the playbook and prepare for future transactions.

      Outputs

      M&A transaction team

      Stakeholder map

      IT strategy assessed

      IT operating model and IT governance structure defined

      Business context implications for IT

      Integration strategy

      Integration roadmap and associated resourcing

      Culture assessment

      Workforce supply identified

      Employee transition plan

      Employee functional workplans

      Updated integration project plan

      Rationalized IT environment

      SWOT of transaction

      M&A Buy Playbook refined for future transactions

      Further reading

      Mergers & Acquisitions: The Buy Blueprint

      For IT leaders who want to have a role in the transaction process when their business is engaging in an M&A purchase.

      EXECUTIVE BRIEF

      Analyst Perspective

      Don’t wait to be invited to the M&A table, make it.

      Photo of Brittany Lutes, Research Analyst, CIO Practice, Info-Tech Research Group.
      Brittany Lutes
      Research Analyst,
      CIO Practice
      Info-Tech Research Group
      Photo of Ibrahim Abdel-Kader, Research Analyst, CIO Practice, Info-Tech Research Group.
      Ibrahim Abdel-Kader
      Research Analyst,
      CIO Practice
      Info-Tech Research Group

      IT has always been an afterthought in the M&A process, often brought in last minute once the deal is nearly, if not completely, solidified. This is a mistake. When IT is brought into the process late, the business misses opportunities to generate value related to the transaction and has less awareness of critical risks or inaccuracies.

      To prevent this mistake, IT leadership needs to develop strong business relationships and gain respect for their innovative suggestions. In fact, when it comes to modern M&A activity, IT should be the ones suggesting potential transactions to meet business needs, specifically when it comes to modernizing the business or adopting digital capabilities.

      IT needs to stop waiting to be invited to the acquisition or divestiture table. IT needs to suggest that the table be constructed and actively work toward achieving the strategic objectives of the business.

      Executive Summary

      Your Challenge

      There are four key scenarios or entry points for IT as the acquiring organization in M&As:

      • IT can suggest an acquisition to meet the business objectives of the organization.
      • IT is brought in to strategy plan the acquisition from both the business’ and IT’s perspectives.
      • IT participates in due diligence activities and valuates the organization potentially being acquired.
      • IT needs to reactively prepare its environment to enable the integration.

      Consider the ideal scenario for your IT organization.

      Common Obstacles

      Some of the obstacles IT faces include:

      • IT is often told about the transaction once the deal has already been solidified and is now forced to meet unrealistic business demands.
      • The business does not trust IT and therefore does not approach IT to define value or reduce risks to the transaction process.
      • The people and culture element are forgotten or not given adequate priority.

      These obstacles often arise when IT waits to be invited into the transaction process and misses critical opportunities.

      Info-Tech's Approach

      Prepare for a growth/integration transaction by:

      • Recognizing the trend for organizations to engage in M&A activity and the increased likelihood that, as an IT leader, you will be involved in a transaction in your career.
      • Creating a standard strategy that will enable strong program management.
      • Properly considering all the critical components of the transaction and integration by prioritizing tasks that will reduce risk, deliver value, and meet stakeholder expectations.

      Info-Tech Insight

      As the number of merger, acquisition, and divestiture transactions continues to increase, so too does IT’s opportunity to leverage the growing digital nature of these transactions and get involved at the onset.

      The changing M&A landscape

      Businesses will embrace more digital M&A transactions in the post-pandemic world

      • When the pandemic occurred, businesses reacted by either pausing (61%) or completely cancelling (46%) deals that were in the mid-transaction state (Deloitte, 2020). The uncertainty made many organizations consider whether the risks would be worth the potential benefits.
      • However, many organizations quickly realized the pandemic is not a hindrance to M&A transactions but an opportunity. Over 16,000 American companies were involved in M&A transactions in the first six months of 2021 (The Economist). For reference, this had been averaging around 10,000 per six months from 2016 to 2020.
      • In addition to this transaction growth, organizations have increasingly been embracing digital. These trends increase the likelihood that, as an IT leader, you will engage in an M&A transaction. However, it is up to you when you get involved in the transactions.

      The total value of transactions in the year after the pandemic started was $1.3 billion – a 93% increase in value compared to before the pandemic. (Nasdaq)

      Virtual deal-making will be the preferred method of 55% of organizations in the post-pandemic world. (Wall Street Journal, 2020)

      Your challenge

      IT is often not involved in the M&A transaction process. When it is, it’s often too late.

      • The most important driver of an acquisition is the ability to access new technology (DLA Piper), and yet 50% of the time, IT isn’t involved in the M&A transaction at all (IMAA Institute, 2017).
      • Additionally, IT’s lack of involvement in the process negatively impacts the business:
        • Most organizations (60%) do not have a standardized approach to integration (Steeves and Associates).
        • Weak integration teams contribute to the failure of 70% of M&A integrations (The Wall Street Journal, 2019).
        • Less than half (47%) of organizations actually experience the positive results sought by the M&A transaction (Steeves and Associates).
      • Organizations pursuing M&A and not involving IT are setting themselves up for failure.

      Only half of M&A deals involve IT (Source: IMAA Institute, 2017)

      Common Obstacles

      These barriers make this challenge difficult to address for many organizations:

      • IT is rarely afforded the opportunity to participate in the transaction deal. When IT is invited, this often happens later in the process where integration will be critical to business continuity.
      • IT has not had the opportunity to demonstrate that it is a valuable business partner in other business initiatives.
      • One of the most critical elements that IT often doesn’t take the time or doesn’t have the time to focus on is the people and leadership component.
      • IT waits to be invited to the process rather then actively involving themselves and suggesting how value can be added to the process.

      In hindsight, it’s clear to see: Involving IT is just good business.

      47% of senior leaders wish they would have spent more time on IT due diligence to prevent value erosion. (Source: IMAA Institute, 2017)

      40% of acquiring businesses discovered a cybersecurity problem at an acquisition.” (Source: Okta)

      Info-Tech's approach

      Acquisitions & Divestitures Framework

      Acquisitions and divestitures are inevitable in modern business, and IT’s involvement in the process should be too. This progression is inspired by:

      1. The growing trend for organizations to increase, decrease, or evolve through these types of transactions.
      2. Transactions that are driven by digital motivations, requiring IT’s expertise.
      3. A maturing business perspective of IT, preventing the difficulty that IT is faced with when invited into the transaction process late.
      4. There never being such a thing as a true merger, making the majority of M&A activity either acquisitions or divestitures.
      A diagram highlighting the 'IT Executives' Role in Acquisitions and Divestitures' when they are integrated at different points in the 'Core Business Timeline'. There are four main entry points 'Proactive', 'Discovery and Strategy', 'Due Diligence and Preparation', and 'Execution and Value Realized'. It is highlighted that IT can and should start at 'Proactive', but most organizations start at 'Execution and Value Realized'. 'Proactive': suggest opportunities to evolve the organization; prove IT's value and engage in growth opportunities early. Innovators start here. Steps of the business timeline in 'Proactive' are 'Organization strategies are defined' and 'M and A is considered to enable strategy'. After a buy or sell transaction is initiated is 'Discovery and Strategy': pre-transaction state. If it is a Buy transaction, 'Establish IT's involvement and approach'. If it is a Sell transaction, 'Prepare to engage in negotiations'. Business Partners start here. Steps of the business timeline in 'Discovery and Strategy' are 'Searching criteria is set', 'Potential candidates are considered', and 'LOI is sent/received'. 'Due Diligence and Preparation': mid-transaction state. If it is a Buy transaction, 'Identify potential transaction benefits and risks'. If it is a Sell transaction, 'Comply, communicate, and collaborate in transaction'. Trusted Operators start here. Steps of the business timeline in 'Due Diligence and Preparation' are 'Due diligence engagement occurs', 'Final agreement is reached', and 'Preparation for transaction execution occurs'. 'Execution and Value Realization': post-transaction state. If it is a Buy transaction, 'Integrate the IT environments and achieve business value'. If it is a Sell transaction, 'Separate the IT environment and deliver on transaction terms'. Firefighters start here. Steps of the business timeline in 'Execution and Value Realization' are 'Staff and operations are addressed appropriately', 'Day 1 of implementation and integration activities occurs', '1st 100 days of new entity state occur' and 'Ongoing risk mitigating and value creating activities occur'.

      The business’ view of IT will impact how soon IT can get involved

      There are four key entry points for IT

      A colorful visualization of the four key entry points for IT and a fifth not-so-key entry point. Starting from the top: 'Innovator', Information and Technology as a Competitive Advantage, 90% Satisfaction; 'Business Partner', Effective Delivery of Strategic Business Projects, 80% Satisfaction; 'Trusted Operator', Enablement of Business Through Application and Work Orders, 70% Satisfaction; 'Firefighter', Reliable Infrastructure and IT Service Desk, 60% Satisfaction; and then 'Unstable', Inability to Consistently Deliver Basic Services, <60% Satisfaction.
      1. Innovator: IT suggests an acquisition to meet the business objectives of the organization.
      2. Business Partner: IT is brought in to strategy plan the acquisition from both the business’ and IT’s perspective.
      3. Trusted Operator: IT participates in due diligence activities and valuates the organization potentially being acquired.
      4. Firefighter: IT reactively engages in the integration with little time to prepare.

      Merger, acquisition, and divestiture defined

      Merger

      A merger looks at the equal combination of two entities or organizations. Mergers are rare in the M&A space, as the organizations will combine assets and services in a completely equal 50/50 split. Two organizations may also choose to divest business entities and merge as a new company.

      Acquisition

      The most common transaction in the M&A space, where an organization will acquire or purchase another organization or entities of another organization. This type of transaction has a clear owner who will be able to make legal decisions regarding the acquired organization.

      Divestiture

      An organization may decide to sell partial elements of a business to an acquiring organization. They will separate this business entity from the rest of the organization and continue to operate the other components of the business.

      Info-Tech Insight

      A true merger does not exist, as there is always someone initiating the discussion. As a result, most M&A activity falls into acquisition or divestiture categories.

      Buying vs. selling

      The M&A process approach differs depending on whether you are the executive IT leader on the buy side or sell side

      This blueprint is only focused on the buy side:

      • More than two organizations could be involved in a transaction.
      • Examples of buy-related scenarios include:
        • Your organization is buying another organization with the intent of having the purchased organization keep its regular staff, operations, and location. This could mean minimal integration is required.
        • Your organization is buying another organization in its entirety with the intent of integrating it into your original company.
        • Your organization is buying components of another organization with the intent of integrating them into your original company.
      • As the purchasing organization, you will probably be initiating the purchase and thus will be valuating the selling organization during due diligence and leading the execution plan.

      The sell side is focused on:

      • Examples of sell-related scenarios include:
        • Your organization is selling to another organization with the intent of keeping its regular staff, operations, and location. This could mean minimal separation is required.
        • Your organization is selling to another organization with the intent of separating to be a part of the purchasing organization.
        • Your organization is engaging in a divestiture with the intent of:
          • Separating components to be part of the purchasing organization permanently.
          • Separating components to be part of a spinoff and establish a unit as a standalone new company.
      • As the selling organization, you could proactively seek out suitors to purchase all or components of your organization, or you could be approached by an organization.

      For more information on divestitures or selling your entire organization, check out Info-Tech’s Mergers & Acquisitions: The Sell Blueprint.

      Core business timeline

      For IT to be valuable in M&As, you need to align your deliverables and your support to the key activities the business and investors are working on.

      Info-Tech’s methodology for Buying Organizations in Mergers, Acquisitions, or Divestitures

      1. Proactive

      2. Discovery & Strategy

      3. Due Diligence & Preparation

      4. Execution & Value Realization

      Phase Steps

      1. Identify Stakeholders and Their Perspective of IT
      2. Assess IT’s Current Value and Future State
      3. Drive Innovation and Suggest Growth Opportunities
      1. Establish the M&A Program Plan
      2. Prepare IT to Engage in the Acquisition
      1. Assess the Target Organization
      2. Prepare to Integrate
      1. Execute the Transaction
      2. Reflection and Value Realization

      Phase Outcomes

      Be an innovative IT leader by suggesting how and why the business should engage in an acquisition or divestiture.

      Create a standardized approach for how your IT organization should address acquisitions.

      Evaluate the target organizations successfully and establish an integration project plan.

      Deliver on the integration project plan successfully and communicate IT’s transaction value to the business.

      Potential metrics for each phase

      1. Proactive

      2. Discovery & Strategy

      3. Due Diligence & Preparation

      4. Execution & Value Realization

      • % Share of business innovation spend from overall IT budget
      • % Critical processes with approved performance goals and metrics
      • % IT initiatives that meet or exceed value expectation defined in business case
      • % IT initiatives aligned with organizational strategic direction
      • % Satisfaction with IT's strategic decision-making abilities
      • $ Estimated business value added through IT-enabled innovation
      • % Overall stakeholder satisfaction with IT
      • % Percent of business leaders that view IT as an Innovator
      • % IT budget as a percent of revenue
      • % Assets that are not allocated
      • % Unallocated software licenses
      • # Obsolete assets
      • % IT spend that can be attributed to the business (chargeback or showback)
      • % Share of CapEx of overall IT budget
      • % Prospective organizations that meet the search criteria
      • $ Total IT cost of ownership (before and after M&A, before and after rationalization)
      • % Business leaders that view IT as a Business Partner
      • % Defects discovered in production
      • $ Cost per user for enterprise applications
      • % In-house-built applications vs. enterprise applications
      • % Owners identified for all data domains
      • # IT staff asked to participate in due diligence
      • Change to due diligence
      • IT budget variance
      • Synergy target
      • % Satisfaction with the effectiveness of IT capabilities
      • % Overall end-customer satisfaction
      • $ Impact of vendor SLA breaches
      • $ Savings through cost-optimization efforts
      • $ Savings through application rationalization and technology standardization
      • # Key positions empty
      • % Frequency of staff turnover
      • % Emergency changes
      • # Hours of unplanned downtime
      • % Releases that cause downtime
      • % Incidents with identified problem record
      • % Problems with identified root cause
      • # Days from problem identification to root cause fix
      • % Projects that consider IT risk
      • % Incidents due to issues not addressed in the security plan
      • # Average vulnerability remediation time
      • % Application budget spent on new build/buy vs. maintenance (deferred feature implementation, enhancements, bug fixes)
      • # Time (days) to value realization
      • % Projects that realized planned benefits
      • $ IT operational savings and cost reductions that are related to synergies/divestitures
      • % IT staff–related expenses/redundancies
      • # Days spent on IT integration
      • $ Accurate IT budget estimates
      • % Revenue growth directly tied to IT delivery
      • % Profit margin growth

      The IT executive’s role in the buying transaction is critical

      And IT leaders have a greater likelihood than ever of needing to support a merger, acquisition, or divestiture.

      1. Reduced Risk

        IT can identify risks that may go unnoticed when IT is not involved.
      2. Increased Accuracy

        The business can make accurate predictions around the costs, timelines, and needs of IT.
      3. Faster Integration

        Faster integration means faster value realization for the business.
      4. Informed Decision Making

        IT leaders hold critical information that can support the business in moving the transaction forward.
      5. Innovation

        IT can suggest new opportunities to generate revenue, optimize processes, or reduce inefficiencies.

      The IT executive’s critical role is demonstrated by:

      • Reduced Risk

        47% of senior leaders wish they would have spent more time on IT due diligence to prevent value erosion (IMAA Institute, 2017).
      • Increased Accuracy

        87% of respondents to a Deloitte survey effectively conducted a virtual deal, with a focus on cybersecurity and integration (Deloitte, 2020).
      • Faster Integration

        Integration costs range from as low as $4 million to as high as $3.8 billion, making the process an investment for the organization (CIO Dive).
      • Informed Decision Making

        Only 38% of corporate and 22% of private equity firms include IT as a significant aspect in their transaction approach (IMAA Institute, 2017).
      • Innovation

        Successful CIOs involved in M&As can spend 70% of their time on aspects outside of IT and 30% of their time on technology and delivery (CIO).

      Playbook benefits

      IT Benefits

      • IT will be seen as an innovative partner to the business, and its suggestions and involvement in the organization will lead to benefits, not hindrances.
      • Develop a streamlined method to valuate the potential organization being purchased and ensure risk management concerns are brought to the business’ attention immediately.
      • Create a comprehensive list of items that IT needs to do during the integration that can be prioritized and actioned.

      Business Benefits

      • The business will get accurate and relevant information about the organization being acquired, ensuring that the anticipated value of the transaction is correctly planned for.
      • Fewer business interruptions will happen, because IT can accurately plan for and execute the high-priority integration tasks.
      • The business can make a fair offer to the purchased organization, having properly valuated all aspects being bought, including the IT environment.

      Insight summary

      Overarching Insight

      As an IT executive, take control of when you get involved in a growth transaction. Do this by proactively identifying acquisition targets, demonstrating the value of IT, and ensuring that integration of IT environments does not lead to unnecessary and costly decisions.

      Proactive Insight

      CIOs on the forefront of digital transformation need to actively look for and suggest opportunities to acquire or partner on new digital capabilities to respond to rapidly changing business needs.

      Discovery & Strategy Insight

      IT organizations that have an effective M&A program plan are more prepared for the buying transaction, enabling a successful outcome. A structured strategy is particularly necessary for organizations expected to deliver M&As rapidly and frequently.

      Due Diligence & Preparation Insight

      Most IT synergies can be realized in due diligence. It is more impactful to consider IT processes and practices (e.g. contracts and culture) in due diligence rather than later in the integration.

      Execution & Value Realization Insight

      IT needs to realize synergies within the first 100 days of integration. The most successful transactions are when IT continuously realizes synergies a year after the transaction and beyond.

      Blueprint deliverables

      Key Deliverable: M&A Buy Playbook

      The M&A Buy Playbook should be a reusable document that enables your IT organization to successfully deliver on any acquisition transaction.

      Screenshots of the 'M and A Buy Playbook' deliverable.

      M&A Buy One-Pager

      See a one-page overview of each phase of the transaction.

      Screenshots of the 'M and A Buy One-Pagers' deliverable.

      M&A Buy Case Studies

      Read a one-page case study for each phase of the transaction.

      Screenshots of the 'M and A Buy Case Studies' deliverable.

      M&A Integration Project Management Tool (SharePoint)

      Manage the integration process of the acquisition using this SharePoint template.

      Screenshots of the 'M and A Integration Project Management Tool (SharePoint)' deliverable.

      M&A Integration Project Management Tool (Excel)

      Manage the integration process of the acquisition using this Excel tool if you can’t or don’t want to use SharePoint.

      Screenshots of the 'M and A Integration Project Management Tool (Excel)' deliverable.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 6 to 10 calls over the course of 2 to 4 months.

        Proactive Phase

      • Call #1: Scope requirements, objectives, and your specific challenges.
      • Discovery & Strategy Phase

      • Call #2: Determine stakeholders and their perspectives of IT.
      • Call #3: Identify how M&A could support business strategy and how to communicate.
      • Due Diligence & Preparation Phase

      • Call #4: Establish a transaction team and acquisition strategic direction.
      • Call #5: Create program metrics and identify a standard integration strategy.
      • Call #6: Assess the potential organization(s).
      • Call #7: Identify the integration program plan.
      • Execution & Value Realization Phase

      • Call #8: Establish employee transitions to retain key staff.
      • Call #9: Assess IT’s ability to deliver on the acquisition transaction.

      The Buy Blueprint

      Phase 1

      Proactive

      Phase 1

      Phase 2 Phase 3 Phase 4
      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Growth Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Acquisition
      • 3.1 Assess the Target Organization
      • 3.2 Prepare to Integrate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Conduct the CEO-CIO Alignment diagnostic
      • Conduct the CIO Business Vision diagnostic
      • Visualize relationships among stakeholders to identify key influencers
      • Group stakeholders into categories
      • Prioritize your stakeholders
      • Plan to communicate
      • Valuate IT
      • Assess the IT/digital strategy
      • Determine pain points and opportunities
      • Align goals to opportunities
      • Recommend growth opportunities

      This phase involves the following participants:

      • IT and business leadership

      What is the Proactive phase?

      Embracing the digital drivers

      As the number of merger, acquisition, or divestiture transactions driven by digital means continues to increase, IT has an opportunity to not just be involved in a transaction but actively seek out potential deals.

      In the Proactive phase, the business is not currently considering a transaction. However, the business could consider one to reach its strategic goals. IT organizations that have developed respected relationships with the business leaders can suggest these potential transactions.

      Understand the business’ perspective of IT, determine who the critical M&A stakeholders are, valuate the IT environment, and examine how it supports the business goals in order to suggest an M&A transaction.

      In doing so, IT isn’t waiting to be invited to the transaction table – it’s creating it.

      Goal: To support the organization in reaching its strategic goals by suggesting M&A activities that will enable the organization to reach its objectives faster and with greater-value outcomes.

      Proactive Prerequisite Checklist

      Before coming into the Proactive phase, you should have addressed the following:

      • Understand what mergers, acquisitions, and divestitures are.
      • Understand what mergers, acquisitions, and divestitures mean for the business.
      • Understand what mergers, acquisitions, and divestitures mean for IT.

      Review the Executive Brief for more information on mergers, acquisitions, and divestitures for purchasing organizations.

      Proactive

      Step 1.1

      Identify M&A Stakeholders and Their Perspective of IT

      Activities

      • 1.1.1 Conduct the CEO-CIO Alignment diagnostic
      • 1.1.2 Conduct the CIO Business Vision diagnostic
      • 1.1.3 Visualize relationships among stakeholders to identify key influencers
      • 1.1.4 Group stakeholders into categories
      • 1.1.5 Prioritize your stakeholders
      • 1.16 Plan to communicate

      This step involves the following participants:

      • IT executive leader
      • IT leadership
      • Critical M&A stakeholders

      Outcomes of Step

      Understand how the business perceives IT and establish strong relationships with critical M&A stakeholders.

      Business executives' perspectives of IT

      Leverage diagnostics and gain alignment on IT’s role in the organization

      • To suggest or get involved with a merger, acquisition, or divestiture, the IT executive leader needs to be well respected by other members of the executive leadership team and the business.
      • Specifically, the Proactive phase relies on the IT organization being viewed as an Innovator within the business.
      • Identify how the CEO/business executive currently views IT and where they would like IT to move within the Maturity Ladder.
      • Additionally, understand how other critical department leaders view IT and how they view the partnership with IT.
      A colorful visualization titled 'Maturity Ladder' detailing levels of IT function that a business may choose from based on the business executives' perspectives of IT. Starting from the bottom: 'Struggle', Does not embarrass, Does not crash; 'Support', Keeps business happy, Keeps costs low; 'Optimize', Increases efficiency, Decreases costs; 'Expand', Extends into new business, Generates revenue; 'Transform', Creates new industry.

      Misalignment in target state requires further communication between the CIO and CEO to ensure IT is striving toward an agreed-upon direction.

      Info-Tech’s CIO Business Vision (CIO BV) diagnostic measures a variety of high-value metrics to provide a well-rounded understanding of stakeholder satisfaction with IT.

      Sample of Info-Tech's CIO Business Vision diagnostic measuring percentages of high-value metrics like 'IT Satisfaction' and 'IT Value' regarding business leader satisfaction. A note for these two reads 'Evaluate business leader satisfaction with IT this year and last year'. A section titled 'Relationship' has metrics such as 'Understands Needs' and 'Trains Effectively'. A note for this section reads 'Examine indicators of the relationship between IT and the business'. A section titled 'Security Friction' has metrics such as 'Regulatory Compliance-Driven' and 'Office/Desktop Security'.

      Business Satisfaction and Importance for Core Services

      The core services of IT are important when determining what IT should focus on. The most important services with the lowest satisfaction offer the largest area of improvement for IT to drive business value.

      Sample of Info-Tech's CIO Business Vision diagnostic specifically comparing the business satisfaction of 12 core services with their importance. Services listed include 'Service Desk', 'IT Security', 'Requirements Gathering', 'Business Apps', 'Data Quality', and more. There is a short description of the services, a percentage for the business satisfaction with the service, a percentage comparing it to last year, and a numbered ranking of importance for each service. A note reads 'Assess satisfaction and importance across 12 core IT capabilities'.

      1.1.1 Conduct the CEO-CIO Alignment diagnostic

      2 weeks

      Input: IT organization expertise and the CEO-CIO Alignment diagnostic

      Output: An understanding of an executive business stakeholder’s perception of IT

      Materials: CEO-CIO Alignment diagnostic, M&A Buy Playbook

      Participants: IT executive/CIO, Business executive/CEO

      1. The CEO-CIO Alignment diagnostic can be a powerful input. Speak with your Info-Tech account representative to conduct the diagnostic. Use the results to inform current IT capabilities.
      2. You may choose to debrief the results of your diagnostic with an Info-Tech analyst. We recommend this to help your team understand how to interpret and draw conclusions from the results.
      3. Examine the results of the survey and note where there might be specific capabilities that could be improved.
      4. Determine whether there are any areas of significant disagreement between the you and the CEO. Mark down those areas for further conversations. Additionally, take note of areas that could be leveraged to support growth transactions or support your rationale in recommending growth transactions.

      Download the sample report.

      Record the results in the M&A Buy Playbook.

      1.1.2 Conduct the CIO Business Vision diagnostic

      2 weeks

      Input: IT organization expertise, CIO BV diagnostic

      Output: An understanding of business stakeholder perception of certain IT capabilities and services

      Materials: CIO Business Vision diagnostic, Computer, Whiteboard and markers, M&A Buy Playbook

      Participants: IT executive/CIO, Senior business leaders

      1. The CIO Business Vision (CIO BV) diagnostic can be a powerful tool for identifying IT capability focus areas. Speak with your account representative to conduct the CIO BV diagnostic. Use the results to inform current IT capabilities.
      2. You may choose to debrief the results of your diagnostic with an Info-Tech analyst. We recommend this to help your team understand how to interpret the results and draw conclusions from the diagnostic.
      3. Examine the results of the survey and take note of any IT services that have low scores.
      4. Read through the diagnostic comments and note any common themes. Especially note which stakeholders identified they have a favorable relationship with IT and which stakeholders identified they have an unfavorable relationship. For those who have an unfavorable relationship, identify if they will have a critical role in a growth transaction.

      Download the sample report.

      Record the results in the M&A Buy Playbook.

      Create a stakeholder network map for M&A transactions

      Follow the trail of breadcrumbs from your direct stakeholders to their influencers to uncover hidden stakeholders.

      Example:

      Diagram of stakeholders and their relationships with other stakeholders, such as 'Board Members', 'CFO/Finance', 'Compliance', etc. with 'CIO/IT Leader' highlighted in the middle. There are unidirectional black arrows and bi-directional green arrows indicating each connection.

        Legend
      • Black arrows indicate the direction of professional influence
      • Dashed green arrows indicate bidirectional, informal influence relationships

      Info-Tech Insight

      Your stakeholder map defines the influence landscape that the M&A transaction will occur within. This will identify who holds various levels of accountability and decision-making authority when a transaction does take place.

      Use connectors to determine who may be influencing your direct stakeholders. They may not have any formal authority within the organization, but they may have informal yet substantial relationships with your stakeholders.

      1.1.3 Visualize relationships among stakeholders to identify key influencers

      1-3 hours

      Input: List of M&A stakeholders

      Output: Relationships among M&A stakeholders and influencers

      Materials: M&A Buy Playbook

      Participants: IT executive leadership

      1. The purpose of this activity is to list all the stakeholders within your organization that will have a direct or indirect impact on the M&A transaction.
      2. Determine the critical stakeholders, and then determine the stakeholders of your stakeholders and consider adding each of them to the stakeholder list.
      3. Assess who has either formal or informal influence over your stakeholders; add these influencers to your stakeholder list.
      4. Construct a diagram linking stakeholders and their influencers together.
        • Use black arrows to indicate the direction of professional influence.
        • Use dashed green arrows to indicate bidirectional, informal influence relationships.

      Record the results in the M&A Buy Playbook.

      Categorize your stakeholders with a prioritization map

      A stakeholder prioritization map helps IT leaders categorize their stakeholders by their level of influence and ownership in the merger, acquisition, or divestiture process.

      A prioritization map of stakeholder categories split into four quadrants. The vertical axis is 'Influence', from low on the bottom to high on top. The horizontal axis is 'Ownership/Interest', from low on the left to high on the right. 'Spectators' are low influence, low ownership/interest. 'Mediators' are high influence, low ownership/interest. 'Noisemakers' are low influence, high ownership/interest. 'Players' are high influence, high ownership/interest.

      There are four areas in the map, and the stakeholders within each area should be treated differently.

      Players – players have a high interest in the initiative and the influence to effect change over the initiative. Their support is critical, and a lack of support can cause significant impediment to the objectives.

      Mediators – mediators have a low interest but significant influence over the initiative. They can help to provide balance and objective opinions to issues that arise.

      Noisemakers – noisemakers have low influence but high interest. They tend to be very vocal and engaged, either positively or negatively, but have little ability to enact their wishes.

      Spectators – generally, spectators are apathetic and have little influence over or interest in the initiative.

      1.1.4 Group stakeholders into categories

      30 minutes

      Input: Stakeholder map, Stakeholder list

      Output: Categorization of stakeholders and influencers

      Materials: Flip charts, Markers, Sticky notes, M&A Buy Playbook

      Participants: IT executive leadership, Stakeholders

      1. Identify your stakeholders’ interest in and influence on the M&A process as high, medium, or low by rating the attributes below.
      2. Map your results to the model to the right to determine each stakeholder’s category.

      Same prioritization map of stakeholder categories as before. This one has specific stakeholders mapped onto it. 'CFO' is mapped as low interest and middling influence, between 'Mediator' and 'Spectator'. 'CIO' is mapped as higher than average interest and high influence, a 'Player'. 'Board Member' is mapped as high interest and high influence, a 'Player'.

      Level of Influence
      • Power: Ability of a stakeholder to effect change.
      • Urgency: Degree of immediacy demanded.
      • Legitimacy: Perceived validity of stakeholder’s claim.
      • Volume: How loud their “voice” is or could become.
      • Contribution: What they have that is of value to you.
      Level of Interest

      How much are the stakeholder’s individual performance and goals directly tied to the success or failure of the product?

      Record the results in the M&A Buy Playbook.

      Prioritize your stakeholders

      There may be too many stakeholders to be able to manage them all. Focus your attention on the stakeholders that matter most.

      Level of Support

      Supporter

      Evangelist

      Neutral

      Blocker

      Stakeholder Category Player Critical High High Critical
      Mediator Medium Low Low Medium
      Noisemaker High Medium Medium High
      Spectator Low Irrelevant Irrelevant Low

      Consider the three dimensions for stakeholder prioritization: influence, interest, and support. Support can be determined by answering the following question: How significant is that stakeholder to the M&A or divestiture process?

      These parameters are used to prioritize which stakeholders are most important and should receive your focused attention.

      1.1.5 Prioritize your stakeholders

      30 minutes

      Input: Stakeholder matrix

      Output: Stakeholder and influencer prioritization

      Materials: Flip charts, Markers, Sticky notes, M&A Buy Playbook

      Participants: IT executive leadership, M&A/divestiture stakeholders

      1. Identify the level of support of each stakeholder by answering the following question: How significant is that stakeholder to the M&A transaction process?
      2. Prioritize your stakeholders using the prioritization scheme on the previous slide.

      Stakeholder

      Category

      Level of Support

      Prioritization

      CMO Spectator Neutral Irrelevant
      CIO Player Supporter Critical

      Record the results in the M&A Buy Playbook.

      Define strategies for engaging stakeholders by type

      A revisit to the map of stakeholder categories, but with strategies listed for each one, and arrows on the side instead of an axis. The vertical arrow is 'Authority', which increases upward, and the horizontal axis is Ownership/Interest which increases as it moves to the right. The strategy for 'Players' is 'Engage', for 'Mediators' is 'Satisfy', for 'Noisemakers' is 'Inform', and for 'Spectators' is 'Monitor'.

      Type

      Quadrant

      Actions

      Players High influence, high interest – actively engage Keep them updated on the progress of the project. Continuously involve Players in the process and maintain their engagement and interest by demonstrating their value to its success.
      Mediators High influence, low interest – keep satisfied They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust and including them in important decision-making steps. In turn, they can help you influence other stakeholders.
      Noisemakers Low influence, high interest – keep informed Try to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using Mediators to help them.
      Spectators Low influence, low interest – monitor They are followers. Keep them in the loop by providing clarity on objectives and status updates.

      Info-Tech Insight

      Each group of stakeholders draws attention and resources away from critical tasks. By properly identifying stakeholder groups, the IT executive leader can develop corresponding actions to manage stakeholders in each group. This can dramatically reduce wasted effort trying to satisfy Spectators and Noisemakers while ensuring the needs of Mediators and Players are met.

      1.1.6 Plan to communicate

      30 minutes

      Input: Stakeholder priority, Stakeholder categorization, Stakeholder influence

      Output: Stakeholder communication plan

      Materials: Flip charts, Markers, Sticky notes, M&A Buy Playbook

      Participants: IT executive leadership, M&A/divestiture stakeholders

      The purpose of this activity is to make a communication plan for each of the stakeholders identified in the previous activities, especially those who will have a critical role in the M&A transaction process.

      1. In the M&A Buy Playbook, input the type of influence each stakeholder has on IT, how they would be categorized in the M&A process, and their level of priority. Use this information to create a communication plan.
      2. Determine the methods and frequency of communication to keep the necessary stakeholder satisfied and maintain or enhance IT’s profile within the organization.

      Record the results in the M&A Buy Playbook.

      Proactive

      Step 1.2

      Assess IT’s Current Value and Method to Achieve a Future State

      Activities

      • 1.2.1 Valuate IT
      • 1.2.2 Assess the IT/digital strategy

      This step involves the following participants:

      • IT executive leader
      • IT leadership
      • Critical stakeholders to M&A

      Outcomes of Step

      Identify critical opportunities to optimize IT and meet strategic business goals through a merger, acquisition, or divestiture.

      How to valuate your IT environment

      And why it matters so much

      • Valuating your current organization’s IT environment is a critical step that all IT organizations should take, whether involved in an M&A or not, to fully understand what it might be worth.
      • The business investments in IT can be directly translated into a value amount. For every $1 invested in IT, the business might be gaining $100 in value back or possibly even loosing $100.
      • Determining, documenting, and communicating this information ensures that the business takes IT’s suggestions seriously and recognizes why investing in IT is so critical.
      • There are three ways a business or asset can be valuated:
        • Cost Approach: Look at the costs associated with building, purchasing, replacing, and maintaining a given aspect of the business.
        • Market Approach: Look at the relative value of a particular aspect of the business. Relative value can fluctuate and depends on what the markets and consequently society believe that particular element is worth.
        • Discounted Cash Flow Approach: Focus on what the potential value of the business could be or the intrinsic value anticipated due to future profitability.
      • (Source: “Valuation Methods,” Corporate Finance Institute)

      Four ways to create value through digital

      1. Reduced costs
      2. Improved customer experience
      3. New revenue sources
      4. Better decision making
      5. (Source: McKinsey & Company)

      1.2.1 Valuate IT

      1 day

      Input: Valuation of data, Valuation of applications, Valuation of infrastructure and operations, Valuation of security and risk

      Output: Valuation of IT

      Materials: Relevant templates/tools listed on the following slides, Capital budget, Operating budget, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership

      The purpose of this activity is to demonstrate that IT is not simply an operational functional area that diminishes business resources. Rather, IT contributes significant value to the business.

      1. Review each of the following slides to valuate IT’s data, applications, infrastructure and operations, and security and risk. These valuations consider several tangible and intangible factors and result in a final dollar amount.
      2. Input the financial amounts identified for each critical area into a summary slide. Use this information to determine where IT is delivering value to the organization.

      Info-Tech Insight

      Consistency is key when valuating your IT organization as well as other IT organizations throughout the transaction process.

      Record the results in the M&A Buy Playbook.

      Data valuation

      Data valuation identifies how you monetize the information that your organization owns.

      Create a data value chain for your organization

      When valuating the information and data that exists in an organization, there are many things to consider.

      Info-Tech has two tools that can support this process:

      1. Information Asset Audit Tool: Use this tool first to take inventory of the different information assets that exist in your organization.
      2. Data Valuation Tool: Once information assets have been accounted for, valuate the data that exists within those information assets.

      Data Collection

      Insight Creation

      Value Creation

      Data Valuation

      01 Data Source
      02 Data Collection Method
      03 Data
      04 Data Analysis
      05 Insight
      06 Insight Delivery
      07 Consumer
      08 Value in Data
      09 Value Dimension
      10 Value Metrics Group
      11 Value Metrics
      Screenshots of Tab 2 of Info-Tech's Data Valuation Tool.

      Instructions

      1. Using the Data Valuation Tool, start gathering information based on the eight steps above to understand your organization’s journey from data to value.
      2. Identify the data value spectrum. (For example: customer sales service, citizen licensing service, etc.)
      3. Fill out the columns for data sources, data collection, and data first.
      4. Capture data analysis and related information.
      5. Then capture the value in data.
      6. Add value dimensions such as usage, quality, and economic dimensions.
        • Remember that economic value is not the only dimension, and usage/quality has a significant impact on economic value.
      7. Collect evidence to justify your data valuation calculator (market research, internal metrics, etc.).
      8. Finally, calculate the value that has a direct correlation with underlying value metrics.

      Application valuation

      Calculate the value of your IT applications

      When valuating the applications and their users in an organization, consider using a business process map. This shows how business is transacted in the company by identifying which IT applications support these processes and which business groups have access to them. Info-Tech has a business process mapping tool that can support this process:

      • Enterprise Integration Process Mapping Tool: Complete this tool first to map the different business processes to the supporting applications in your organization.

      Instructions

      1. Start by calculating user costs. This is the product of the (# of users) × (% of time spent using IT) × (fully burdened salary).
      2. Identify the revenue per employee and divide that by the average cost per employee to calculate the derived productivity ratio (DPR).
      3. Once you have calculated the user costs and DPR, multiply those total values together to get the application value.
      4. User Costs

        Total User Costs

        Derived Productivity Ratio (DPR)

        Total DPR

        Application Value

        # of users % time spent using IT Fully burdened salary Multiply values from the 3 user costs columns Revenue per employee Average cost per employee (Revenue P.E) ÷ (Average cost P.E) (User costs) X (DPR)

      5. Once the total application value is established, calculate the combined IT and business costs of delivering that value. IT and business costs include inflexibility (application maintenance), unavailability (downtime costs, including disaster exposure), IT costs (common costs statistically allocated to applications), and fully loaded cost of active (full-time equivalent [FTE]) users.
      6. Calculate the net value of applications by subtracting the total IT and business costs from the total application value calculated in step 3.
      7. IT and Business Costs

        Total IT and Business Costs

        Net Value of Applications

        Application maintenance Downtime costs (include disaster exposure) Common costs allocated to applications Fully loaded costs of active (FTE) users Sum of values from the four IT and business costs columns (Application value) – (IT and business costs)

      (Source: CSO)

      Infrastructure valuation

      Assess the foundational elements of the business’ information technology

      The purpose of this exercise is to provide a high-level infrastructure valuation that will contribute to valuating your IT environment.

      Calculating the value of the infrastructure will require different methods depending on the environment. For example, a fully cloud-hosted organization will have different costs than a fully on-premises IT environment.

      Instructions:

      1. Start by listing all of the infrastructure-related items that are relevant to your organization.
      2. Once you have finalized your items column, identify the total costs/value of each item.
        • For example, total software costs would include servers and storage.
      3. Calculate the total cost/value of your IT infrastructure by adding all of values in the right column.

      Item

      Costs/Value

      Hardware Assets Total Value +$3.2 million
      Hardware Leased/Service Agreement -$
      Software Purchased +$
      Software Leased/Service Agreement -$
      Operational Tools
      Network
      Disaster Recovery
      Antivirus
      Data Centers
      Service Desk
      Other Licenses
      Total:

      For additional support, download the M&A Runbook for Infrastructure and Operations.

      Risk and security

      Assess risk responses and calculate residual risk

      The purpose of this exercise is to provide a high-level risk assessment that will contribute to valuating your IT environment. For a more in-depth risk assessment, please refer to the Info-Tech tools below:

      1. Risk Register Tool
      2. Security M&A Due Diligence Tool

      Instructions

      1. Review the probability and impact scales below and ensure you have the appropriate criteria that align to your organization before you conduct a risk assessment.
      2. Identify the probability of occurrence and estimated financial impact for each risk category detail and fill out the table on the right. Customize the table as needed so it aligns to your organization.
      3. Probability of Risk Occurrence

        Occurrence Criteria
        (Classification; Probability of Risk Event Within One Year)

        Negligible Very Unlikely; ‹20%
        Very Low Unlikely; 20 to 40%
        Low Possible; 40 to 60%
        Moderately Low Likely; 60 to 80%
        Moderate Almost Certain; ›80%

      Note: If needed, you can customize this scale with the severity designations that you prefer. However, make sure you are always consistent with it when conducting a risk assessment.

      Financial & Reputational Impact

      Budgetary and Reputational Implications
      (Financial Impact; Reputational Impact)

      Negligible (‹$10,000; Internal IT stakeholders aware of risk event occurrence)
      Very Low ($10,000 to $25,000; Business customers aware of risk event occurrence)
      Low ($25,000 to $50,000; Board of directors aware of risk event occurrence)
      Moderately Low ($50,000 to $100,000; External customers aware of risk event occurrence)
      Moderate (›$100,000; Media coverage or regulatory body aware of risk event occurrence)

      Risk Category Details

      Probability of Occurrence

      Estimated Financial Impact

      Estimated Severity (Probability X Impact)

      Capacity Planning
      Enterprise Architecture
      Externally Originated Attack
      Hardware Configuration Errors
      Hardware Performance
      Internally Originated Attack
      IT Staffing
      Project Scoping
      Software Implementation Errors
      Technology Evaluation and Selection
      Physical Threats
      Resource Threats
      Personnel Threats
      Technical Threats
      Total:

      1.2.2 Assess the IT/digital strategy

      4 hours

      Input: IT strategy, Digital strategy, Business strategy

      Output: An understanding of an executive business stakeholder’s perception of IT, Alignment of IT/digital strategy and overall organization strategy

      Materials: Computer, Whiteboard and markers, M&A Buy Playbook

      Participants: IT executive/CIO, Business executive/CEO

      The purpose of this activity is to review the business and IT strategies that exist to determine if there are critical capabilities that are not being supported.

      Ideally, the IT and digital strategies would have been created following development of the business strategy. However, sometimes the business strategy does not directly call out the capabilities it requires IT to support.

      1. On the left half of the corresponding slide in the M&A Buy Playbook, document the business goals, initiatives, and capabilities. Input this information from the business or digital strategies. (If more space for goals, initiatives, or capabilities is needed, duplicate the slide).
      2. On the other half of the slide, document the IT goals, initiatives, and capabilities. Input this information from the IT strategy and digital strategy.

      For additional support, see Build a Business-Aligned IT Strategy.

      Record the results in the M&A Buy Playbook.

      Proactive

      Step 1.3

      Drive Innovation and Suggest Growth Opportunities

      Activities

      • 1.3.1 Determine pain points and opportunities
      • 1.3.2 Align goals with opportunities
      • 1.3.3 Recommend growth opportunities

      This step involves the following participants:

      • IT executive leader
      • IT leadership
      • Critical M&A stakeholders

      Outcomes of Step

      Establish strong relationships with critical M&A stakeholders and position IT as an innovative business partner that can suggest growth opportunities.

      1.3.1 Determine pain points and opportunities

      1-2 hours

      Input: CEO-CIO Alignment diagnostic, CIO Business Vision diagnostic, Valuation of IT environment, IT-business goals cascade

      Output: List of pain points or opportunities that IT can address

      Materials: Computer, Whiteboard and markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Business stakeholders

      The purpose of this activity is to determine the pain points and opportunities that exist for the organization. These can be external or internal to the organization.

      1. Identify what opportunities exist for your organization. Opportunities are the potential positives that the organization would want to leverage.
      2. Next, identify pain points, which are the potential negatives that the organization would want to alleviate.
      3. Spend time considering all the options that might exist, and keep in mind what has been identified previously.

      Opportunities and pain points can be trends, other departments’ initiatives, business perspectives of IT, etc.

      Record the results in the M&A Buy Playbook.

      1.3.2 Align goals with opportunities

      1-2 hours

      Input: CEO-CIO Alignment diagnostic, CIO Business Vision diagnostic, Valuation of IT environment, IT-business goals cascade, List of pain points and opportunities

      Output: An understanding of an executive business stakeholder’s perception of IT, Foundations for growth strategy

      Materials: Computer, Whiteboard and markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Business stakeholders

      The purpose of this activity is to determine whether a growth or separation strategy might be a good suggestion to the business in order to meet its business objectives.

      1. For the top three to five business goals, consider:
        1. Underlying drivers
        2. Digital opportunities
        3. Whether a growth or reduction strategy is the solution
      2. Just because a growth or reduction strategy is a solution for a business goal does not necessarily indicate M&A is the way to go. However, it is important to consider before you pursue suggesting M&A.

      Record the results in the M&A Buy Playbook.

      1.3.3 Recommend growth opportunities

      1-2 hours

      Input: Growth or separation strategy opportunities to support business goals, Stakeholder communication plan, Rationale for the suggestion

      Output: M&A transaction opportunities suggested

      Materials: M&A Buy Playbook

      Participants: IT executive/CIO, Business executive/CEO

      The purpose of this activity is to recommend a merger, acquisition, or divestiture to the business.

      1. Identify which of the business goals the transaction would help solve and why IT is the one to suggest such a goal.
      2. Leverage the stakeholder communication plan identified previously to give insight into stakeholders who would have a significant level of interest, influence, or support in the process.

      Info-Tech Insight

      With technology and digital driving many transactions, leverage this opening and begin the discussions with your business on how and why an acquisition would be a great opportunity.

      Record the results in the M&A Buy Playbook.

      By the end of this Proactive phase, you should:

      Be prepared to suggest M&A opportunities to support your company’s goals through growth or acquisition transactions

      Key outcome from the Proactive phase

      Develop progressive relationships and strong communication with key stakeholders to suggest or be aware of transformational opportunities that can be achieved through growth or reduction strategies such as mergers, acquisitions, or divestitures.

      Key deliverables from the Proactive phase
      • Business perspective of IT examined
      • Key stakeholders identified and relationship to the M&A process outlined
      • Ability to valuate the IT environment and communicate IT’s value to the business
      • Assessment of the business, digital, and IT strategies and how M&As could support those strategies
      • Pain points and opportunities that could be alleviated or supported through an M&A transaction
      • Acquisition or buying recommendations

      The Buy Blueprint

      Phase 2

      Discovery & Strategy

      Phase 1

      Phase 2

      Phase 3Phase 4
      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Growth Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Acquisition
      • 3.1 Assess the Target Organization
      • 3.2 Prepare to Integrate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Create the mission and vision
      • Identify the guiding principles
      • Create the future-state operating model
      • Determine the transition team
      • Document the M&A governance
      • Create program metrics
      • Establish the integration strategy
      • Conduct a RACI
      • Create the communication plan
      • Assess the potential organization(s)

      This phase involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Pre-Work

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Establish the Transaction FoundationDiscover the Motivation for AcquiringFormalize the Program PlanCreate the Valuation FrameworkStrategize the TransactionNext Steps and Wrap-Up (offsite)

      Activities

      • 0.1 Conduct the CIO Business Vision and CEO-CIO Alignment diagnostics
      • 0.2 Identify key stakeholders and outline their relationship to the M&A process
      • 0.3 Identify the rationale for the company's decisions to pursue an acquisition
      • 1.1 Review the business rationale for the acquisition
      • 1.2 Assess the IT/digital strategy
      • 1.3 Identify pain points and opportunities tied to the acquisition
      • 1.4 Create the IT vision statement, create the IT mission statement, and identify IT guiding principles
      • 2.1 Create the future-state operating model
      • 2.2 Determine the transition team
      • 2.3 Document the M&A governance
      • 2.4 Establish program metrics
      • 3.1 Valuate your data
      • 3.2 Valuate your applications
      • 3.3 Valuate your infrastructure
      • 3.4 Valuate your risk and security
      • 3.5 Combine individual valuations to make a single framework
      • 4.1 Establish the integration strategy
      • 4.2 Conduct a RACI
      • 4.3 Review best practices for assessing target organizations
      • 4.4 Create the communication plan
      • 5.1 Complete in-progress deliverables from previous four days
      • 5.2 Set up review time for workshop deliverables and to discuss next steps

      Deliverables

      1. Business perspectives of IT
      2. Stakeholder network map for M&A transactions
      1. Business context implications for IT
      2. IT’s acquisition strategic direction
      1. Operating model for future state
      2. Transition team
      3. Governance structure
      4. M&A program metrics
      1. IT valuation framework
      1. Integration strategy
      2. RACI
      3. Communication plan
      1. Completed M&A program plan and strategy
      2. Prepared to assess target organization(s)

      What is the Discovery & Strategy phase?

      Pre-transaction state

      The Discovery & Strategy phase during an acquisition is a unique opportunity for many IT organizations. IT organizations that can participate in the acquisition transaction at this stage are likely considered a strategic partner of the business.

      For one-off acquisitions, IT being invited during this stage of the process is rare. However, for organizations that are preparing to engage in many acquisitions over the coming years, this type of strategy will greatly benefit from IT involvement. Again, the likelihood of participating in an M&A transaction is increasing, making it a smart IT leadership decision to, at the very least, loosely prepare a program plan that can act as a strategic pillar throughout the transaction.

      During this phase of the pre-transaction state, IT will also be asked to participate in ensuring that the potential organization being sought will be able to meet any IT-specific search criteria that was set when the transaction was put into motion.

      Goal: To identify a repeatable program plan that IT can leverage when acquiring all or parts of another organization’s IT environment, ensuring customer satisfaction and business continuity

      Discovery & Strategy Prerequisite Checklist

      Before coming into the Discovery & Strategy phase, you should have addressed the following:

      • Understand the business perspective of IT.
      • Know the key stakeholders and have outlined their relationships to the M&A process.
      • Be able to valuate the IT environment and communicate IT's value to the business.
      • Understand the rationale for the company's decisions to pursue an acquisition and the opportunities or pain points the acquisition should address.

      Discovery & Strategy

      Step 2.1

      Establish the M&A Program Plan

      Activities

      • 2.1.1 Create the mission and vision
      • 2.1.2 Identify the guiding principles
      • 2.1.3 Create the future-state operating model
      • 2.1.4 Determine the transition team
      • 2.1.5 Document the M&A governance
      • 2.1.6 Create program metrics

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team

      Outcomes of Step

      Establish an M&A program plan that can be repeated across acquisitions.

      The vision and mission statements clearly articulate IT’s aspirations and purpose

      The IT vision statement communicates a desired future state of the IT organization, whereas the IT mission statement portrays the organization’s reason for being. While each serves its own purpose, they should both be derived from the business context implications for IT.

      Vision Statements

      Mission Statements

      Characteristics

      • Describe a desired future
      • Focus on ends, not means
      • Concise
      • Aspirational
      • Memorable
      • Articulate a reason for existence
      • Focus on how to achieve the vision
      • Concise
      • Easy to grasp
      • Sharply focused
      • Inspirational

      Samples

      To be a trusted advisor and partner in enabling business innovation and growth through an engaged IT workforce. (Source: Business News Daily) IT is a cohesive, proactive, and disciplined team that delivers innovative technology solutions while demonstrating a strong customer-oriented mindset. (Source: Forbes, 2013)

      2.1.1 Create the mission and vision statements

      2 hours

      Input: Business objectives, IT capabilities, Rationale for the transaction

      Output: IT’s mission and vision statements for growth strategies tied to mergers, acquisitions, and divestitures

      Materials: Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create mission and vision statements that reflect IT’s intent and method to support the organization as it pursues a growth strategy.

      1. Review the definitions and characteristics of mission and vision statements.
      2. Brainstorm different versions of the mission and vision statements.
      3. Edit the statements until you get to a single version of each that accurately reflects IT’s role in the growth process.

      Record the results in the M&A Buy Playbook.

      Guiding principles provide a sense of direction

      IT guiding principles are shared, long-lasting beliefs that guide the use of IT in constructing, transforming, and operating the enterprise by informing and restricting IT investment portfolio management, solution development, and procurement decisions.

      A diagram illustrating the place of 'IT guiding principles' in the process of making 'Decisions on the use of IT'. There are four main items, connecting lines naming the type of process in getting from one step to the next, and a line underneath clarifying the questions asked at each step. On the far left, over the question 'What decisions should be made?', is 'Business context and IT implications'. This flows forward to 'IT guiding principles', and they are connected by 'Influence'. Next, over the question 'How should decisions be made?', is the main highlighted section. 'IT guiding principles' flows forward to 'Decisions on the use of IT', and they are connected by 'Guide and inform'. On the far right, over the question 'Who has the accountability and authority to make decisions?', is 'IT policies'. This flows back to 'Decisions on the use of IT', and they are connected by 'Direct and control'.

      IT principles must be carefully constructed to make sure they are adhered to and relevant

      Info-Tech has identified a set of characteristics that IT principles should possess. These characteristics ensure the IT principles are relevant and followed in the organization.

      Approach focused. IT principles should be focused on the approach – how the organization is built, transformed, and operated – as opposed to what needs to be built, which is defined by both functional and non-functional requirements.

      Business relevant. Create IT principles that are specific to the organization. Tie IT principles to the organization’s priorities and strategic aspirations.

      Long lasting. Build IT principles that will withstand the test of time.

      Prescriptive. Inform and direct decision making with actionable IT principles. Avoid truisms, general statements, and observations.

      Verifiable. If compliance can’t be verified, people are less likely to follow the principle.

      Easily Digestible. IT principles must be clearly understood by everyone in IT and by business stakeholders. IT principles aren’t a secret manuscript of the IT team. IT principles should be succinct; wordy principles are hard to understand and remember.

      Followed. Successful IT principles represent a collection of beliefs shared among enterprise stakeholders. IT principles must be continuously communicated to all stakeholders to achieve and maintain buy-in.

      In organizations where formal policy enforcement works well, IT principles should be enforced through appropriate governance processes.

      Consider the example principles below

      IT Principle Name

      IT Principle Statement

      1. Risk Management We will ensure that the organization’s IT Risk Management Register is properly updated to reflect all potential risks and that a plan of action against those risks has been identified.
      2. Transparent Communication We will ensure employees are spoken to with respect and transparency throughout the transaction process.
      3. Integration for Success We will create an integration strategy that enables the organization and clearly communicates the resources required to succeed.
      4. Managed Data We will handle data creation, modification, integration, and use across the enterprise in compliance with our data governance policy.
      5. Establish a single IT Environment We will identify, prioritize, and manage the applications and services that IT provides in order to eliminate redundant technology and maximize the value that users and customers experience.
      6. Compliance With Laws and Regulations We will operate in compliance with all applicable laws and regulations for both our organization and the potentially purchased organization.
      7. Defined Value We will create a plan of action that aligns with the organization’s defined value expectations.
      8. Network Readiness We will ensure that employees and customers have immediate access to the network with minimal or no outages.
      9. Operating to Succeed We will bring all of IT into a central operating model within two years of the transaction.

      2.1.2 Identify the guiding principles

      2 hours

      Input: Business objectives, IT capabilities, Rationale for the transaction, Mission and vision statements

      Output: IT’s guiding principles for growth strategies tied to mergers, acquisitions, and divestitures

      Materials: Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create the guiding principles that will direct the IT organization throughout the growth strategy process.

      1. Review the role of guiding principles and the examples of guiding principles that organizations have used.
      2. Brainstorm different versions of the guiding principles. Each guiding principle should start with the phrase “We will…”
      3. Edit and consolidate the statements until you have a list of approximately eight to ten statements that accurately reflect IT’s role in the growth process.
      4. Review the guiding principles every six months to ensure they continue to support the delivery of the business’ growth strategy goals.

      Record the results in the M&A Buy Playbook.

      Create two IT teams to support the transaction

      IT M&A Transaction Team

      • The IT M&A Transaction Team should consist of the strongest members of the IT team who can be expected to deliver on unusual or additional tasks not asked of them in normal day-to-day operations.
      • The roles selected for this team will have very specific skills sets or deliver on critical integration capabilities, making their involvement in the combination of two or more IT environments paramount.
      • These individuals need to have a history of proving themselves very trustworthy, as they will likely be required to sign an NDA as well.
      • Expect to have to certain duplicate capabilities or roles across the M&A transaction team and operational team.

      IT Operational Team

      • This group is responsible for ensuring the business operations continue.
      • These employees might be those who are newer to the organization but can be counted on to deliver consistent IT services and products.
      • The roles of this team should ensure that end users or external customers remain satisfied.

      Key capabilities to support M&A

      Consider the following capabilities when looking at who should be a part of the M&A transaction team.

      Employees who have a significant role in ensuring that these capabilities are being delivered will be a top priority.

      Infrastructure

      • Systems Integration
      • Data Management

      Business Focus

      • Service-Level Management
      • Enterprise Architecture
      • Stakeholder Management
      • Project Management

      Risk & Security

      • Privacy Management
      • Security Management
      • Risk & Compliance Management

      Build a lasting and scalable operating model

      An operating model is an abstract visualization, used like an architect’s blueprint, that depicts how structures and resources are aligned and integrated to deliver on the organization’s strategy.

      It ensures consistency of all elements in the organizational structure through a clear and coherent blueprint before embarking on detailed organizational design.

      The visual should highlight which capabilities are critical to attaining strategic goals and clearly show the flow of work so that key stakeholders can understand where inputs flow in and outputs flow out of the IT organization.

      As you assess the current operating model, consider the following:

      • Does the operating model contain all the necessary capabilities your IT organization requires to be successful?
      • What capabilities should be duplicated?
      • Are there individuals with the skill set to support those roles? If not, is there a plan to acquire or develop those skills?
      • A dedicated project team strictly focused on M&A is great. However, is it feasible for your organization? If not, what blockers exist?
      A diagram with 'Initiatives' and 'Solutions' on the left and right of an area chart, 'Customer' at the top, the area between them labelled 'Functional Area n', and six horizontal bars labelled 'IT Capability' stacked on top of each other. The 'IT Capability' bars are slightly skewed to the 'Solutions' side of the chart.

      Info-Tech Insight

      Investing time up-front getting the operating model right is critical. This will give you a framework to rationalize future organizational changes, allowing you to be more iterative and allowing your model to change as the business changes.

      2.1.3 Create the future-state operating model

      4 hours

      Input: Current operating model, IT strategy, IT capabilities, M&A-specific IT capabilities, Business objectives, Rationale for the transaction, Mission and vision statements

      Output: Future-state operating model

      Materials: Operating model, Capability overlay, Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to establish what the future-state operating model will be if your organization needs to adjust to support a growth transaction.

      1. Ensuring that all the IT capabilities are identified by the business and IT strategy, document your organization’s current operating model.
      2. Identify what core capabilities would be critical to the buying transaction process and integration. Highlight and make copies of those capabilities in the M&A Buy Playbook.
      3. Arrange the capabilities to clearly show the flow of inputs and outputs. Identify critical stakeholders of the process (such as customers or end users) if that will help the flow.
      4. Ensure the capabilities that will be decentralized are clearly identified. Decentralized capabilities do not exist within the central IT organization but rather in specific lines of businesses or products to better understand needs and deliver on the capability.

      An example operating model is included in the M&A Buy Playbook. This process benefits from strong reference architecture and capability mapping ahead of time.

      Record the results in the M&A Buy Playbook.

      2.1.4 Determine the transition team

      3 hours

      Input: IT capabilities, Future-state operating model, M&A-specific IT capabilities, Business objectives, Rationale for the transaction, Mission and vision statements

      Output: Transition team

      Materials: Reference architecture, Organizational structure, Flip charts/whiteboard, Markers

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create a team that will support your IT organization throughout the transaction. Determining which capabilities and therefore which roles will be required ensures that the business will continue to get the operational support it needs.

      1. Based on the outcome of activity 2.1.3, review the capabilities that your organization will require on the transition team. Group capabilities into functional groups containing capabilities that are aligned well with one another because they have similar responsibilities and functionalities.
      2. Replace the capabilities with roles. For example, stakeholder management, requirements gathering, and project management might be one functional group. Project management and stakeholder management might combine to create a project manager role.
      3. Review the examples in the M&A Buy Playbook and identify which roles will be a part of the transition team.

      For more information, see Redesign Your Organizational Structure

      What is governance?

      And why does it matter so much to IT and the M&A process?

      • Governance is the method in which decisions get made, specifically as they impact various resources (time, money, and people).
      • Because M&A is such a highly governed transaction, it is important to document the governance bodies that exist in your organization.
      • This will give insight into what types of governing bodies there are, what decisions they make, and how that will impact IT.
      • For example, funds to support integration need to be discussed, approved, and supplied to IT from a governing body overseeing the acquisition.
      • A highly mature IT organization will have automated governance, while a seemingly non-existent governance process will be considered ad hoc.
      A pyramid with four levels representing the types of governing bodies that are available with differing levels of IT maturity. An arrow beside the pyramid points upward. The bottom of the arrow is labelled 'Traditional (People and document centric)' and the top is labelled 'Adaptive (Data centric)'. Starting at the bottom of the pyramid is level 1 'Ad Hoc Governance', 'Governance that is not well defined or understood within the organization. It occurs out of necessity but often not by the right people'. Level 2 is 'Controlled Governance', 'Governance focused on compliance and decisions driven by hierarchical authority. Levels of authority are defined and often driven by regulatory'. Level 3 is 'Agile Governance', 'Governance that is flexible to support different needs and quick response in the organization. Driven by principles and delegated throughout the company'. At the top of the pyramid is level 4 'Automated Governance', 'Governance that is entrenched and automated into organizational processes and product/service design. Empowered and fully delegated governance to maintain fit and drive organizational success and survival'.

      2.1.5 Document M&A governance

      1-2 hours

      Input: List of governing bodies, Governing body committee profiles, Governance structure

      Output: Documented method on how decisions are made as it relates to the M&A transaction

      Materials: Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to determine the method in which decisions are made throughout the M&A transaction as it relates to IT. This will require understanding both governing bodies internal to IT and those external to IT.

      1. First, determine the other governance structures within the organization that will impact the decisions made about M&A. List out these bodies or committees.
      2. Create a profile for each committee that looks at the membership, purpose of the committee, decision areas (authority), and the process of inputs and outputs. Ensure IT committees that will have a role in this process are also documented. Consider the benefits realized, risks, and resources required for each.
      3. Organize the committees into a structure, identifying the committees that have a role in defining the strategy, designing and building, and running.

      Record the results in the M&A Buy Playbook.

      Current-state structure map – definitions of tiers

      Strategy: These groups will focus on decisions that directly connect to the strategic direction of the organization.

      Design & Build: The second tier of groups will oversee prioritization of a certain area of governance as well as design and build decisions that feed into strategic decisions.

      Run: The lowest level of governance will be oversight of more-specific initiatives and capabilities within IT.

      Expect tier overlap. Some committees will operate in areas that cover two or three of these governance tiers.

      Measure the IT program’s success in terms of its ability to support the business’ M&A goals

      Upper management will measure IT’s success based on your ability to support the underlying reasons for the M&A. Using business metrics will help assure business stakeholders that IT understands their needs and is working with the business to achieve them.

      Business-Specific Metrics

      • Revenue Growth: Increase in the top line as seen by market expansion, product expansion, etc. by percentage/time.
      • Synergy Extraction: Reduction in costs as determined by the ability to identify and eliminate redundancies over time.
      • Profit Margin Growth: Increase in the bottom line as a result of increased revenue growth and/or decreased costs over time.

      IT-Specific Metrics

      • IT operational savings and cost reductions due to synergies: Operating expenses, capital expenditures, licenses, contracts, applications, infrastructure over time.
      • Reduction in IT staff expense and headcount: Decreased budget allocated to IT staff, and ability to identify and remove redundancies in staff.
      • Meeting or improving on IT budget estimates: Delivering successful IT integration on a budget that is the same or lower than the budget estimated during due diligence.
      • Meeting or improving on IT time-to-integration estimates: Delivering successful IT integration on a timeline that is the same or shorter than the timeline estimated during due diligence.
      • Business capability support: Delivering the end state of IT that supports the expected business capabilities and growth.

      Establish your own metrics to gauge the success of IT

      Establish SMART M&A Success Metrics

      S pecific Make sure the objective is clear and detailed.
      M easurable Objectives are measurable if there are specific metrics assigned to measure success. Metrics should be objective.
      A ctionable Objectives become actionable when specific initiatives designed to achieve the objective are identified.
      R ealistic Objectives must be achievable given your current resources or known available resources.
      T ime-Bound An objective without a timeline can be put off indefinitely. Furthermore, measuring success is challenging without a timeline.
      • What should IT consider when looking to identify potential additions, deletions, or modifications that will either add value to the organization or reduce costs/risks?
      • Provide a definition of synergies.
      • IT operational savings and cost reductions due to synergies: Operating expenses, capital expenditures, licenses, contracts, applications, infrastructure.
      • Reduction in IT staff expense and headcount: Decreased budget allocated to IT staff, and ability to identify and remove redundancies in staff.
      • Meeting or improving on IT budget estimates: Delivering successful IT integration on a budget that is the same or lower than the budget estimated during due diligence.
      • Meeting or improving on IT time-to-integration estimates: Delivering successful IT integration on a timeline that is the same or shorter than the timeline estimated during due diligence.
      • Revenue growth: Increase in the top line as a result, as seen by market expansion, product expansion, etc.
      • Synergy extraction: Reduction in costs, as determined by the ability to identify and eliminate redundancies.
      • Profit margin growth: Increase in the bottom line as a result of increased revenue growth and/or decreased costs.

      Metrics for each phase

      1. Proactive

      2. Discovery & Strategy

      3. Valuation & Due Diligence

      4. Execution & Value Realization

      • % Share of business innovation spend from overall IT budget
      • % Critical processes with approved performance goals and metrics
      • % IT initiatives that meet or exceed value expectation defined in business case
      • % IT initiatives aligned with organizational strategic direction
      • % Satisfaction with IT's strategic decision-making abilities
      • $ Estimated business value added through IT-enabled innovation
      • % Overall stakeholder satisfaction with IT
      • % Percent of business leaders that view IT as an Innovator
      • % IT budget as a percent of revenue
      • % Assets that are not allocated
      • % Unallocated software licenses
      • # Obsolete assets
      • % IT spend that can be attributed to the business (chargeback or showback)
      • % Share of CapEx of overall IT budget
      • % Prospective organizations that meet the search criteria
      • $ Total IT cost of ownership (before and after M&A, before and after rationalization)
      • % Business leaders that view IT as a Business Partner
      • % Defects discovered in production
      • $ Cost per user for enterprise applications
      • % In-house-built applications vs. enterprise applications
      • % Owners identified for all data domains
      • # IT staff asked to participate in due diligence
      • Change to due diligence
      • IT budget variance
      • Synergy target
      • % Satisfaction with the effectiveness of IT capabilities
      • % Overall end-customer satisfaction
      • $ Impact of vendor SLA breaches
      • $ Savings through cost-optimization efforts
      • $ Savings through application rationalization and technology standardization
      • # Key positions empty
      • % Frequency of staff turnover
      • % Emergency changes
      • # Hours of unplanned downtime
      • % Releases that cause downtime
      • % Incidents with identified problem record
      • % Problems with identified root cause
      • # Days from problem identification to root cause fix
      • % Projects that consider IT risk
      • % Incidents due to issues not addressed in the security plan
      • # Average vulnerability remediation time
      • % Application budget spent on new build/buy vs. maintenance (deferred feature implementation, enhancements, bug fixes)
      • # Time (days) to value realization
      • % Projects that realized planned benefits
      • $ IT operational savings and cost reductions that are related to synergies/divestitures
      • % IT staff–related expenses/redundancies
      • # Days spent on IT integration
      • $ Accurate IT budget estimates
      • % Revenue growth directly tied to IT delivery
      • % Profit margin growth

      2.1.6 Create program metrics

      1-2 hours

      Input: IT capabilities, Mission, vision, and guiding principles, Rationale for the acquisition

      Output: Program metrics to support IT throughout the M&A process

      Materials: Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to determine how IT’s success throughout a growth transaction will be measured and determined.

      1. Document a list of appropriate metrics on the whiteboard. Remember to include metrics that demonstrate the business impact. You can use the sample metrics listed on the previous slide as a starting point.
      2. Set a target and deadline for each metric. This will help the group determine when it is time to evaluate progression.
      3. Establish a baseline for each metric based on information collected within your organization.
      4. Assign an owner for tracking each metric as well as someone to be accountable for performance.

      Record the results in the M&A Buy Playbook.

      Discovery & Strategy

      Step 2.2

      Prepare IT to Engage in the Acquisition

      Activities

      • 2.2.1 Establish the integration strategy
      • 2.2.2 Conduct a RACI
      • 2.2.3 Create the communication plan
      • 2.2.4 Assess the potential organization(s)

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team

      Outcomes of Step

      Identify IT’s plan of action when it comes to the acquisition and align IT’s integration strategy with the business’ M&A strategy.

      Integration strategies

      There are several IT integration strategies that will help you achieve your target technology environment.

      IT Integration Strategies
      • Absorption. Convert the target organization’s strategy, structure, processes, and/or systems to that of the acquiring organization.
      • Best-of-Breed. Pick and choose the most effective people, processes, and technologies to form an efficient operating model.
      • Transformation Retire systems from both organizations and use collective capabilities, data, and processes to create something entirely new.
      • Preservation Retain individual business units that will operate within their own capability. People, processes, and technologies are unchanged.

      The approach IT takes will depend on the business objectives for the M&A.

      • Generally speaking, the integration strategy is well understood and influenced by the frequency of and rationale for acquiring.
      • Based on the initiatives generated by each business process owner, you need to determine the IT integration strategy that will best support the desired target technology environment.

      Key considerations when choosing an IT integration strategy include:

      • What are the main business objectives of the M&A?
      • What are the key synergies expected from the transaction?
      • What IT integration best helps obtain these benefits?
      • What opportunities exist to position the business for sustainable growth?

      Absorption and best-of-breed

      Review highlights and drawbacks of absorption and best-of-breed integration strategies

      Absorption
        Highlights
      • Recommended for businesses striving to reduce costs and drive efficiency gains.
      • Economies of scale realized through consolidation and elimination of redundant applications.
      • Quickest path to a single company operation and systems as well as lower overall IT cost.
        Drawbacks
      • Potential for disruption of the target company’s business operations.
      • Requires significant business process changes.
      • Disregarding the target offerings altogether may lead to inferior system decisions that do not yield sustainable results.
      Best-of-Breed
        Highlights
      • Recommended for businesses looking to expand their market presence or acquire new products. Essentially aligning the two organizations in the same market.
      • Each side has a unique offering but complementing capabilities.
      • Potential for better buy-in from the target because some of their systems are kept, resulting in willingness to
        Drawbacks
      • May take longer to integrate because it tends to present increased complexity that results in higher costs and risks.
      • Requires major integration efforts from both sides of the company. If the target organization is uncooperative, creating the desired technology environment will be difficult.

      Transformation and preservation

      Review highlights and drawbacks of transformation and preservation integration strategies

      Transformation
        Highlights
      • This is the most customized approach, although it is rarely used.
      • It is essential to have an established long-term vision of business capabilities when choosing this path.
      • When executed correctly, this approach presents potential for significant upside and creation of sustainable competitive advantages.
        Drawbacks
      • This approach requires extensive time to implement, and the cost of integration work may be significant.
      • If a new system is created without strategic capabilities, the organizations will not realize long-term benefits.
      • The cost of correcting complexities at later stages in the integration effort may be drastic.
      Preservation
        Highlights
      • This approach is appropriate if the merging organizations will remain fairly independent, if there will be limited or no communication between companies, and if the companies’ market strategies, products, and channels are entirely distinct.
      • Environment can be accomplished quickly and at a low cost.
        Drawbacks
      • Impact to each business is minimal, but there is potential for lost synergies and higher operational costs. This may be uncontrollable if the natures of the two businesses are too different to integrate.
      • Reduced benefits and limited opportunities for IT integration.

      2.2.1 Establish the integration strategy

      1-2 hours

      Input: Business integration strategy, Guiding principles, M&A governance

      Output: IT’s integration strategy

      Materials: Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to determine IT’s approach to integration. The approach might differ slightly from transaction to transaction. However, the business’ approach to transactions should give insight into the general integration strategy IT should adopt.

      1. Make sure you have clearly articulated the business objectives for the M&A, the technology end state for IT, and the magnitude of the overall integration.
      2. Review and discuss the highlights and drawbacks of each type of integration.
      3. Use Info-Tech’s Integration Posture Selection Framework on the next slide to select the integration posture that will appropriately enable the business. Consider these questions during your discussion:
        1. What are the main business objectives of the M&A? What key IT capabilities will need to support business objectives?
        2. What key synergies are expected from the transaction? What opportunities exist to position the business for sustainable growth?
        3. What IT integration best helps obtain these benefits?

      Record the results in the M&A Buy Playbook.

      Integration Posture Selection Framework

      Business M&A Strategy

      Resultant Technology Strategy

      M&A Magnitude (% of Acquirer Assets, Income, or Market Value)

      IT Integration Posture

      A. Horizontal Adopt One Model ‹10% Absorption
      10 to 75% Absorption or Best-of-Breed
      ›75% Best-of-Breed
      B. Vertical Create Links Between Critical Systems Any
      • Preservation (Differentiated Functions)
      • Absorption or Best-of-Breed (Non-Differentiated Functions)
      C. Conglomerate Independent Model Any Preservation
      D. Hybrid: Horizontal & Conglomerate Independent Model Any Preservation

      2.2.2 Conduct a RACI

      1-2 hours

      Input: IT capabilities, Transition team, Integration strategy

      Output: Completed RACI for transition team

      Materials: Reference architecture, Organizational structure, Flip charts/whiteboard, Markers, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to identify the core accountabilities and responsibilities for the roles identified as critical to your transition team. While there might be slight variation from transaction to transaction, ideally each role should be performing certain tasks.

      1. First, identify a list of critical tasks that need to be completed to support the purchase or acquisition. For example:
        • Communicate with the company M&A team.
        • Identify critical IT risks that could impact the organization after the transaction.
        • Identify key artifacts to collect and review during due diligence.
      2. Next, identify at the activity level which role is accountable or responsible for each activity. Enter an A for accountable, R for responsible, or A/R for both.

      Record the results in the M&A Buy Playbook.

      Communication and change

      Prepare key stakeholders for the potential changes

      • Anytime you are starting a project or program that will depend on users and stakeholders to give up their old way of doing things, change will force people to become novices again, leading to lost productivity and added stress.
      • Change management can improve outcomes for any project where you need people to adopt new tools and procedures, comply with new policies, learn new skills and behaviors, or understand and support new processes.
      • M&As move very quickly, and it can be very difficult to keep track of which stakeholders you need to be communicating with and what you should be communicating.
      • Not all organizations embrace or resist change in the same ways. Base your change communications on your organization’s cultural appetite for change in general.
        • Organizations with a low appetite for change will require more direct, assertive communications.
        • Organizations with a high appetite for change are more suited to more open, participatory approaches.

      Three key dimensions determine the appetite for cultural change:

      • Power Distance. Refers to the acceptance that power is distributed unequally throughout the organization.
        In organizations with a high power distance, the unequal power distribution is accepted by the less powerful employees.
      • Individualism. Organizations that score high in individualism have employees who are more independent. Those who score low in individualism fall into the collectivism side, where employees are strongly tied to one another or their groups.
      • Uncertainty Avoidance. Describes the level of acceptance that an organization has toward uncertainty. Those who score high in this area find that their employees do not favor uncertain situations, while those that score low in this area find that their employees are comfortable with change and uncertainty.

      2.2.3 Create the communication plan

      1-2 hours

      Input: IT’s M&A mission, vision, and guiding principles, M&A transition team, IT integration strategy, RACI

      Output: IT’s M&A communication plan

      Materials: Flip charts/whiteboard, Markers, RACI, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create a communication plan that IT can leverage throughout the initiative.

      1. Create a structured communication plan that allows for continuous communication with the integration management office, senior management, and the business functional heads.
      2. Outline key topics of communication, with stakeholders, inputs, and outputs for each topic.
      3. Review Info-Tech’s example communication plan in the M&A Buy Playbook and update it with relevant information.
      4. Does this communication plan make sense for your organization? What doesn’t make sense? Adjust the communication guide to suit your organization.

      Record the results in the M&A Buy Playbook.

      Assessing potential organizations

      As soon as you have identified organizations to consider, it’s imperative to assess critical risks. Most IT leaders can attest that they will receive little to no notice when they have to assess the IT organization of a potential purchase. As a result, having a standardized template to quickly gauge the value of the business can be critical.

      Ways to Assess

      1. News: Assess what sort of news has been announced in relation to the organization. Have they had any risk incidents? Has a critical vendor announced working with them?
      2. LinkedIn: Scan through the LinkedIn profiles of employees. This will give you a sense of what platforms they have based on their employees.
      3. Trends: Some industries will have specific solutions that are relevant and popular. Assess what the key players are (if you don’t already know) to determine the solution.
      4. Business Architecture: While this assessment won’t perfect, try to understand the business’ value streams and the critical business and IT capabilities that would be needed to support them.

      2.2.4 Assess the potential organization(s)

      1-2 hours

      Input: Publicized historical risk events, Solutions and vendor contracts likely in the works, Trends

      Output: IT’s valuation of the potential organization(s) for acquisition

      Materials: M&A Buy Playbook

      Participants: IT executive/CIO

      The purpose of this activity is to assess the organization(s) that your organization is considering purchasing.

      1. Complete the Historical Valuation Worksheet in the M&A Buy Playbook to understand the type of IT organization that your company may inherit and need to integrate with.
        • The business likely isn’t looking for in-depth details at this time. However, as the IT leader, it is your responsibility to ensure critical risks are identified and communicated to the business.
      2. Use the information identified to help the business narrow down which organizations should be targeted for the acquisition.

      Record the results in the M&A Buy Playbook.

      By the end of this pre-transaction phase you should:

      Have a program plan for M&As and a repeatable M&A strategy for IT when engaging in growth transactions

      Key outcomes from the Discovery & Strategy phase
      • Be prepared to analyze and recommend potential organizations that the business can acquire or merge with, using a strong program plan that can be repeated across transactions.
      • Create a M&A strategy that accounts for all the necessary elements of a transaction and ensures sufficient governance, capabilities, and metrics exist.
      Key deliverables from the Discovery & Strategy phase
      • Create vision and mission statements
      • Establish guiding principles
      • Create a future-state operating model
      • Identify the key roles for the transaction team
      • Identify and communicate the M&A governance
      • Determine target metrics
      • Identify the M&A operating model
      • Select the integration strategy framework
      • Conduct a RACI for key transaction tasks for the transaction team
      • Document the communication plan

      M&A Buy Blueprint

      Phase 3

      Due Diligence & Preparation

      Phase 1Phase 2

      Phase 3

      Phase 4
      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Growth Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Acquisition
      • 3.1 Assess the Target Organization
      • 3.2 Prepare to Integrate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Drive value with a due diligence charter
      • Identify data room artifacts
      • Assess technical debt
      • Valuate the target IT organization
      • Assess culture
      • Prioritize integration tasks
      • Establish the integration roadmap
      • Identify the needed workforce supply
      • Estimate integration costs
      • Create an employee transition plan
      • Create functional workplans for employees
      • Align project metrics with identified tasks

      This phase involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team
      • Business leaders
      • Prospective IT organization
      • Transition team

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Pre-Work

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Establish the Transaction FoundationDiscover the Motivation for IntegrationAssess the Target Organization(s)Create the Valuation FrameworkPlan the Integration RoadmapNext Steps and Wrap-Up (offsite)

      Activities

      • 0.1 Identify the rationale for the company's decisions to pursue an acquisition.
      • 0.2 Identify key stakeholders and determine the IT transaction team.
      • 0.3 Gather and evaluate the M&A strategy, future-state operating model, and governance.
      • 1.1 Review the business rationale for the acquisition.
      • 1.2 Identify pain points and opportunities tied to the acquisition.
      • 1.3 Establish the integration strategy.
      • 1.4 Create the due diligence charter.
      • 2.1 Create a list of IT artifacts to be reviewed in the data room.
      • 2.2 Conduct a technical debt assessment.
      • 2.3 Assess the current culture and identify the goal culture.
      • 2.4 Identify the needed workforce supply.
      • 3.1 Valuate the target organization’s data.
      • 3.2 Valuate the target organization’s applications.
      • 3.3 Valuate the target organization’s infrastructure.
      • 3.4 Valuate the target organization’s risk and security.
      • 3.5 Combine individual valuations to make a single framework.
      • 4.1 Prioritize integration tasks.
      • 4.2 Establish the integration roadmap.
      • 4.3 Establish and align project metrics with identified tasks.
      • 4.4 Estimate integration costs.
      • 5.1 Complete in-progress deliverables from previous four days.
      • 5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. IT strategy
      2. IT operating model
      3. IT governance structure
      4. M&A transaction team
      1. Business context implications for IT
      2. Integration strategy
      3. Due diligence charter
      1. Data room artifacts
      2. Technical debt assessment
      3. Culture assessment
      4. Workforce supply identified
      1. IT valuation framework to assess target organization(s)
      1. Integration roadmap and associated resourcing
      1. Acquisition integration strategy for IT

      What is the Due Diligence & Preparation phase?

      Mid-transaction state

      The Due Diligence & Preparation phase during an acquisition is a critical time for IT. If IT fails to proactively participate in this phase, IT will have to merely react to integration expectations set by the business.

      While not all IT organizations are able to participate in this phase, the evolving nature of M&As to be driven by digital and technological capabilities increases the rationale for IT being at the table. Identifying critical IT risks, which will inevitably be business risks, begins during the due diligence phase.

      This is also the opportunity for IT to plan how it will execute the planned integration strategy. Having access to critical information only available in data rooms will further enable IT to successfully plan and execute the acquisition to deliver the value the business is seeking through a growth transaction.

      Goal: To thoroughly evaluate all potential risks associated with the organization(s) being pursued and create a detailed plan for integrating the IT environments

      Due Diligence Prerequisite Checklist

      Before coming into the Due Diligence & Preparation phase, you must have addressed the following:

      • Understand the rationale for the company's decisions to pursue an acquisition and what opportunities or pain points the acquisition should alleviate.
      • Identify the key roles for the transaction team.
      • Identify the M&A governance.
      • Determine target metrics.
      • Select an integration strategy framework.
      • Conduct a RACI for key transaction tasks for the transaction team.

      Before coming into the Due Diligence & Preparation phase, we recommend addressing the following:

      • Create vision and mission statements.
      • Establish guiding principles.
      • Create a future-state operating model.
      • Identify the M&A operating model.
      • Document the communication plan.
      • Examine the business perspective of IT.
      • Identify key stakeholders and outline their relationship to the M&A process.
      • Be able to valuate the IT environment and communicate IT’s value to the business.

      The Technology Value Trinity

      Delivery of Business Value & Strategic Needs

      • Digital & Technology Strategy
        The identification of objectives and initiatives necessary to achieve business goals.
      • IT Operating Model
        The model for how IT is organized to deliver on business needs and strategies.
      • Information & Technology Governance
        The governance to ensure the organization and its customers get maximum value from the use of information and technology.

      All three elements of the Technology Value Trinity work in harmony to deliver business value and achieve strategic needs. As one changes, the others need to change as well.

      • Digital and IT Strategy tells you what you need to achieve to be successful.
      • IT Operating Model and Organizational Design is the alignment of resources to deliver on your strategy and priorities.
      • Information & Technology Governance is the confirmation of IT’s goals and strategy, which ensures the alignment of IT and business strategy. It’s the mechanism by which you continuously prioritize work to ensure that what is delivered is in line with the strategy. This oversight evaluates, directs, and monitors the delivery of outcomes to ensure that the use of resources results in the achieving the organization’s goals.

      Too often strategy, operating model and organizational design, and governance are considered separate practices. As a result, “strategic documents” end up being wish lists, and projects continue to be prioritized based on who shouts the loudest – not based on what is in the best interest of the organization.

      Due Diligence & Preparation

      Step 3.1

      Assess the Target Organization

      Activities

      • 3.1.1 Drive value with a due diligence charter
      • 3.1.2 Identify data room artifacts
      • 3.1.3 Assess technical debt
      • 3.1.4 Valuate the target IT organization
      • 3.1.5 Assess culture

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team
      • Business leaders
      • Prospective IT organization
      • Transition team

      Outcomes of Step

      This step of the process is when IT should actively evaluate the target organization being pursued for acquisition.

      3.1.1 Drive value with a due diligence charter

      1-2 hours

      Input: Key roles for the transaction team, M&A governance, Target metrics, Selected integration strategy framework, RACI of key transaction tasks for the transaction team

      Output: IT Due Diligence Charter

      Materials: M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create a charter leveraging the items completed in the previous phase, as listed on the Due Diligence Prerequisite Checklist slide, to gain executive sign-off.

      1. In the IT Due Diligence Charter in the M&A Buy Playbook, complete the aspects of the charter that are relevant for you and your organization.
      2. We recommend including these items in the charter:
        • Communication plan
        • Transition team roles
        • Goals and metrics for the transaction
        • Integration strategy
        • Acquisition RACI
      3. Once the charter has been completed, ensure that business executives agree to the charter and sign off on the plan of action.

      Record the results in the M&A Buy Playbook.

      3.1.2 Identify data room artifacts

      4 hours

      Input: Future-state operating model, M&A governance, Target metrics, Selected integration strategy framework, RACI of key transaction tasks for the transaction team

      Output: List of items to acquire and review in the data room

      Materials: Critical domain lists on following slides, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Transition team

      The purpose of this activity is to create a list of the key artifacts that should be asked for and reviewed during the due diligence process.

      1. Review the lists on the following pages as a starting point. Identify which domains, stakeholders, artifacts, and information should be requested for the data room. This information should be directed to the target organization.
      2. IT leadership may or may not be asked to enter the data room directly. Therefore, it’s important that you clearly identify these artifacts.
      3. List each question or concern, select the associated workstream in the M&A Buy Playbook, and update the status of the information retrieval.
      4. Use the comments section to document your discoveries or concerns.

      Record the results in the M&A Buy Playbook.

      Critical domains

      Understand the key stakeholders and outputs for each domain

      Each critical domain will likely have different stakeholders who know that domain best. Communicate with these stakeholders throughout the M&A process to make sure you are getting accurate information and interpreting it correctly.

      Domain

      Stakeholders

      Key Artifacts

      Key Information to request

      Business
      • Enterprise Architecture
      • Business Relationship Manager
      • Business Process Owners
      • Business capability map
      • Capability map (the M&A team should be taking care of this, but make sure it exists)
      • Business satisfaction with various IT systems and services
      Leadership/IT Executive
      • CIO
      • CTO
      • CISO
      • IT budgets
      • IT capital and operating budgets (from current year and previous year)
      Data & Analytics
      • Chief Data Officer
      • Data Architect
      • Enterprise Architect
      • Master data domains, system of record for each
      • Unstructured data retention requirements
      • Data architecture
      • Master data domains, sources, and storage
      • Data retention requirements
      Applications
      • Applications Manager
      • Application Portfolio Manager
      • Application Architect
      • Applications map
      • Applications inventory
      • Applications architecture
      • Copy of all software license agreements
      • Copy of all software maintenance agreements
      Infrastructure
      • Head of Infrastructure
      • Enterprise Architect
      • Infrastructure Architect
      • Infrastructure Manager
      • Infrastructure map
      • Infrastructure inventory
      • Network architecture (including which data centers host which infrastructure and applications)
      • Inventory (including integration capabilities of vendors, versions, switches, and routers)
      • Copy of all hardware lease or purchase agreements
      • Copy of all hardware maintenance agreements
      • Copy of all outsourcing/external service provider agreements
      • Copy of all service-level agreements for centrally provided, shared services and systems
      Products and Services
      • Product Manager
      • Head of Customer Interactions
      • Product lifecycle
      • Product inventory
      • Customer market strategy

      Critical domains (continued)

      Understand the key stakeholders and outputs for each domain

      Domain

      Stakeholders

      Key Artifacts

      Key Information to request

      Operations
      • Head of Operations
      • Service catalog
      • Service overview
      • Service owners
      • Access policies and procedures
      • Availability and service levels
      • Support policies and procedures
      • Costs and approvals (internal and customer costs)
      IT Processes
      • CIO
      • IT Management
      • VP of IT Governance
      • VP of IT Strategy
      • IT process flow diagram
      • Processes in place and productivity levels (capacity)
      • Critical processes/processes the organization feels they do particularly well
      IT People
      • CIO
      • VP of Human Resources
      • IT organizational chart
      • Competency & capacity assessment
      • IT organizational structure (including resources from external service providers such as contractors) with appropriate job descriptions or roles and responsibilities
      • IT headcount and location
      Security
      • CISO
      • Security Architect
      • Security posture
      • Information security staff
      • Information security service providers
      • Information security tools
      • In-flight information security projects
      Projects
      • Head of Projects
      • Project portfolio
      • List of all future, ongoing, and recently completed projects
      Vendors
      • Head of Vendor Management
      • License inventory
      • Inventory (including what will and will not be transitioning, vendors, versions, number of licenses)

      Assess the target organization’s technical debt

      The other organization could be costly to purchase if not yet modernizing.

      • Consider the potential costs that your business will have to spend to get the other IT organization modernized or even digital.
      • This will be highly affected by your planned integration strategy.
      • A best-of-breed strategy might simply mean there's little to bring over from the other organization’s environment.
      • It’s often challenging to identify a direct financial cost for technical debt. Consider direct costs but also assess categories of impact that can have a long-term effect on your business: lost customer, staff, or business partner goodwill; limited flexibility and resilience; and health, safety, and compliance impacts.
      • Use more objective measures to track subjective impact. For example, consider the number of customers who could be significantly affected by each tech debt in the next quarter.

      Focus on solving the problems you need to address.

      Analyzing technical debt has value in that the analysis can help your organization make better risk management and resource allocation decisions.

      Review these examples of technical debt

      Do you have any of these challenges?

      Applications
      • Inefficient or incomplete code
      • Fragile or obsolete systems of record that limit the implementation of new functionality
      • Out-of-date IDEs or compilers
      • Unsupported applications
      Data & Analytics
      • Data presented via API that does not conform to chosen standards (EDI, NRF-ARTS, etc.)
      • Poor data governance
      • No transformation between OLTP and the data warehouse
      • Heavy use of OLTP for reporting
      • Lack of AI model and decision governance, maintenance
      End-User Computing
      • Aging and slow equipment
      • No configuration management
      • No MDM/UEM
      Security
      • Unpatched/unpatchable systems
      • Legacy firewalls
      • No data classification system
      • “Perimeter” security architecture
      • No documented security incident response
      • No policies, or unenforced policies
      Operations
      • Incomplete, ineffective, or undocumented business continuity and disaster recovery plans
      • Insufficient backups or archiving
      • Inefficient MACD processes
      • Application sprawl with no record of installed applications or licenses
      • No ticketing or ITSM system
      • No change management process
      • No problem management process
      • No event/alert management
      Infrastructure
      • End-of-life/unsupported equipment
      • Aging power or cooling systems
      • Water- or halon-based data center fire suppression systems
      • Out-of-date firmware
      • No DR site
      • Damaged or messy cabling
      • Lack of system redundancy
      • Integrated computers on business equipment (e.g. shop floor equipment, medical equipment) running out-of-date OS/software
      Project & Portfolio Management
      • No project closure process
      • Ineffective project intake process
      • No resource management practices

      “This isn’t a philosophical exercise. Knowing what you want to get out of this analysis informs the type of technical debt you will calculate and the approach you will take.” (Scott Buchholz, CTO, Deloitte Government & Public Services Practice, The Wall Street Journal, 2015)

      3.1.3 Assess technical debt

      1-2 hours

      Input: Participant views on organizational tech debt, Five to ten key technical debts, Business impact scoring scales, Reasonable next-quarter scenarios for each technical debt, Technical debt business impact analysis

      Output: Initial list of tech debt for the target organization

      Materials: Whiteboard, Sticky notes, Technical Debt Business Impact Analysis Tool, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Business leaders, Transition team

      The purpose of this activity is to assess the technical debt of the other IT organization. Taking on unnecessary technical debt is one of the biggest risks to the IT environment

      1. This activity can be completed by leveraging the blueprint Manage Your Technical Debt, specifically the Technical Debt Business Impact Analysis Tool. Complete the following activities in the blueprint:
        • 1.2.1 Identify your technical debt
        • 1.2.2 Select tech debt for your impact analysis
        • 2.2.2 Estimate tech debt impact
        • 2.2.3 Identify the most-critical technical debts
      2. Review examples of technical debt in the previous slide to assist you with this activity.
      3. Document the results from tab 3, Impact Analysis, in the M&A Buy Playbook if you are trying to record all artifacts related to the transaction in one place.

      Record the results in the M&A Buy Playbook.

      How to valuate an IT environment

      And why it matters so much

      • Valuating the target organization’s IT environment is a critical step to fully understand what it might be worth. Business partners are often not in the position to valuate the IT aspects to the degree that you would be.
      • The business investments in IT can be directly translated to a value amount. Meaning for every $1 invested in IT, the business might be gaining $100 in value back or possibly even loosing $100.
      • Determining, documenting, and communicating this information ensures that the business takes IT’s suggestions seriously and recognizes why investing in IT can be so critical.
      • There are three ways a business or asset can be valuated:
        • Cost Approach: Look at the costs associated with building, purchasing, replacing, and maintaining a given aspect of the business.
        • Market Approach: Look at the relative value of a particular aspect of the business. Relative value can fluctuate and depends on what the markets and consequently society believe that particular element is worth.
        • Discounted Cash Flow Approach: Focus on what the potential value of the business could be or the intrinsic value anticipated due to future profitability.

      The IT valuation conducted during due diligence can have a significant impact on the final financials of the transaction for the business.

      3.1.4 Valuate the target IT organization

      1 day

      Input: Valuation of data, Valuation of applications, Valuation of infrastructure and operations, Valuation of security and risk

      Output: Valuation of target organization’s IT

      Materials: Relevant templates/tools, Capital budget, Operating budget, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Prospective IT organization

      The purpose of this activity is to valuate the other IT organization.

      1. Review each of slides 42 to 45 to generate a valuation of IT’s data, applications, infrastructure, and security and risk. These valuations consider several tangible and intangible factors and result in a final dollar amount. For more information on this activity, review Activity 1.2.1 from the Proactive phase.
      2. Identify financial amounts for each critical area and add the financial output to the summary slide in the M&A Buy Playbook.
      3. Compare this information against your own IT organization’s valuation.
        1. Does it add value to your IT organization?
        2. Is there too much risk to accept if this transaction goes through?

      Info-Tech Insight

      Consistency is key when valuating your IT organization as well as other IT organizations throughout the transaction process.

      Record the results in the M&A Buy Playbook.

      Culture should not be overlooked, especially as it relates to the integration of IT environments

      • There are three types of culture that need to be considered.
      • Most importantly, this transition is an opportunity to change the culture that might exist in your organization’s IT environment.
      • Make a decision on which type of culture you’d like IT to have post-transition.

      Target Organization’s Culture

      The culture that the target organization is currently embracing. Their established and undefined governance practices will lend insight into this.

      Your Organization’s Culture

      The culture that your organization is currently embracing. Examine people’s attitudes and behaviors within IT toward their jobs and the organization.

      Ideal Culture

      What will the future culture of the IT organization be once integration is complete? Are there aspects that your current organization and the target organization embrace that are worth considering?

      Culture categories

      Map the results of the IT Culture Diagnostic to an existing framework

      Competitive
      • Autonomy
      • Confront conflict directly
      • Decisive
      • Competitive
      • Achievement oriented
      • Results oriented
      • High performance expectations
      • Aggressive
      • High pay for good performance
      • Working long hours
      • Having a good reputation
      • Being distinctive/different
      Innovative
      • Adaptable
      • Innovative
      • Quick to take advantage of opportunities
      • Risk taking
      • Opportunities for professional growth
      • Not constrained by rules
      • Tolerant
      • Informal
      • Enthusiastic
      Traditional
      • Stability
      • Reflective
      • Rule oriented
      • Analytical
      • High attention to detail
      • Organized
      • Clear guiding philosophy
      • Security of employment
      • Emphasis on quality
      • Focus on safety
      Cooperative
      • Team oriented
      • Fair
      • Praise for good performance
      • Supportive
      • Calm
      • Developing friends at work
      • Socially responsible

      Culture Considerations

      • What culture category was dominant for each IT organization?
      • Do you share the same dominant category?
      • Is your current dominant culture category the most ideal to have post-integration?

      3.1.5 Assess Culture

      3-4 hours

      Input: Cultural assessments for current IT organization, Cultural assessment for target IT organization

      Output: Goal for IT culture

      Materials: IT Culture Diagnostic, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, IT employees of current organization, IT employees of target organization, Company M&A team

      The purpose of this activity is to assess the different cultures that might exist within the IT environments of both organizations. More importantly, your IT organization can select its desired IT culture for the long term if it does not already exist.

      1. Complete this activity by leveraging the blueprint Fix Your IT Culture, specifically the IT Culture Diagnostic. Fill out the diagnostic for the IT department in your organization:
        1. Answer the 16 questions in tab 2, Diagnostic.
        2. Find out your dominant culture and review recommendations in tab 3, Results.
      2. Document the results from tab 3, Results, in the M&A Buy Playbook if you are trying to record all artifacts related to the transaction in one place.
      3. Repeat the activity for the target organization.
      4. Leverage the information to determine what the goal for the culture of IT will be post-integration if it will differ from the current culture.

      Record the results in the M&A Buy Playbook.

      Due Diligence & Preparation

      Step 3.2

      Prepare to Integrate

      Activities

      • 3.2.1 Prioritize integration tasks
      • 3.2.2 Establish the integration roadmap
      • 3.2.3 Identify the needed workforce supply
      • 3.2.4 Estimate integration costs
      • 3.2.5 Create an employee transition plan
      • 3.2.6 Create functional workplans for employees
      • 3.2.7 Align project metrics with identified tasks

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Transition team
      • Company M&A team

      Outcomes of Step

      Have an established plan of action toward integration across all domains and a strategy toward resources.

      Don’t underestimate the importance of integration preparation

      Integration is the process of combining the various components of one or more organizations into a single organization.

      80% of integration should happen within the first two years. (Source: CIO Dive)

      70% of M&A IT integrations fail due to components that could and should be addressed at the beginning. (Source: The Wall Street Journal, 2019)

      Info-Tech Insight

      Integration is not rationalization. Once the organization has integrated, it can prepare to rationalize the IT environment.

      Integration needs

      Identify your domain needs to support the target technology environment

      Set up a meeting with your IT due diligence team to:

      • Address data, applications, infrastructure, and other domain gaps.
      • Discuss the people and processes necessary to achieve the target technology environment and support M&A business objectives.

      Use this opportunity to:

      • Identify data and application complexities between your organization and the target organization.
      • Identify the IT people and process gaps, redundancies, and initiatives.
      • Determine your infrastructure needs and identify redundancies.
        • Does IT have the infrastructure to support the applications and business capabilities of the resultant enterprise?
        • Identify any gaps between the current infrastructure in both organizations and the infrastructure required in the resultant enterprise.
        • Identify any redundancies.
        • Determine the appropriate IT integration strategies.
      • Document your gaps, redundancies, initiatives, and assumptions to help you track and justify the initiatives that must be undertaken and help estimate the cost of integration.

      Integration implications

      Understand the implications for integration with respect to each target technology environment

      Domain

      Independent Models

      Create Links Between Critical Systems

      Move Key Capabilities to Common Systems

      Adopt One Model

      Data & Analytics

      • Consider data sources that might need to be combined (e.g. financials, email lists, internet).
      • Understand where each organization will warehouse its data and how it will be managed in a cost-effective manner.
      • Consider your reporting and transactional needs. Initially systems may remain separate, but eventually they will need to be merged.
      • Analyze whether or not the data types are compatible between companies.
      • Understand the critical data needs and the complexity of integration activities.
      • Consider your reporting and transactional needs. Initially systems may remain separate, but eventually they will need to be merged.
      • Focus on the master data domains that represent the core of your business.
      • Assess the value, size, location, and cleanliness of the target organization’s data sets.
      • Determine the data sets that will be migrated to capture expected synergies and drive core capabilities while addressing how other data sets will be maintained and managed.
      • Decide which applications to keep and which to terminate. This includes setting timelines for application retirement.
      • Establish interim linkages and common interfaces for applications while major migrations occur.

      Applications

      • Establish whether or not there are certain critical applications that still need to be linked (e.g. email, financials).
      • Leverage the unique strengths and functionalities provided by the applications used by each organization.
      • Confirm that adequate documentation and licensing exists.
      • Decide which critical applications need to be linked versus which need to be kept separate to drive synergies. For example, financial, email, and CRM may need to be linked, while certain applications may remain distinct.
      • Pay particular attention to the extent to which systems relating to customers, products, orders, and shipments need to be integrated.
      • Determine the key capabilities that require support from the applications identified by business process owners.
      • Assess which major applications need to be adopted by both organizations, based on the M&A goals.
      • Establish interim linkages and common interfaces for applications while major migrations occur.
      • Decide which applications to keep and which to terminate. This includes setting timelines for application retirement.
      • Establish interim linkages and common interfaces for applications while major migrations occur.

      Integration implications (continued)

      Understand the implications for integration with respect to each target technology environment

      Domain

      Independent Models

      Create Links Between Critical Systems

      Move Key Capabilities to Common Systems

      Adopt One Model

      Infrastructure

      • Assess the infrastructure demands created by retaining separate models (e.g. separate domains, voice, network integration).
      • Evaluate whether or not there are redundant data centers that could be consolidated to reduce costs.
      • Assess the infrastructure demands created by retaining separate models (e.g. separate domains, voice, network integration).
      • Evaluate whether or not there are redundant data centers that could be consolidated to reduce costs.
      • Evaluate whether certain infrastructure components, such as data centers, can be consolidated to support the new model while also eliminating redundancies. This will help reduce costs.
      • Assess which infrastructure components need to be kept versus which need to be terminated to support the new application portfolio. Keep in mind that increasing the transaction volume on a particular application increases the infrastructure capacity that is required for that application.
      • Extend the network to integrate additional locations.

      IT People & Processes

      • Retain workers from each IT department who possess knowledge of key products, services, and legacy systems.
      • Consider whether there are redundancies in staffing that could be eliminated.
      • The IT processes of each organization will most likely remain separate.
      • Consider the impact of the target organization on your IT processes.
      • Retain workers from each IT department who possess knowledge of key products, services, and legacy systems.
      • Consider whether there are redundancies in staffing that could be eliminated.
      • Consider how critical IT processes of the target organization fit with your current IT processes.
      • Identify which redundant staff members should be terminated by focusing on the key skills that will be necessary to support the common systems.
      • If there is overlap with the IT processes in both organizations, you may wish to map out both processes to get a sense for how they might work together.
      • Assess what processes will be prioritized to support IT strategies.
      • Identify which redundant staff members should be terminated by focusing on the key skills that will be necessary to support the prioritized IT processes.

      Integration implications (continued)

      Understand the implications for integration with respect to each target technology environment

      Domain

      Independent Models

      Create Links Between Critical Systems

      Move Key Capabilities to Common Systems

      Adopt One Model

      Leadership/IT Executive

      • Have insight into the goals and direction of the organization’s leadership. Make sure that a communication path has been established to receive information and provide feedback.
      • The decentralized model will require some form of centralization and strong governance processes to enable informed decisions.
      • Ensure that each area can deliver on its needs while not overstepping the goals and direction of the organization.
      • This will help with integration in the sense that front-line employees can see a single organization beginning to form.
      • In this model, there is the opportunity to select elements of each leadership style and strategy that will work for the larger organization.
      • Leadership can provide a single and unified approach to how the strategic goals will be executed.
      • More often than not, this would be the acquiring organization’s strategic direction.

      Vendors

      • Determine which contracts the target organization currently has in place.
      • Having different vendors in place will not be a bad model if it makes sense.
      • Spend time reviewing the contracts and ensuring that each organization has the right contracts to succeed.
      • Identify what redundancies might exist (ERPs, for example) and determine if the vendor would be willing to terminate one contract or another.
      • Through integration, it might be possible to engage in one set of contract negotiations for a single application or technology.
      • Identify whether there are opportunities to combine contracts or if they must remain completely separated until the end of the term.
      • In an effort to capitalize on the contracts working well, reduce the contracts that might be hindering the organization.
      • Speak to the vendor offering the contract.
      • Going forward, ensure the contracts are negotiated to include clauses to allow for easier and more cost-effective integration.

      Integration implications (continued)

      Understand the implications for integration with respect to each target technology environment

      Domain

      Independent Models

      Create Links Between Critical Systems

      Move Key Capabilities to Common Systems

      Adopt One Model

      Security

      • Both organizations would need to have a process for securing their organization.
      • Sharing and accessing information might be more difficult, as each organization would need to keep the other organization separate to ensure the organization remains secure.
      • Creating standard policies and procedures that each organization must adhere to would be critical here (for example, multifactor authentication).
      • Establish a single path of communication between the two organizations, ensuring reliable and secure data and information sharing.
      • Leverage the same solutions to protect the business as a whole from internal and external threats.
      • Identify opportunities where there might be user points of failure that could be addressed early in the process.
      • Determine what method of threat detection and response will best support the business and select that method to apply to the entire organization, both original and newly acquired.

      Projects

      • Projects remain ongoing as they were prior to the integration.
      • Some projects might be made redundant after the initial integration is over.
      • Re-evaluate the projects after integration to ensure they continue to deliver on the business’ strategic direction.
      • Determine which projects are similar to one another and identify opportunities to leverage business needs and solutions for each organization where possible.
      • Review project histories to determine the rationale for and success of projects that could be reused in either organization going forward.
      • Determine which projects should remain ongoing and which projects could wait to be implemented or could be completely stopped.
      • There might be certain modernization projects ongoing that cannot be stopped.
      • However, for all other projects, embrace a single portfolio.
      • Completely reduce or remove all ongoing projects from the one organization and continue with only the projects of the other organization.
      • Add in new projects when they arise as needed.

      3.2.1 Prioritize integration tasks

      2 hours

      Input: Integration tasks, Transition team, M&A RACI

      Output: Prioritized integration list

      Materials: Integration task checklist, Integration roadmap

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to prioritize the different integration tasks that your organization has identified as necessary to this transaction. Some tasks might not be relevant for this particular transaction, and others might be critical.

      1. Download the SharePoint or Excel version of the M&A Integration Project Management Tool. Identify which integration tasks you want as part of your project plan. Alter or remove any tasks that are irrelevant to your organization. Add in tasks you think are missing.
      2. When deciding criticality of the task, consider the effect on stakeholders, those who are impacted or influenced in the process of the task, and dependencies (e.g. data strategy needs to be addressed first before you can tackle its dependencies, like data quality).
      3. Feel free to edit the way you measure criticality. The standard tool leverages a three-point scale. At the end, you should have a list of tasks in priority order based on criticality.

      Record the updates in the M&A Integration Project Management Tool (SharePoint).

      Record the updates in the M&A Integration Project Management Tool (Excel).

      Integration checklists

      Prerequisite Checklist
      • Build the project plan for integration and prioritize activities
        • Plan first day
        • Plan first 30/100 days
        • Plan first year
      • Create an organization-aligned IT strategy
      • Identify critical stakeholders
      • Create a communication strategy
      • Understand the rationale for the acquisition or purchase
      • Develop IT's purchasing strategy
      • Determine goal opportunities
      • Create the mission and vision statements
      • Create the guiding principles
      • Create program metrics
      • Consolidate reports from due diligence/data room
      • Conduct culture assessment
      • Create a transaction team
      • Assess workforce demand and supply
      • Plan and communicate potential layoffs
      • Create an employee transition plan
      • Identify the IT investment
      Business
      • Design an enterprise architecture
      • Document your business architecture
      • Identify and assess all of IT's risks
      Leadership/IT Executive
      • Build an IT budget
      • Structure operating budget
      • Structure capital budget
      • Identify the needed workforce demand vs. capacity
      • Establish and monitor key metrics
      • Communicate value realized/cost savings
      Data
      • Confirm data strategy
      • Confirm data governance
      • Data architecture
      • Data sources
      • Data storage (on-premises vs. cloud)
      • Enterprise content management
      • Compatibility of data types between organizations
      • Cleanliness/usability of target organization data sets
      • Identify data sets that need to be combined to capture synergies/drive core capabilities
      • Reporting and analytics capabilities
      Applications
      • Prioritize and address critical applications
        • ERP
        • CRM
        • Email
        • HRIS
        • Financial
        • Sales
        • Risk
        • Security
      • Leverage application rationalization framework to determine applications to keep, terminate, or create
      • Develop method of integrating applications
      • Model critical applications that have dependencies on one another
      • Identify the infrastructure capacity required to support critical applications
      Operations
      • Communicate helpdesk/service desk information
      • Manage sales access to customer data
      • Determine locations and hours of operation
      • Consolidate phone lists and extensions
      • Synchronize email address books

      Integration checklists (continued)

      Infrastructure
      • Determine single network access
      • Manage organization domains
      • Consolidate data centers
      • Compile inventory of vendors, versions, switches, and routers
      • Review hardware lease or purchase agreements
      • Review outsourcing/service provider agreements
      • Review service-level agreements
      • Assess connectivity linkages between locations
      • Plan to migrate to a single email system if necessary
      Vendors
      • Establish a sustainable vendor management office
      • Review vendor landscape
      • Identify warranty options
      • Rationalize vendor services and solutions
      • Identify opportunities to mature the security architecture
      People
      • Design an IT operating model
      • Redesign your IT organizational structure
      • Conduct a RACI
      • Conduct a culture assessment and identify goal IT culture
      • Build an IT employee engagement program
      • Determine critical roles and systems/process/products they support
      • Create a list of employees to be terminated
      • Create employee transition plans
      • Create functional workplans
      Projects
      • Stop duplicate or unnecessary target organization projects
      • Communicate project intake process
      • Prioritize projects
      Products & Services
      • Ensure customer services requirements are met
      • Ensure customer interaction requirements are met
      • Select a solution for product lifecycle management
      Security
      • Conduct a security assessment of target organization
      • Develop accessibility prioritization and schedule
      • Establish an information security strategy
      • Develop a security awareness and training program
      • Develop and manage security governance, risk, and compliance
      • Identify security budget
      • Build a data privacy and classification program
      IT Processes
      • Evaluate current process models
      • Determine productivity/capacity levels of processes
      • Identify processes to be terminated
      • Identify process expectations from target organization
      • Establish a communication plan
      • Develop a change management process
      • Establish/review IT policies

      3.2.2 Establish the integration roadmap

      2 hours

      Input: Prioritized integration tasks, Employee transition plan, Integration RACI, Costs for activities, Activity owners

      Output: Integration roadmap

      Materials: M&A Integration Project Plan Tool (SharePoint), M&A Integration Project Plan Tool (Excel)

      Participants: IT executive/CIO, IT senior leadership, Transition team, Company M&A team

      The purpose of this activity is to create a roadmap to support IT throughout the integration process. Using the information gathered in previous activities, you can create a roadmap that will ensure a smooth integration.

      1. Leverage our M&A Integration Project Management Tool to track critical elements of the integration project. There are a few options available:
        1. Follow the instructions on the next slide if you are looking to upload our SharePoint project template.
        2. If you cannot or do not want to use SharePoint as your project management solution, download our Excel version of the tool.
          **Remember that this your tool, so customize to your liking.
      2. Identify who will own or be accountable for each of the integration tasks and establish the time frame for when each project should begin and end. This will confirm which tasks should be prioritized.

      Record the updates in the M&A Integration Project Management Tool (SharePoint).

      Record the updates in the M&A Integration Project Management Tool (Excel).

      Integration Project Management Tool (SharePoint Template)

      Follow these instructions to upload our template to your SharePoint environment

      1. Create or use an existing SP site.
      2. Download the M&A Integration Project Plan Tool (SharePoint) .wsp file from the Mergers & Acquisitions: The Buy Blueprint landing page.
      3. To import a template into your SharePoint environment, do the following:
        1. Open PowerShell.
        2. Connect-SPO Service (need to install PowerShell module).
        3. Enter in your tenant admin URL.
        4. Enter in your admin credentials.
        5. Set-SPO Site https://YourDomain.sharepoint.com/sites/YourSiteHe... -DenyAddAndCustomizePages 0
        OR
        1. Turn on both custom script features to allow users to run custom
      4. Screenshot of the 'Custom Script' option for importing a template into your SharePoint environment. Feature description reads 'Control whether users can run custom script on personal sites and self-service created sites. Note: changes to this setting might take up to 24 hours to take effect. For more information, see http://go.microsoft.com/fwlink/?LinkIn=397546'. There are options to prevent or allow users from running custom script on personal/self-service created sites.
      5. Enable the SharePoint Server Standard Site Collection features.
      6. Upload the .wsp file in Solutions Gallery.
      7. Deploy by creating a subsite and select from custom options.
        • Allow or prevent custom script
        • Security considerations of allowing custom script
        • Save, download, and upload a SharePoint site as a template
      8. Refer to Microsoft documentation to understand security considerations and what is and isn’t supported:

      For more information, check out the SharePoint Template: Step-by-Step Deployment Guide.

      Participate in active workforce planning to transition employees

      The chosen IT operating model, primary M&A goals, and any planned changes to business strategy will dramatically impact IT staffing and workforce planning efforts.

      Visualization of the three aspects of 'IT workforce planning', as listed below.

      IT workforce planning

      • Primary M&A goals
        If the goal of the M&A is cost cutting, then workforce planning will be necessary to identify labor redundancies.
      • Changes to business strategy
        If business strategy will change after the merger, then workforce planning will typically be more involved than if business strategy will not change.
      • Integration strategy
        For independent models, workforce planning will typically be unnecessary.
        For connection of essential systems or absorption, workforce planning will likely be an involved, time-consuming process.
      1. Estimate the headcount you will need through the end of the M&A transition period.
      2. Outline the process you will use to assess staff for roles that have more than one candidate.
      3. Review employees in each department to determine the best fit for each role.
      4. Determine whether terminations will happen all together or in waves.

      Info-Tech Insight

      Don’t be a short-term thinker when it comes to workforce planning! IT teams that only consider the headcount needed on day one of the new entity will end up scrambling to find skilled resources to fill workforce gaps later in the transition period.

      3.2.3 Identify the needed workforce supply

      3-4 hours

      Input: IT strategy, Prioritized integration tasks

      Output: A clear indication of how many resources are required for each role and the number of resources that the organization actually has

      Materials: Resource Management Supply-Demand Calculator

      Participants: IT executive/CIO, IT senior leadership, Target organization employees, Company M&A team, Transition team

      The purpose of this activity is to determine the anticipated amount of work that will be required to support projects (like integration), administrative, and keep-the-lights-on activities.

      1. Download the Resource Management Supply-Demand Calculator.
      2. The calculator requires minimal up-front staff participation: You can obtain meaningful results with participation from as few as one person with insight on the distribution of your resources and their average work week or month.
      3. The calculator will yield a report that shows a breakdown of your annual resource supply and demand, as well as the gap between the supply and demand. Further insight on project and non-project supply and demand are provided.
      4. Repeat the tool several times to identify the needs of your IT environment for day one, day 30/100, and year one. Anticipate that these will change over time. Also, do not forget to obtain this information from the target organization. Given that you will be integrating, it’s important to know how many staff they have in which roles.
      5. **For additional information, please review slides starting from slide 44 in Establish Realistic IT Resource Management Practices to see how to use the tool.

      Record the results in the Resource Management Supply-Demand Calculator.

      Resource Supply-Demand Calculator Output Example

      Example of a 'Resource Management Supply-Demand Analysis Report' with charts and tables measuring Annualized Resource Supply and Demand, Resource Capacity Confidence, Project Capacity, and combinations of those metrics.

      Resource Capacity Confidence. This figure is based on your confidence in supply confidence, demand stability, and the supply-demand ratio.

      Importance of estimating integration costs

      Change is the key driver of integration costs

      Integration costs are dependent on the following:
      • Meeting synergy targets – whether that be cost saving or growth related.
        • Employee-related costs, licensing, and reconfiguration fees play a huge part in meeting synergy targets.
      • Adjustments related to compliance or regulations – especially if there are changes to legal entities, reporting requirements, or risk-mitigation standards.
      • Governance or third party–related support required to ensure timelines are met and the integration is a success.
      Integration costs vary by industry type.
      • Certain industries may have integration costs made up of mostly one type, differing from other industries, due to the complexity and different demands of the transaction. For example:
        • Healthcare integration costs are mostly driven by regulatory, safety, and quality standards, as well as consolidation of the research and development function.
        • Energy and Utilities tend to have the lowest integration costs due to most transactions occurring within the same sector rather than as a cross-sector investment. For example, oil and gas acquisitions tend to be for oil fields and rigs (strategic fixed assets), which can easily be added to the buyer’s portfolio.

      Integration costs are more related to the degree of change required than the size of the transaction.

      3.2.4 Estimate integration costs

      3-4 hours

      Input: Integration tasks, Transition team, Valuation of current IT environment, Valuation of target IT environment, Outputs from data room, Technical debt, Employees

      Output: List of anticipated costs required to support IT integration

      Materials: Integration task checklist, Integration roadmap, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Transition team

      The purpose of this activity is to estimate the costs that will be associated with the integration. It’s important to ensure a realistic figure is identified and communicated to the larger M&A team within your company as early in the process as possible. This ensures that the funding required for the transaction is secured and budgeted for in the overarching transaction.

      1. On the associated slide in the M&A Buy Playbook, input:
        • Task
        • Domain
        • Cost type
        • Total cost amount
        • Level of certainty around the cost
      2. Provide a copy of the estimated costs to the company’s M&A team. Also provide any additional information identified earlier to help them understand the importance of those costs.

      Record the results in the M&A Buy Playbook.

      Employee transition planning

      Considering employee impact will be a huge component to ensure successful integration

      • Meet With Leadership
      • Plan Individual and Department Redeployment
      • Plan Individual and Department Layoffs
      • Monitor and Manage Departmental Effectiveness
      • For employees, the transition could mean:
        • Changing from their current role to a new role to meet requirements and expectations throughout the transition.
        • Being laid off because the role they are currently occupying has been made redundant.
      • It is important to plan for what the M&A integration needs will be and what the IT operational needs will be.
      • A lack of foresight into this long-term plan could lead to undue costs and headaches trying to retain critical staff, rehiring positions that were already let go, and keeping redundant employees longer then necessary.

      Info-Tech Insight

      Being transparent throughout the process is critical. Do not hesitate to tell employees the likelihood that their job may be made redundant. This will ensure a high level of trust and credibility for those who remain with the organization after the transaction.

      3.2.5 Create an employee transition plan

      3-4 hours

      Input: IT strategy, IT organizational design, Resource Supply-Demand Calculator output

      Output: Employee transition plans

      Materials: M&A Buy Playbook, Whiteboard, Sticky notes, Markers

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Transition team

      The purpose of this activity is to create a transition plan for employees.

      1. Transition planning can be done at specific individual levels or more broadly to reflect a single role. Consider these four items in the transition plan:
        • Understand the direction of the employee transitions.
        • Identify employees that will be involved in the transition (moved or laid off).
        • Prepare to meet with employees.
        • Meet with employees.
      2. For each employee that will be facing some sort of change in their regular role, permanent or temporary, create a transition plan.
      3. For additional information on transitioning employees, review the blueprint Streamline Your Workforce During a Pandemic.

      **Note that if someone’s future role is a layoff, then there is no need to record anything for skills needed or method for skill development.

      Record the results in the M&A Buy Playbook.

      3.2.6 Create functional workplans for employees

      3-4 hours

      Input: Prioritized integration tasks, Employee transition plan, Integration RACI, Costs for activities, Activity owners

      Output: Employee functional workplans

      Materials: M&A Buy Playbook, Learning and development tools

      Participants: IT executive/CIO, IT senior leadership, IT management team, Company M&A team, Transition team

      The purpose of this activity is to create a functional workplan for the different employees so that they know what their key role and responsibilities are once the transaction occurs.

      1. First complete the transition plan from the previous activity (3.2.5) and the separation roadmap. Have these documents ready to review throughout this process.
      2. Identify the employees who will be transitioning to a new role permanently or temporarily. Creating a functional workplan is especially important for these employees.
      3. Identify the skills these employees need to have to support the separation. Record this in the corresponding slide in the M&A Buy Playbook.
      4. For each employee, identify someone who will be a point of contact for them throughout the transition.

      It is recommended that each employee have a functional workplan. Leverage the IT managers to support this task.

      Record the results in the M&A Buy Playbook.

      Metrics for integration

      Valuation & Due Diligence

      • % Defects discovered in production
      • $ Cost per user for enterprise applications
      • % In-house-built applications vs. enterprise applications
      • % Owners identified for all data domains
      • # IT staff asked to participate in due diligence
      • Change to due diligence
      • IT budget variance
      • Synergy target

      Execution & Value Realization

      • % Satisfaction with the effectiveness of IT capabilities
      • % Overall end-customer satisfaction
      • $ Impact of vendor SLA breaches
      • $ Savings through cost-optimization efforts
      • $ Savings through application rationalization and technology standardization
      • # Key positions empty
      • % Frequency of staff turnover
      • % Emergency changes
      • # Hours of unplanned downtime
      • % Releases that cause downtime
      • % Incidents with identified problem record
      • % Problems with identified root cause
      • # Days from problem identification to root cause fix
      • % Projects that consider IT risk
      • % Incidents due to issues not addressed in the security plan
      • # Average vulnerability remediation time
      • % Application budget spent on new build/buy vs. maintenance (deferred feature implementation, enhancements, bug fixes)
      • # Time (days) to value realization
      • % Projects that realized planned benefits
      • $ IT operational savings and cost reductions that are related to synergies/divestitures
      • % IT staff–related expenses/redundancies
      • # Days spent on IT integration
      • $ Accurate IT budget estimates
      • % Revenue growth directly tied to IT delivery
      • % Profit margin growth

      3.2.7 Align project metrics with identified tasks

      3-4 hours

      Input: Prioritized integration tasks, Employee transition plan, Integration RACI, Costs for activities, Activity owners, M&A goals

      Output: Integration-specific metrics to measure success

      Materials: Roadmap template, M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Transition team

      The purpose of this activity is to understand how to measure the success of the integration project by aligning metrics to each identified task.

      1. Review the M&A goals identified by the business. Your metrics will need to tie back to those business goals.
      2. Identify metrics that align to identified tasks and measure achievement of those goals. For each metric you consider, ask the following questions:
        • What is the main goal or objective that this metric is trying to solve?
        • What does success look like?
        • Does the metric promote the right behavior?
        • Is the metric actionable? What is the story you are trying to tell with this metric?
        • How often will this get measured?
        • Are there any metrics it supports or is supported by?

      Record the results in the M&A Buy Playbook.

      By the end of this mid-transaction phase you should:

      Have successfully evaluated the target organization’s IT environment, escalated the acquisition risks and benefits, and prepared IT for integration.

      Key outcomes from the Due Diligence & Preparation phase
      • Participate in due diligence activities to accurately valuate the target organization(s) and determine if there are critical risks or benefits the current organization should be aware of.
      • Create an integration roadmap that considers the tasks that will need to be completed and the resources required to support integration.
      Key deliverables from the Due Diligence & Preparation phase
      • Establish a due diligence charter
      • Create a list of data room artifacts and engage in due diligence
      • Assess the target organization’s technical debt
      • Valuate the target IT organization
      • Assess and plan for culture
      • Prioritize integration tasks
      • Establish the integration roadmap
      • Identify the needed workforce supply
      • Estimate integration costs
      • Create employee transition plans
      • Create functional workplans for employees
      • Align project metrics with identified tasks

      M&A Buy Blueprint

      Phase 4

      Execution & Value Realization

      Phase 1Phase 2Phase 3

      Phase 4

      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Growth Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Acquisition
      • 3.1 Assess the Target Organization
      • 3.2 Prepare to Integrate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Rationalize the IT environment
      • Continually update the project plan
      • Confirm integration costs
      • Review IT’s transaction value
      • Conduct a transaction and integration SWOT
      • Review the playbook and prepare for future transactions

      This phase involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Vendor management team
      • IT transaction team
      • Company M&A team

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Pre-Work

      Day 1

      Day 2

      Day 3

      Engage in Integration

      Day 4

      Establish the Transaction FoundationDiscover the Motivation for IntegrationPlan the Integration RoadmapPrepare Employees for the TransitionEngage in IntegrationAssess the Transaction Outcomes (Must be within 30 days of transaction date)

      Activities

      • 0.1 Understand the rationale for the company's decisions to pursue an acquisition.
      • 0.2 Identify key stakeholders and determine the IT transaction team.
      • 0.3 Gather and evaluate the M&A strategy, future-state operating model, and governance.
      • 1.1 Review the business rationale for the acquisition.
      • 1.2 Identify pain points and opportunities tied to the acquisition.
      • 1.3 Establish the integration strategy.
      • 1.4 Prioritize Integration tasks.
      • 2.1 Establish the integration roadmap.
      • 2.2 Establish and align project metrics with identified tasks.
      • 2.3 Estimate integration costs.
      • 3.1 Assess the current culture and identify the goal culture.
      • 3.2 Identify the needed workforce supply.
      • 3.3 Create an employee transition plan.
      • 3.4 Create functional workplans for employees.
      • I.1 Complete the integration by regularly updating the project plan.
      • I.2 Begin to rationalize the IT environment where possible and necessary.
      • 4.1 Confirm integration costs.
      • 4.2 Review IT’s transaction value.
      • 4.3 Conduct a transaction and integration SWOT.
      • 4.4 Review the playbook and prepare for future transactions.

      Deliverables

      1. IT strategy
      2. IT operating model
      3. IT governance structure
      4. M&A transaction team
      1. Business context implications for IT
      2. Integration strategy
      1. Integration roadmap and associated resourcing
      1. Culture assessment
      2. Workforce supply identified
      3. Employee transition plan
      1. Rationalized IT environment
      2. Updated integration project plan
      1. SWOT of transaction
      2. M&A Buy Playbook refined for future transactions

      What is the Execution & Value Realization phase?

      Post-transaction state

      Once the transaction comes to a close, it’s time for IT to deliver on the critical integration tasks. Set the organization up for success by having an integration roadmap. Retaining critical IT staff throughout this process will also be imperative to the overall transaction success.

      Throughout the integration process, roadblocks will arise and need to be addressed. However, by ensuring that employees, technology, and processes are planned for ahead of the transaction, you as IT will be able to weather those unexpected concerns with greater ease.

      Now that you as an IT leader have engaged in an acquisition, demonstrating the value IT was able to provide to the process is critical to establishing a positive and respected relationship with other senior leaders in the business. Be prepared to identify the positives and communicate this value to advance the business’ perception of IT.

      Goal: To carry out the planned integration activities and deliver the intended value to the business

      Execution Prerequisite Checklist

      Before coming into the Execution & Value Realization phase, you must have addressed the following:

      • Understand the rationale for the company's decisions to pursue an acquisition and what opportunities or pain points the acquisition should alleviate.
      • Identify the key roles for the transaction team.
      • Identify the M&A governance.
      • Determine target metrics and align to project tasks.
      • Select an integration strategy framework.
      • Conduct a RACI for key transaction tasks for the transaction team.
      • Create a list of data room artifacts and engage in due diligence (directly or indirectly).
      • Prioritize integration tasks.
      • Establish the integration roadmap.
      • Identify the needed workforce supply.
      • Create employee transition plans.

      Before coming into the Execution & Value Realization phase, we recommend addressing the following:

      • Create vision and mission statements.
      • Establish guiding principles.
      • Create a future-state operating model.
      • Identify the M&A operating model.
      • Document the communication plan.
      • Examine the business perspective of IT.
      • Identify key stakeholders and outline their relationship to the M&A process.
      • Be able to valuate the IT environment and communicate IT's value to the business.
      • Establish a due diligence charter.
      • Assess the target organization’s technical debt.
      • Valuate the target IT organization.
      • Assess and plan for culture.
      • Estimate integration costs.
      • Create functional workplans for employees.

      Integration checklists

      Prerequisite Checklist
      • Build the project plan for integration and prioritize activities
        • Plan first day
        • Plan first 30/100 days
        • Plan first year
      • Create an organization-aligned IT strategy
      • Identify critical stakeholders
      • Create a communication strategy
      • Understand the rationale for the acquisition or purchase
      • Develop IT's purchasing strategy
      • Determine goal opportunities
      • Create the mission and vision statements
      • Create the guiding principles
      • Create program metrics
      • Consolidate reports from due diligence/data room
      • Conduct culture assessment
      • Create a transaction team
      • Assess workforce demand and supply
      • Plan and communicate potential layoffs
      • Create an employee transition plan
      • Identify the IT investment
      Business
      • Design an enterprise architecture
      • Document your business architecture
      • Identify and assess all of IT's risks
      Leadership/IT Executive
      • Build an IT budget
      • Structure operating budget
      • Structure capital budget
      • Identify the needed workforce demand vs. capacity
      • Establish and monitor key metrics
      • Communicate value realized/cost savings
      Data
      • Confirm data strategy
      • Confirm data governance
      • Data architecture
      • Data sources
      • Data storage (on-premises vs. cloud)
      • Enterprise content management
      • Compatibility of data types between organizations
      • Cleanliness/usability of target organization data sets
      • Identify data sets that need to be combined to capture synergies/drive core capabilities
      • Reporting and analytics capabilities
      Applications
      • Prioritize and address critical applications
        • ERP
        • CRM
        • Email
        • HRIS
        • Financial
        • Sales
        • Risk
        • Security
      • Leverage application rationalization framework to determine applications to keep, terminate, or create
      • Develop method of integrating applications
      • Model critical applications that have dependencies on one another
      • Identify the infrastructure capacity required to support critical applications
      Operations
      • Communicate helpdesk/service desk information
      • Manage sales access to customer data
      • Determine locations and hours of operation
      • Consolidate phone lists and extensions
      • Synchronize email address books

      Integration checklists (continued)

      Infrastructure
      • Determine single network access
      • Manage organization domains
      • Consolidate data centers
      • Compile inventory of vendors, versions, switches, and routers
      • Review hardware lease or purchase agreements
      • Review outsourcing/service provider agreements
      • Review service-level agreements
      • Assess connectivity linkages between locations
      • Plan to migrate to a single email system if necessary
      Vendors
      • Establish a sustainable vendor management office
      • Review vendor landscape
      • Identify warranty options
      • Rationalize vendor services and solutions
      • Identify opportunities to mature the security architecture
      People
      • Design an IT operating model
      • Redesign your IT organizational structure
      • Conduct a RACI
      • Conduct a culture assessment and identify goal IT culture
      • Build an IT employee engagement program
      • Determine critical roles and systems/process/products they support
      • Create a list of employees to be terminated
      • Create employee transition plans
      • Create functional workplans
      Projects
      • Stop duplicate or unnecessary target organization projects
      • Communicate project intake process
      • Prioritize projects
      Products & Services
      • Ensure customer services requirements are met
      • Ensure customer interaction requirements are met
      • Select a solution for product lifecycle management
      Security
      • Conduct a security assessment of target organization
      • Develop accessibility prioritization and schedule
      • Establish an information security strategy
      • Develop a security awareness and training program
      • Develop and manage security governance, risk, and compliance
      • Identify security budget
      • Build a data privacy and classification program
      IT Processes
      • Evaluate current process models
      • Determine productivity/capacity levels of processes
      • Identify processes to be terminated
      • Identify process expectations from target organization
      • Establish a communication plan
      • Develop a change management process
      • Establish/review IT policies

      Execution & Value Realization

      Step 4.1

      Execute the Transaction

      Activities

      • 4.1.1 Rationalize the IT environment
      • 4.1.2 Continually update the project plan

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Vendor management team
      • IT transaction team
      • Company M&A team

      Outcomes of Step

      Successfully execute on the integration and strategize how to rationalize the two (or more) IT environments and update the project plan, strategizing against any roadblocks as they might come.

      Compile –› Assess –› Rationalize

      Access to critical information often does not happen until day one

      • As the transaction comes to a close and the target organization becomes the acquired organization, it’s important to start working on the rationalization of your organization.
      • One of the most important elements will be to have a complete understanding of the acquired organization’s IT environment. Specifically, assess the technology, people, and processes that might exist.
      • This rationalization will be heavily dependent on your planned integration strategy determined in the Discovery & Strategy phase of the process.
      • If your IT organization was not involved until after that phase, then determine whether your organization plans on remaining in its original state, taking on the acquired organization’s state, or forming a best-of-breed state by combining elements.
      • To execute on this, however, a holistic understanding of the new IT environment is required.

      Some Info-Tech resources to support this initiative:

      • Reduce and Manage Your Organization’s Insider Threat Risk
      • Build an Application Rationalization Framework
      • Rationalize Your Collaboration Tools
      • Consolidate IT Asset Management
      • Build Effective Enterprise Integration on the Back of Business Process
      • Consolidate Your Data Centers

      4.1.1 Rationalize the IT environment

      6-12 months

      Input: RACI chart, List of critical applications, List of vendor contracts, List of infrastructure assets, List of data assets

      Output: Rationalized IT environment

      Materials: Software Terms & Conditions Evaluation Tool

      Participants: IT executive/CIO, IT senior leadership, Vendor management

      The purpose of this activity is to rationalize the IT environment to reduce and eliminate redundant technology.

      1. Compile a list of the various applications and vendor contracts from the acquired organization and the original organization.
      2. Determine where there is repetition. Have a member of the vendor management team review those contracts and identify cost-saving opportunities.

      This will not be a quick and easy activity to complete. It will require strong negotiation on the behalf of the vendor management team.

      For additional information and support for this activity, see the blueprint Master Contract Review and Negotiations for Software Agreements.

      4.1.2 Continually update the project plan

      Reoccurring basis following transition

      Input: Prioritized integration tasks, Integration RACI, Activity owners

      Output: Updated integration project plan

      Materials: M&A Integration Project Management Tool

      Participants: IT executive/CIO, IT senior leadership, IT transaction team, Company M&A team

      The purpose of this activity is to ensure that the project plan is continuously updated as your transaction team continues to execute on the various components outlined in the project plan.

      1. Set a regular cadence for the transaction team to meet, update and review the status of the various integration task items, and strategize how to overcome any roadblocks.
      2. Employ governance best practices in these meetings to ensure decisions can be made effectively and resources allocated strategically.

      Record the updates in the M&A Integration Project Management Tool (SharePoint).

      Record the updates in the M&A Integration Project Management Tool (Excel).

      Execution & Value Realization

      Step 4.2

      Reflection and Value Realization

      Activities

      • 4.2.1 Confirm integration costs
      • 4.2.2 Review IT’s transaction value
      • 4.2.3 Conduct a transaction and integration SWOT
      • 4.2.4 Review the playbook and prepare for future transactions

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Transition team
      • Company M&A team

      Outcomes of Step

      Review the value that IT was able to generate around the transaction and strategize on how to improve future acquisition transactions.

      4.2.1 Confirm integration costs

      3-4 hours

      Input: Integration tasks, Transition team, Previous RACI, Estimated costs

      Output: Actual integration costs

      Materials: M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, IT transaction team, Company M&A team

      The purpose of this activity is to confirm the associated costs around integration. While the integration costs would have been estimated previously, it’s important to confirm the costs that were associated with the integration in order to provide an accurate and up-to-date report to the company’s M&A team.

      1. Taking all the original items identified previously in activity 3.2.4, identify if there were changes in the estimated costs. This can be an increase or a decrease.
      2. Ensure that each cost has a justification for why the cost changed from the original estimation.

      Record the results in the M&A Buy Playbook.

      Track synergy capture through the IT integration

      The ultimate goal of the M&A is to achieve and deliver deal objectives. Early in the M&A, IT must identify, prioritize, and execute upon synergies that deliver value to the business and its shareholders. Continue to measure IT’s contribution toward achieving the organization’s M&A goals throughout the integration by keeping track of cost savings and synergies that have been achieved. When these achievements happen, communicate them and celebrate success.

      1. Define Synergy Metrics: Select metrics to track synergies through the integration.
        1. You can track value by looking at percentages of improvement in process-level metrics depending on the synergies being pursued.
        2. For example, if the synergy being pursued is increasing asset utilization, metrics could range from capacity to revenue generated through increased capacity.
      2. Prioritize Synergistic Initiatives: Estimate the cost and benefit of each initiative's implementation to compare the amount of business value to the cost. The benefits and costs should be illustrated at a high level. Estimating the exact dollar value of fulfilling a synergy can be difficult and misleading.
          Steps
        • Determine the benefits that each initiative is expected to deliver.
        • Determine the high-level costs of implementation (capacity, time, resources, effort).
      3. Track Synergy Captures: Develop a detailed workplan to resource the roadmap and track synergy captures as the initiatives are undertaken.

      Once 80% of the necessary synergies are realized, executive pressure will diminish. However, IT must continue to work toward the technology end state to avoid delayed progression.

      4.2.2 Review IT’s transaction value

      3-4 hours

      Input: Prioritized integration tasks, Integration RACI, Activity owners, M&A company goals

      Output: Transaction value

      Materials: M&A Buy Playbook

      Participants: IT executive/CIO, IT senior leadership, Company's M&A team

      The purpose of this activity is to track how your IT organization performed against the originally identified metrics.

      1. If your organization did not have the opportunity to identify metrics earlier, determine from the company M&A team what those metrics might be. Review activity 3.2.7 for more information on metrics.
      2. Identify whether the metric (which should be used to support a goal) was at, below, or above the original target metric. This is a very critical task for IT to complete because it allows IT to confirm that they were successful engaging in the transaction and that the business can count on them in future transactions.
      3. Be sure to record accurate and relevant information on why the outcomes (good or bad) are supporting the M&A goals that were set out by the business.

      Record the results in the M&A Buy Playbook.

      4.2.3 Conduct a transaction and integration SWOT

      2 hours

      Input: Integration costs, Retention rates, Value IT contributed to the transaction

      Output: Strengths, weaknesses, opportunities, and threats

      Materials: Flip charts, Markers, Sticky notes

      Participants: IT executive/CIO, IT senior leadership, Business transaction team

      The purpose of this activity is to assess the positive and negative elements of the transaction.

      1. Consider the various internal and external elements that could have impacted the outcome of the transaction.
        • Strengths. Internal characteristics that are favorable as they relate to your development environment.
        • Weaknesses Internal characteristics that are unfavorable or need improvement.
        • Opportunities External characteristics that you may use to your advantage.
        • Threats External characteristics that may be potential sources of failure or risk.

      Record the results in the M&A Buy Playbook.

      M&A Buy Playbook review

      With an acquisition complete, your IT organization is now more prepared then ever to support the business through future M&As

      • Now that the transaction is more than 80% complete, take the opportunity to review the key elements that worked well and the opportunities for improvement in future transactions.
      • Critically examine the M&A Buy Playbook your IT organization created and identify what worked well to help the transaction and where your organization could adjust to do better in future transactions.
      • If your organization were to engage in another acquisition under your IT leadership, how would you go about the transaction to make sure the company meets its goals?

      4.2.4 Review the playbook and prepare for future transactions

      4 hours

      Input: Transaction and integration SWOT

      Output: Refined M&A playbook

      Materials: M&A Buy Playbook

      Participants: IT executive/CIO

      The purpose of this activity is to revise the playbook and ensure it is ready to go for future transactions.

      1. Using the outputs from the previous activity, 4.2.3, determine what strengths and opportunities there were that should be leveraged in the next transaction.
      2. Likewise, determine which threats and weaknesses could be avoided in the future transactions.
        Remember, this is your M&A Buy Playbook, and it should reflect the most successful outcome for you in your organization.

      Record the results in the M&A Buy Playbook.

      By the end of this post-transaction phase you should:

      Have completed the integration post-transaction and be fluidly delivering the critical value that the business expected of IT.

      Key outcomes from the Execution & Value Realization phase
      • Ensure the integration tasks are being completed and that any blockers related to the transaction are being removed.
      • Determine where IT was able to realize value for the business and demonstrate IT’s involvement in meeting target goals.
      Key deliverables from the Execution & Value Realization phase
      • Rationalize the IT environment
      • Continually update the project plan for completion
      • Confirm integration costs
      • Review IT’s transaction value
      • Conduct a transaction and integration SWOT
      • Review the playbook and prepare for future transactions

      Summary of Accomplishment

      Problem Solved

      Congratulations, you have completed the M&A Buy Blueprint!

      Rather than reacting to a transaction, you have been proactive in tackling this initiative. You now have a process to fall back on in which you can be an innovative IT leader by suggesting how and why the business should engage in an acquisition. You now have:

      • Created a standardized approach for how your IT organization should address acquisitions.
      • Evaluated the target organizations successfully and established an integration project plan.
      • Delivered on the integration project plan successfully and communicated IT’s transaction value to the business.

      Now that you have done all of this, reflect on what went well and what can be improved in case if you have to do this all again in a future transaction.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information
      workshops@infotech.com 1-888-670-8899

      Research Contributors and Experts

      Ibrahim Abdel-Kader
      Research Analyst | CIO
      Info-Tech Research Group
      Brittany Lutes
      Senior Research Analyst | CIO
      Info-Tech Research Group
      John Annand
      Principal Research Director | Infrastructure
      Info-Tech Research Group
      Scott Bickley
      Principal Research Director | Vendor Management
      Info-Tech Research Group
      Cole Cioran
      Practice Lead | Applications
      Info-Tech Research Group
      Dana Daher
      Research Analyst | Strategy & Innovation
      Info-Tech Research Group
      Eric Dolinar
      Manager | M&A Consulting
      Deloitte Canada
      Christoph Egel
      Director, Solution Design & Deliver
      Cooper Tire & Rubber Company
      Nora Fisher
      Vice President | Executive Services Advisory
      Info-Tech Research Group
      Larry Fretz
      Vice President | Industry
      Info-Tech Research Group

      Research Contributors and Experts

      David Glazer
      Vice President of Analytics
      Kroll
      Jack Hakimian
      Senior Vice President | Workshops and Delivery
      Info-Tech Research Group
      Gord Harrison
      Senior Vice President | Research & Advisory
      Info-Tech Research Group
      Valence Howden
      Principal Research Director | CIO
      Info-Tech Research Group
      Jennifer Jones
      Research Director | Industry
      Info-Tech Research Group
      Nancy McCuaig
      Senior Vice President | Chief Technology and Data Office
      IGM Financial Inc.
      Carlene McCubbin
      Practice Lead | CIO
      Info-Tech Research Group
      Kenneth McGee
      Research Fellow | Strategy & Innovation
      Info-Tech Research Group
      Nayma Naser
      Associate
      Deloitte
      Andy Neill
      Practice Lead | Data & Analytics, Enterprise Architecture
      Info-Tech Research Group

      Research Contributors and Experts

      Rick Pittman
      Vice President | Research
      Info-Tech Research Group
      Rocco Rao
      Research Director | Industry
      Info-Tech Research Group
      Mark Rosa
      Senior Vice President & Chief Information Officer
      Mohegan Gaming and Entertainment
      Tracy-Lynn Reid
      Research Lead | People & Leadership
      Info-Tech Research Group
      Jim Robson
      Senior Vice President | Shared Enterprise Services (retired)
      Great-West Life
      Steven Schmidt
      Senior Managing Partner Advisory | Executive Services
      Info-Tech Research Group
      Nikki Seventikidis
      Senior Manager | Finance Initiative & Continuous Improvement
      CST Consultants Inc.
      Allison Straker
      Research Director | CIO
      Info-Tech Research Group
      Justin Waelz
      Senior Network & Systems Administrator
      Info-Tech Research Group
      Sallie Wright
      Executive Counselor
      Info-Tech Research Group

      Bibliography

      “5 Ways for CIOs to Accelerate Value During Mergers and Acquisitions.” Okta, n.d. Web.

      Altintepe, Hakan. “Mergers and acquisitions speed up digital transformation.” CIO.com, 27 July 2018. Web.

      “America’s elite law firms are booming.” The Economist, 15 July 2021. Web.

      Barbaglia, Pamela, and Joshua Franklin. “Global M&A sets Q1 record as dealmakers shape post-COVID world.” Nasdaq, 1 April 2021. Web.

      Boyce, Paul. “Mergers and Acquisitions Definition: Types, Advantages, and Disadvantages.” BoyceWire, 8 Oct. 2020. Web.

      Bradt, George. “83% Of Mergers Fail -- Leverage A 100-Day Action Plan For Success Instead.” Forbes, 27 Jan. 2015. Web.

      Capgemini. “Mergers and Acquisitions: Get CIOs, IT Leaders Involved Early.” Channel e2e, 19 June 2020. Web.

      Chandra, Sumit, et al. “Make Or Break: The Critical Role Of IT In Post-Merger Integration.” IMAA Institute, 2016. Web.

      Deloitte. “How to Calculate Technical Debt.” The Wall Street Journal, 21 Jan. 2015. Web.

      Ernst & Young. “IT As A Driver Of M&A Success.” IMAA Institute, 2017. Web.

      Fernandes, Nuno. “M&As In 2021: How To Improve The Odds Of A Successful Deal.” Forbes, 23 March 2021. Web.

      “Five steps to a better 'technology fit' in mergers and acquisitions.” BCS, 7 Nov. 2019. Web.

      Fricke, Pierre. “The Biggest Opportunity You’re Missing During an M&Aamp; IT Integration.” Rackspace, 4 Nov. 2020. Web.

      Garrison, David W. “Most Mergers Fail Because People Aren't Boxes.” Forbes, 24 June 2019. Web.

      Harroch, Richard. “What You Need To Know About Mergers & Acquisitions: 12 Key Considerations When Selling Your Company.” Forbes, 27 Aug. 2018. Web.

      Hope, Michele. “M&A Integration: New Ways To Contain The IT Cost Of Mergers, Acquisitions And Migrations.” Iron Mountain, n.d. Web.

      “How Agile Project Management Principles Can Modernize M&A.” Business.com, 13 April 2020. Web.

      Hull, Patrick. “Answer 4 Questions to Get a Great Mission Statement.” Forbes, 10 Jan. 2013. Web.

      Kanter, Rosabeth Moss. “What We Can Learn About Unity from Hostile Takeovers.” Harvard Business Review, 12 Nov. 2020. Web.

      Koller, Tim, et al. “Valuation: Measuring and Managing the Value of Companies, 7th edition.” McKinsey & Company, 2020. Web.

      Labate, John. “M&A Alternatives Take Center Stage: Survey.” The Wall Street Journal, 30 Oct. 2020. Web.

      Lerner, Maya Ber. “How to Calculate ROI on Infrastructure Automation.” DevOps.com, 1 July 2020. Web.

      Loten, Angus. “Companies Without a Tech Plan in M&A Deals Face Higher IT Costs.” The Wall Street Journal, 18 June 2019. Web.

      Low, Jia Jen. “Tackling the tech integration challenge of mergers today” Tech HQ, 6 Jan. 2020. Web.

      Lucas, Suzanne. “5 Reasons Turnover Should Scare You.” Inc. 22 March 2013. Web.

      “M&A Trends Survey: The future of M&A. Deal trends in a changing world.” Deloitte, Oct. 2020. Web.

      Maheshwari, Adi, and Manish Dabas. “Six strategies tech companies are using for successful divesting.” EY, 1 Aug. 2020. Web.

      Majaski, Christina. “Mergers and Acquisitions: What's the Difference?” Investopedia, 30 Apr. 2021.

      “Mergers & Acquisitions: Top 5 Technology Considerations.” Teksetra, 21 Jul. 2020. Web.

      “Mergers Acquisitions M&A Process.” Corporate Finance Institute, n.d. Web.

      “Mergers and acquisitions: A means to gain technology and expertise.” DLA Piper, 2020. Web.

      Nash, Kim S. “CIOs Take Larger Role in Pre-IPO Prep Work.” The Wall Street Journal, 5 March 2015. Web.

      Paszti, Laila. “Canada: Emerging Trends In Information Technology (IT) Mergers And Acquisitions.” Mondaq, 24 Oct. 2019. Web.

      Patel, Kiison. “The 8 Biggest M&A Failures of All Time” Deal Room, 9 Sept. 2021. Web.

      Peek, Sean, and Paula Fernandes. “What Is a Vision Statement?” Business News Daily, 7 May 2020. Web.

      Ravid, Barak. “Tech execs focus on growth amid increasingly competitive M&A market.” EY, 28 April 2021. Web.

      Resch, Scott. “5 Questions with a Mergers & Acquisitions Expert.” CIO, 25 June 2019. Web.

      Salsberg, Brian. “Four tips for estimating one-time M&A integration costs.” EY, 17 Oct. 2019. Web.

      Samuels, Mark. “Mergers and acquisitions: Five ways tech can smooth the way.” ZDNet, 15 Aug. 2018. Web.

      “SAP Divestiture Projects: Options, Approach and Challenges.” Cognizant, May, 2014. Web.

      Steeves, Dave. “7 Rules for Surviving a Merger & Acquisition Technology Integration.” Steeves and Associates, 5 Feb. 2020. Web.

      Tanaszi, Margaret. “Calculating IT Value in Business Terms.” CSO, 27 May 2004. Web.

      “The CIO Playbook. Nine Steps CIOs Must Take For Successful Divestitures.” SNP, 2016. Web.

      “The Role of IT in Supporting Mergers and Acquisitions.” Cognizant, Feb. 2015. Web.

      Torres, Roberto. “M&A playbook: How to prepare for the cost, staff and tech hurdles.” CIO Dive, 14 Nov. 2019. Web.

      “Valuation Methods.” Corporate Finance Institute, n.d. Web.

      Weller, Joe. “The Ultimate Guide to the M&A Process for Buyers and Sellers.” Smartsheet, 16 May 2019. Web.

      Gain Control of Cloud Integration Strategies Before they Float Away

      • Buy Link or Shortcode: {j2store}362|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Enterprise Integration
      • Parent Category Link: /enterprise-integration
      • IT is typically backlogged with tasks while the business waits to implement key solutions to remain competitive. In this competitive space, Cloud solutions offer attractive benefits to business stakeholders especially around agility and cost.
      • Moving to the Cloud involves more than outsourcing a component of the technology stack. Roles, processes, and authentication technologies need to be redefined to fit a distributed stack where parts of the IT solution space reside on-premise while the rest are in the Cloud.
      • Cloud integration means accepting loss of control in product development. A Cloud vendor will address the needs of most constituents and any high degree of customization which counteracts their business model. This makes integration a complex initiative involving two separate parties trying to align.

      Our Advice

      Critical Insight

      • Cloud integration is a fundamental commitment to change within the organization as it deeply impacts roles, processes, and technologies.
      • Be prepared to lose some degree of control of SLA management. IT will have to manage multiple Cloud SLAs and deliver a lowest common approach to the business. This may mean lowering the SLA standards previously set with on-premise solutions.
      • Cloud integration isn’t just about the technology. It is a dedication to establish solid relationships with the Cloud vendor. Understanding where the cloud solution is moving and what issues are being addressed are critical to creating an organizational road map for the future.

      Impact and Result

      • Develop a Cloud integration strategy by proactively understanding the impact of Cloud integration efforts to the organization.
      • Realize that Cloud integration will be an ongoing process of collaboration with the business, and that the initial implementation does not constitute an end.
      • Implement an integrated support structure that includes on-premise and cloud stacks.

      Gain Control of Cloud Integration Strategies Before they Float Away Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Understand the impacts of Cloud computing on Data, Application, Access, and Service Level Agreement integration

      Assess your current level of Cloud adoption and integration, focusing on solutions that are emerging in the market and the applicability to your IT environment.

      • Storyboard: Gain Control of Cloud Integration Strategies Before they Float Away
      • Cloud Integration Checklist
      • None
      [infographic]

      Build Your Data Practice and Platform

      • Buy Link or Shortcode: {j2store}347|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management

      The complex nature of data investment leads to de-scoping and delivery of data services that do not meet business needs or give value to the business. Subject matter experts are hired to resolve the problem, but their success is impacted by absent architecture, technology, and organizational alignment.

      Our Advice

      Critical Insight

      Walking through a book of architecture building plans with a personal guide is cheaper and faster than employing an architect to build and design your home.

      Impact and Result

      Info-Tech's approach provides a proven methodology that includes the following:

      • Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives.
      • Comprehensive data practice designed based on the required business and data capabilities.
      • Data platform design based on Info-Tech data architecture reference patterns and prioritized data initiatives and capabilities.

      Build Your Data Practice and Platform Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Build Your Data Practice and Platform Storyboard – A step-by-step document that leverages road-tested patterns and frameworks to properly build your data practice and pattern in continuous alignment with the business landscape.

      Info-Tech's approach provides a proven methodology that includes following:   

    • Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives.
    • Comprehensive data practices designed based on the required business and data capabilities.
      • Build Your Data Practice and Platform Storyboard

      2. Data Practice and Platform Models – Leveraging best-of-breed frameworks to help you build a clear, concise, and compelling data practice and platform.

      Data practice & platform pre-build pattern templates based on Info-Tech data reference patterns and data platform design best practices.

      • Data Practice and Platform Models

      Infographic

      Workshop: Build Your Data Practice and Platform

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Business Context and Value

      The Purpose

      Establish business context and value.

      Key Benefits Achieved

      Business context and strategic driver.

      Activities

      1.1 Understand/confirm the organization's strategic goals

      1.2 Classify the strategic goals and map to business drivers

      1.3 Identify the business capabilities that the strategy focuses on

      1.4 Identify the business processes realizing the strategy

      Outputs

      Business context and strategic drivers

      Prioritized business capabilities and processes

      Data culture survey results analysis

      2 Identify Your Top Initiatives

      The Purpose

      Identify your top initiatives.

      Key Benefits Achieved

      High-value business-aligned data initiative.

      Activities

      2.1 Highlight data-related outcomes/goals to realize to fulfill the business goal

      2.2 Map business data initiatives to the business strategic goals

      2.3 Prioritize data initiatives

      Outputs

      High-value, business-aligned data initiatives

      3 Analyze Data Challenges

      The Purpose

      Analyze data challenges.

      Key Benefits Achieved

      Clear understanding of the data challenges.

      Activities

      3.1 Map data challenges to Info-Tech data challenges

      3.2 Review Info-Tech data capabilities based on prioritized initiatives

      3.3 Discuss data platform and practice next steps

      Outputs

      List of data challenges preventing data maturation with the organization

      4 Map Data Capability

      The Purpose

      Map data capability.

      Key Benefits Achieved

      Prioritized data capability.

      Activities

      4.1 Map data challenges to Info-Tech data challenges

      4.2 Review Info-Tech data capabilities based on prioritized initiatives

      4.3 Discuss data platform and practice next steps

      Outputs

      Required data capabilities

      Data platform and practice – plan

      Initialized data management RACI 

      Further reading

      Build Your Data Practice and Platform

      Construct a scalable data foundation

      Analyst Perspective

      Build a data practice and platform that delivers value to your organization.

      The build or optimization of your data practice and data platform must be predicated on a thorough understanding of the organization’s goals, objectives, and priorities and the business capabilities and process they are meant to support and enable.

      Formalizing your practice or constructing your platform just for the sake of doing so often results in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.

      Leverage Info-Tech’s approach and incorporate our pre-built models and patterns to effectively navigate that crucial and often difficult phase upfront of comprehensively defining business data needs so you can ultimately realize faster time-to-delivery of your overall data practice and platform.

      Photo of Rajesh Parab, Director, Research & Advisory, Data & Analytics Practice, Info-Tech Research Group.

      Rajesh Parab
      Director, Research & Advisory, Data & Analytics Practice
      Info-Tech Research Group

      Photo of Crystal Singh, Director, Research & Advisory, Data & Analytics Practice, Info-Tech Research Group.

      Crystal Singh
      Director, Research & Advisory, Data & Analytics Practice
      Info-Tech Research Group

      Attempting to Solve Data Problems?

      Situation
      • Lack of data centric leadership results in downstream issues such as integration, quality, and accessibility.
      • The complex nature of the data and lack of understanding leads to de-scoping delivery of data services that does not meet business needs or add value.
      • Poorly designed practice and siloed platforms result in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.
      Complication
      • Data problem: When the data problem is diagnosed, the organization adopts a tactical approach.
      • Confirmation bias: Subject matter experts (SME) are hired to resolve the poorly defined problem, but the success of the SME is impacted by lack of architecture, technology, and organizational alignment.
      • Still no value: The selected tactical approach does not provide a solid foundation or solve your data problem.
      • Strategy for sake of strategy: Implementing a strategic approach for the sake of being strategic but this becomes overwhelming.
      • Fall back to tactical and operational: The data services are now potentially exposed and vulnerable, which strains business continuity and increases data debt.
      • Increased complexity and risk: Data silos, poor understanding, and high complexity results in an unmanageable data environment.
      Resolution
      • Requirements: Define and align your data requirement to business.
      • Capabilities: Discover data, identify data capabilities, and map your requirements.
      • Practices: Design and select fit-for-purpose data practices.
      • Platform: Optimize your data platform investments though sound architecture.

      Info-Tech Insight

      The true value of data comes from defining intentional relationships between the business and the data through a well thought out data platform and practice.

      Situation – Perpetual Data Problem

      Diagram of a head with gears around it and speech bubbles with notes titled 'Data Problem'. The surrounding gears, clockwise from bottom left, say 'Accessibility', 'Trust', 'Data Breach', 'Ambiguity', 'Ownership', 'Duplication', 'System Failure', and 'Manual Manipulation'. The speech bubbles notes, clockwise from bottom left, say 'Value-Add: How do I translate business needs to data capabilities?', 'Practice Organization: How do I organize resources and roles assignment challenges?', 'Platform: How do I organize data flows with no conceptual view of the environment?', and 'Break Down Silos: How do I break down silos?'
      I can’t access the data.
      I don’t trust the data in the report.
      It takes too long to get to the data for decision making
      • Lack of data-centric leadership results in downstream issues: integration, quality, accessibility
      • The organization’s data is too complex to manage without a cohesive plan.
      • The complex nature of the data and a lack of understanding leads to de-scoping delivery of data services that does not meet business needs or add value.
      • Poorly designed practice and siloed platforms result in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.

      Complication – Data Initiative Fizzles Out

      • Data problem: When the data problem is diagnosed the organization adopts a tactical approach.
      • Confirmation bias: Subject matter experts (SME) are hired to resolve the poorly defined problem, but the success of the SME is impacted by lack of architecture, technology, and organizational alignment.
      • Still no value: the selected tactical approach does not provide a solid foundation or solve your data problem.
      • Strategy for sake of strategy: Implementing a strategic approach for sake of being strategic but this becomes overwhelming.
      • Fall back to tactical and operational: The data services are now potentially exposed and vulnerable, which strains business continuity and increases data debt.
      • Increased complexity and risk: Data silos, poor understanding, and high complexity result in an unmanageable data environment.
      Flowchart beginning with 'Data Symptom Exhibited' and 'Data Problem Diagnosed', then splitting into two paths 'Solve Data Problem as a point solution' or 'Attempt Strategic approach without culture, capacity, and business leadership'. Each approach ends with 'Data too complex, and initiative fizzles out...' and cycles back to the beginning.
      Use the road-tested patterns and frameworks in our blueprint to break the perpetual data solution cycle. Focus on the value that a data and analytics platform will bring rather than focusing on the data problems alone.

      Build Your Data Practice and Platform

      Bring Your Data Strategy to Life

      Logo for Info-Tech.
      Logo for #iTRG.
      CONVENTIONAL WISDOM

      Attempting to Solve Your Data Problems

      DATA SYMPTOM EXHIBITED

      Mismatch report, data quality issue, or similar symptom of a data problem.

      DATA PROBLEM DIAGNOSED

      Data expert identifies it as a data problem.

      COMPLEX STRATEGIC APPROACH ATTEMPTED

      Recognized need to attempt it strategically, but don't have capacity or culture to execute.

      Cycle diagram titled 'Data Problems' with numbers connected to surrounding steps, and a break after Step 3 where one can 'BREAK THE CYCLE'. In the middle are a list of data problems: 'Accessibility’, ‘Data Breach', 'Manual Manipulation', 'System Failure', 'Ambiguity', 'Duplication', 'Ownership', and 'Trust'.
      SOLUTION FAILS

      The tactical solution fails to solve the root cause of the data problem, and the data symptoms persist.

      TACTICAL SOLUTION FALLBACK

      A quick and dirty solution is attempted in order to fix the data problem.

      THE COMPLEX APPROACH FIZZLES OUT

      Attempted strategic approach takes too long, fizzles out.

      BREAK THE CYCLE

      Solving Your Data Problems

      1. DEFINE YOUR DATA REQUIREMENTS Incorporate a Business to Data Approach by utilizing Info-Tech's business capability templates for identifying data needs. BUSINESS-ALIGNED DATA REQUIREMENTS
      2. CONDUCT YOUR DATA DISCOVERY Understand the data behind your business problem. Identify the required data capabilities and domains as required by your business processes. RECOMMENDED DATA CAPABILITIES
      3. DESIGN YOUR DATA PRACTICES Build your custom data practices based on the predefined reusable models. CUSTOMIZED DATA PRACTICE
      4. ARCHITECT YOUR DATA PLATFORM Build your custom data platform based on the redefined reusable architecture patterns. CUSTOMIZED DATA PLATFORM
      CONTINUOUS PHASE: ROADMAP, SPONSORSHIP FEEDBACK AND DELIVERY

      Develop a roadmap to establish the practice and implement the architecture as designed. Ensure continuous alignment of the practice and architecture with the business landscape.

      Phase-by-Phase Approach to Build Your Data Practice and Platform

      Flowchart detailing the path to take through the four phases of this blueprint beginning with the 'Inputs' and 'People' involved and incorporating 'Deliverables' along the way. Phase-by-Phase Approach
      • Phase 1: Step 1 – Define Your Data Requirement
      • Phase 1: Step 2 – Conduct Your Data Discovery
      • Phase 2 – Design Your Data Practice
      • Phase 3 – Architect Your Data Platform

      Measure value when building your data practice and platform

      Sample Data Management Metrics

      Lists of data management metrics in different categories.

      • Refine the metrics for the overall Data Management practice and every initiative therein.
      • Refine the metrics at each platform and practice component to show business value against implementation effort.

      Understand and Build Data Culture

      See your Info-Tech Account Representative for more details on our Data Culture Diagnostic

      Only 14.29% of Transportation and Logistics respondents agree BI and Analytics Process and Technology are sufficient What is a diagnostic?

      Our diagnostics are the simplest way to collect the data you need, turn it into actionable insights, and communicate with stakeholders across the organization.

      52.54% of respondents from the healthcare industry are unaware of their organization’s data security policy
      Ask the Right Questions

      Use our low-effort surveys to get the data you need from stakeholders across the organization.

      Use Our Diagnostic Engine

      Our diagnostic engine does all the heavy lifting and analysis, turning your data into usable information.

      Communicate & Take Action

      Wow your executives with the incredible insights you've uncovered. Then, get to action: make IT better.

      On average only 40% agree that they have the reporting when needed


      (Source: Info-Tech’s Data Culture Diagnostic, 53 Organizations, 3138 Responses)

      35% of respondents feel that a governance body is in place looking at strategic data

      Build a Data-Driven Strategy Using Info-Tech Diagnostic Programs

      Make informed IT decisions by starting your diagnostic program today. Your account manager is waiting to help you.
      Sample of Info-Tech's 'Data Culture Scorecard'.

      Use Our Predefined Data and Analytics Patterns to Build Your DnA Landscape

      Walking through a book of architecture building plans with a personal guide is cheaper and faster than employing an architect to build and design your home

      Two books titled 'The Everything Homebuilding Book' and 'Architecture 101'. An open book with a finger pointing to a diagram.

      The first step is to align business strategy with data strategy and then start building your data practice and data platform

      Flowchart starting with business strategy focuses, then to data strategy focuses, and eventually to 'Data Metrics'.

      Insights

      The true value of data comes from defining intentional relationships between the business and the data through a well-thought-out data platform and practice.

      • Phase 1
        • Some organizations are low maturity so using the traditional Capability Maturity Model Integration (CMMI) would not make sense. A great alternative is to leverage existing models and methodologies to get going off the bat.
        • The Data Strategy is an input into the platform and practice. This is considered the Why; Data Practice and Platform is the How.
      • Phase 2
        • Info-Tech’s approach is business-goal driven and it leverages patterns, which enable the implementation of critical and foundational components and subsequently facilitates the evolution and development of the practice over time.
        • Systems should not be designed in isolation. Cross-functional collaboration throughout the design is critical to ensure all types of issues are revealed early. Otherwise, crucial tests are omitted, deployments fail, and end-users are dissatisfied.
      • Phase 3
        • Build your conceptual data architecture based on well-thought-out formulated patterns that align with your organization’s needs and environment.
        • Functional needs often take precedence over quality architecture. Quality must be baked into design, execution, and decision-making practices to ensure the right trade-offs are made.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Info-Tech’s Methodology for Building Your Data Practice and Platform

      Phase 1 –
      Define Your Data Requirements and Conduct Your Data Discovery
      Phase 2 –
      Design Your Data Practices
      Phase 3 –
      Architect Your Data Platform
      Phase Steps
      1. Identify your top initiatives
      2. Map your data initiatives to data capabilities
      1. Understand the practices value statement
      2. Review the Info-Tech practice pattern
      3. Initiate your practice design and setup
      1. Identify your data component
      2. Refine your data platform architecture
      3. Design your data platform
      4. Identify your new components and capabilities
      5. Initiative platform build and rollout
      Phase Outcomes Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives Comprehensive data practice design based on the required business and data capabilities Data platform design based on Info-Tech data architecture reference pattern and prioritized data initiatives and capabilities

      Data Platform and Practice Implementation Plan

      Example timeline for data platform and practice implementation plan with 'Fiscal Years' across the top, and below they're broken down into quarters. Along the left side 'Phase 1: Step 1...', 'Phase 1: Step 2...', 'Phase 2...' and 'Phase 3'. Tasks are mapped onto the timeline in each phase with a short explanation.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Info-Tech’s Workshop support for Build Your Data Practice and Platform. 'Build Your Data Practice and Platform' slide from earlier.
      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Workshop 1

      Data Needs and Discovery

      Workshop 2

      Data Practice Design

      Workshop 3

      Data Platform Design

      Workshop 1:
      Data Needs and Discovery

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Day 1 Day 2 Day 3 Day 4
      Establish Business Context and Value
      Identify Your Top Initiatives
      Analyze Data Challenges
      Map Data Capability
      Activities

      1.1 Understand/confirm your organization’s strategic goals

      1.2 Classify the strategic goals and map to business drivers

      1.3 Identify the business capabilities that the strategy focus is on

      1.4 Identify the business processes realizing the strategy

      2.1 Highlight data-related outcomes /goals to realize to fulfill the business goal

      2.2 Map business data initiatives to the business strategic goals

      2.3 Prioritize Data initiatives

      3.1 Understand data management capabilities and framework

      3.2 Classify business data requirements using Info-Tech’s classification approach

      3.3 Highlight data challenges in your current environment

      4.1 Map data challenges to Info-Tech data challenges

      4.2 Review Info-Tech data capabilities based on prioritized initiative

      4.3 Discuss Data Platform and Practice Next Steps

      Deliverables
      • Business context and strategic drivers
      • Prioritized business capabilities and processes
      • Data Culture Survey results analysis
      • High-value business-aligned data initiative
      • List of data challenges preventing data maturation with the organization
      • Required data capabilities
      • Data platform and practice – plan
      • Initialized data management RACI
      Participants Business stakeholder, Business leader Business Subject Matter Expert, Data IT sponsor (CIO), Head of Data, Data Architect Business stakeholder, Business leader Business Subject Matter Expert, Data IT sponsor (CIO), Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect

      Workshop 2:
      Data Practice Design

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Day 1 Day 2 Day 3 Day 4
      Plan Your Data Practices
      Design Your Data Practices 1
      Design Your Data Practices 2
      Design Your Data Practices 3
      Activities

      Prerequisite: Business context, business data requirement, and data capabilities

      1.1 Understand data practice framework

      1.2 Define your practice implementation approach

      1.3 Review and update data management RACI

      2.1 Understand Info-Tech data practice patterns for each prioritized practice

      2.2 Define your practice setup for each prioritized practice

      2.3 Highlight critical processes for each practice

      3.1 Understand Info-Tech data practice patterns for each prioritized practice

      3.2 Define your practice setup for each prioritized practice

      3.3 Highlight critical processes for each practice

      4.1 Understand Info-Tech data practice patterns for each prioritized practice

      4.2 Define your practice setup for each prioritized practice

      4.3 Highlight critical processes for each practice

      4.4 Discuss data platform and practice next steps

      Deliverables
      • Data practice implementation approach
      • Data management RACI
      • Data practice setup pattern for your organization
      • Data practice process pattern for your organization
      • Data practice setup pattern for your organization
      • Data practice process pattern for your organization
      • Data practice setup pattern for your organization
      • Data practice process pattern for your organization
      • Data platform and practice – plan
      Participants Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect

      Workshop 3:
      Data Platform Design

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Day 1Day 2Day 3Day 4
      Data Platform Overview
      Update Data Platform Reference Architecture
      Design Your Data Platform
      Design Your Data Practices 4
      Activities

      Prerequisite: Business context, business data requirement, and data capabilities

      1.1 Understand data platform framework and data capabilities

      1.2 Understand key data architecture principles and best practices

      1.3 Shortlist data platform patterns

      2.1 Map and identify data capabilities to data platform components

      2.2 Build data platform architecture using Info-Tech data platform reference architecture

      2.3 Highlight critical processes for each practice

      3.1 Design your target data platform using Info-Tech’s data platform template

      3.2 Identify new capabilities and components in your platform design

      4.1 Identify new capabilities and component in your platform design

      4.2 Discuss data platform initiatives

      Deliverables
      • Shortlisted data platform patterns
      • Data platform reference architecture for your organization
      • Data platform design for your organization
      • Data platform plan
      ParticipantsData experts, Business Subject Matter Expert, Head of Data, Data ArchitectData experts, Business Subject Matter Expert, Head of Data, Data ArchitectData experts, Business Subject Matter Expert, Head of Data, Data ArchitectData experts, Business Subject Matter Expert, Head of Data, Data Architect

      Build Your Data Practice and Platform

      Phase 1

      Phase 1: Step 1 – Define Your Data Requirements
      Phase 1: Step 2 – Conduct Your Data Discovery

      Phase 1

      1.1 Define Your Data Requirements
      1.2 Conduct Your Data Discovery

      Phase 2 Phase 3

      Phase 1: Step 1 – Define Your Data Requirements will walk you through the following activities:

      • Confirm the organizational strategic goals, business drivers, business capabilities, and processes driving the Data Practice and Platform effort.
      • Identify the data related outcomes, goals, and ideal environment needed to fulfill the business goals.

      This phase involves the following participants:

      A blend of business leaders and business SMEs together with the Data Strategy team.

      Phase 1: Step 2 – Conduct Your Data Discovery will walk you through the following activities:

      • Identify and highlight the data challenges faced in achieving the desired outcome.
      • Map the data challenges to the data capabilities required to realize the desired data outcome.

      This phase involves the following participants:

      Key personnel from IT/Data team: (Data Architect, Data Engineers, Head of Head of Reporting and Analytics)

      Prepare for the Upgrade to Windows 11

      • Buy Link or Shortcode: {j2store}166|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: End-User Computing Devices
      • Parent Category Link: /end-user-computing-devices
      • Windows 10 is going EOL in 2025.That is closer than you think.
      • Many of your endpoints are not eligible for the Windows 11 upgrade. You can’t afford to replace all your endpoints this year. How do you manage this Microsoft initiated catastrophe?
      • You want to stay close to the leading edge of technology and services, but how do you do that while keeping your spending in check and within budget?

      Our Advice

      Critical Insight

      Windows 11 is a step forward in security, which is one of the primary reasons for the release of the new operating system. Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

      Impact and Result

      Windows 11 hardware requirements will result in devices that are not eligible for the upgrade. Companies will be left to spend money on replacement devices. Following the Info-Tech guidance will help clients properly budget for hardware replacements before Windows 10 is no longer supported by Microsoft. Eligible devices can be upgraded, but Info-Tech guidance can help clients properly plan the upgrade using the upgrade ring approach.

      Prepare for the Upgrade to Windows 11 Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Prepare for the Upgrade to Windows 11 Deck – A look into some of the pros and cons of Microsoft’s latest desktop operating system, along with guidance on moving forward with this inevitable upgrade.

      Discover the reason for the release of Windows 11, what you require to be eligible for the upgrade, what features were added or updated, and what features were removed. Our guidance will assist you with a planned and controlled rollout of the Windows 11 upgrade. We also provide guidance on how to approach a device refresh plan if some devices are not eligible for Windows 11. The upgrade is inevitable, but you have time, and you have options.

      • Prepare for the Upgrade to Windows 11 Storyboard

      2. What Are My Options If My Devices Cannot Upgrade to Windows 11? – Build a Windows 11 Device Replacement budget with our Hardware Asset Management Budgeting Tool.

      This tool will help you budget for a hardware asset refresh and to adjust the budget as necessary to accommodate any unexpected changes. The tool can easily be modified to assist in developing and justifying the budget for hardware assets for a Windows 11 project. Follow the instructions on each tab and feel free to play with the HAM budgeting tool to fit your needs.

      • HAM Budgeting Tool
      [infographic]

      Further reading

      Prepare for the Upgrade to Windows 11

      The upgrade is inevitable, but you have time, and you have options.

      Analyst Perspective

      Upgrading to Windows 11 is easy, and while it should be properly investigated and planned, it should absolutely be an activity you undertake.

      “You hear that Mr. Anderson? That is the sound of inevitability.” ("The Matrix Quotes" )

      The fictitious Agent Smith uttered those words to Keanu Reeves’ character, Neo, in The Matrix in 1999, and while Agent Smith was using them in a very sinister and figurative context, the words could just as easily be applied to the concept of upgrading to the Windows 11 operating system from Microsoft in 2022.

      There have been two common, recurring themes in the media since late 2019. One is the global pandemic and the other is cyber-related crime. Microsoft is not in a position to make an impact on a novel coronavirus, but it does have the global market reach to influence end-user technology and it appears that it has done just that. Windows 11 is a step forward in endpoint security and functionality. It also solidifies the foundation for future innovations in end-user operating systems and how they are delivered. Windows-as-a-Service (WAAS) is the way forward for Microsoft. Windows 10 is living on borrowed time, with a defined end of support date of October 14, 2025. Upgrading to Windows 11 is easy, and while it should be properly investigated and planned, it should absolutely be an activity you undertake.

      It is inevitable!

      P.J. Ryan

      Research Director, Infrastructure & Operations

      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Windows 10 is going EOL in 2025. That is closer than you think.
      • Many of your endpoints are not eligible for the Windows 11 upgrade. You can’t afford to replace all your endpoints this year. How do you manage this Microsoft-initiated catastrophe?
      • You want to stay close to the leading edge of technology and services, but how do you do that while keeping your spending in check and within budget?

      Common Obstacles

      • The difference between Windows 10 and Windows 11 is not clear. Windows 11 looks like Windows 10 with some minor changes, mostly cosmetic. Many online users don’t see the need. Why upgrade? What are the benefits?
      • The cost of upgrading devices just to be eligible for Windows 11 is high.
      • Your end users don’t like change. This is not going to go over well!

      Info-Tech's Approach

      • Spend wisely. Space out your endpoint replacements and upgrades over several years. You do not have to upgrade everything right away.
      • Be patient. Windows 11 contained some bugs when it was initially released. Microsoft fixed most of the issues through monthly quality updates, but you should ensure that you are comfortable with the current level of functionality before you upgrade.
      • Use the upgrade ring approach. Test your applications with a small group first, and then stage the rollout to increasingly larger groups over time.

      Info-Tech Insight

      There is a lot of talk about Windows 11, but this is only an operating system upgrade, and it is not a major one. Understand what is new, what is added, and what is missing. Check your devices to determine how many are eligible and ineligible. Many organizations will have to spend capital on endpoint upgrades. Solid asset management practices will help.

      Insight summary

      Windows 11 is a step forward in security, which is one of the primary reasons for the release of the new operating system.

      Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

      The hardware requirements for Windows 11 enable security features such as password-less logon, disk encryption, increased startup protection with secure boot, and virtualization-based security.

      Many organizations will have to spend capital on endpoint upgrades.

      Microsoft now insists that modern hardware is required for Windows 11 for not only security but also for improved stability. That same hardware requirement will mean that many devices that are only three or four years old (as well as older ones) may not be eligible for Windows 11.

      Windows 11 is a virtualization challenge for some providers.

      The hardware requirements for physical devices are also required for virtual devices. The TPM module appears to be the biggest challenge. Oracle VirtualBox and Citrix Hypervisor as well as AWS and Google are unable to support Windows 11 virtual devices as of the time of writing.

      Windows 10 will be supported by Microsoft until October 2025.

      That will remove some of the pressure felt due to the ineligibility of many devices and the need to refresh them. Take your time and plan it out, keeping within budget constraints. Use the upgrade ring approach for systems that are eligible for the Windows 11 upgrade.

      New look and feel, and a center screen taskbar.

      Corners are rounded, some controls look a little different, but overall Windows 11 is not a dramatic shift from Windows 10. It is easier to navigate and find features. Oh, and yes, the taskbar (and start button) is shifted to the center of the screen, but you can move them back to the left if desired.

      The education industry gets extra attention with the release of Windows 11.

      Windows 11 comes with multiple subscription-based education offerings, but it also now includes a new lightweight SE edition that is intended for the K-8 age group. Microsoft also released a Windows 11 Education SE specific laptop, at a very attractive price point. Other manufacturers also offer Windows 11 SE focused devices.

      Why Windows 11?

      Windows 10 was supposed to be the final desktop OS from Microsoft, wasn’t it?

      Maybe. It depends who you ask.

      Jerry Nixon, a Microsoft developer evangelist, gained notoriety when he uttered these words while at a Microsoft presentation as part of Microsoft Ignite in 2015: “Right now we’re releasing Windows 10, and because Windows 10 is the last version of Windows, we’re all still working on Windows 10,” (Hachman). Microsoft never officially made that statement. Interestingly enough, it never denied the comments made by Jerry Nixon either.

      Perhaps Microsoft released a new operating system as a financial grab, a way to make significant revenue?

      Nope.

      Windows 11 is a free upgrade or is included with any new computer purchase.

      Market share challenges?

      Doubtful.

      It’s true that Microsoft's market share of desktop operating systems is dropping while Apple OS X and Google Chrome OS are rising.

      In fact, Microsoft has relinquished over 13% of the market share since 2012 and Apple has almost doubled its market share. BUT:

      Microsoft is still holding 75.12% of the market while Apple is in the number 2 spot with 14.93% (gs.statcounter.com).

      The market share is worth noting for Microsoft but it hardly warrants a new operating system.

      New look and feel?

      Unlikely

      New start button and taskbar orientation, new search window, rounded corners, new visual look on some controls like the volume bar, new startup sound, new Windows logo, – all minor changes. Updates could achieve the same result.

      Security?

      Likely the main reason.

      Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

      The hardware requirements for Windows 11 enable security features such as password-less logon, disk encryption, increased startup protection with secure boot, and virtualization-based security.

      The features are available on all Windows 11 physical devices, due to the common hardware requirements.

      Windows 11 hardware-based security

      These hardware options and features were available in Windows 10 but not enforced. With Windows 11, they are no longer optional. Below is a description and explanation of the main features.

      Feature What it is How it works
      TPM 2.0 (Trusted Platform Module) Chip TPM is a chip on the motherboard of the computer. It is used to store encryption keys, certificates, and passwords. TPM does this securely with tamper-proof prevention. It can also generate encryption keys and it includes its own unique encryption key that cannot be altered (helpdeskgeek.com). You do not need to enter your password once you setup Windows Hello, so the password is no longer easy to capture and steal. It is set up on a device per device basis, meaning if you go to a different device to sign in, your Windows Hello authentication will not follow you and you must set up your Hello pin or facial recognition again on that particular device. TPM (Trusted Platform Module) can store the credentials used by Windows Hello and encrypt them on the module.
      Windows Hello Windows Hello is an alternative to using a password for authentication. Users can use a pin, a fingerprint, or facial recognition to authenticate.
      Device Encryption Device encryption is only on when your device is off. It scrambles the data on your disk to make it unreadable unless you have the key to unscramble it. If your endpoint is stolen, the contents of the hard drive will remain encrypted and cannot be accessed by anyone unless they can properly authenticate on the device and allow the system to unscramble the encrypted data.
      UEFI Secure Boot Capable UEFI is an acronym for Unified Extensible Firmware Interface. It is an interface between the operating system and the computer firmware. Secure Boot, as part of the firmware interface, ensures that only unchangeable and approved software and drivers are loaded at startup and not any malware that may have infiltrated the system (Lumunge). UEFI, with Secure Boot, references a database containing keys and signatures of drivers and runtime code that is approved as well as forbidden. It will not let the system boot up unless the signature of the driver or run-time code that is trying to execute is approved. This UEFI Secure boot recognition process continues until control is handed over to the operating system.
      Virtualization Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) VBS is security based on virtualization capabilities. It uses the virtualization features of the Windows operating system, specifically the Hyper-V hypervisor, to create and isolate a small chunk of memory that is isolated from the operating system. HVCI checks the integrity of code for violations. The Code Integrity check happens in the isolated virtual area of memory protected by the hypervisor, hence the acronym HVCI (Hypervisor Protected Code Integrity) (Murtaza). In the secure, isolated region of memory created by VBS with the hypervisor, Windows will run checks on the integrity of the code that runs various processes. The isolation protects the stored item from tampering by malware and similar threats. If they run incident free, they are released to the operating system and can run in the standard memory space. If issues are detected, the code will not be released, nor will it run in the standard memory space of the operating system, and damage or compromise will be prevented.

      How do all the hardware-based security features work?

      This scenario explains how a standard boot up and login should happen.

      You turn on your computer. Secure Boot authorizes the processes and UEFI hands over control to the operating system. Windows Hello works with TPM and uses a pin to authenticate the user and the operating systems gives you access to the Windows environment.

      Now imagine the same process with various compromised scenarios.

      You turn on your computer. Secure Boot does not recognize the signature presented to it by the second process in the boot sequence. You will be presented with a “Secure Boot Violation” message and an option to reboot. Your computer remains protected.

      You boot up and get past the secure boot process and UEFI passes control over to the Windows 11 operating system. Windows Hello asks for your pin, but you cannot remember the pin and incorrectly enter it three times before admitting temporary defeat. Windows Hello did not find a matching pin on the TPM and will not let you proceed. You cannot log in but in the eyes of the operating system, it has prevented an unauthorized login attempt.

      You power up your computer, log in without issue, and go about your morning routine of checking email, etc. You are not aware that malware has infiltrated your system and modified a page in system memory to run code and access the operating system kernel. VBS and HVCI check the integrity of that code and detect that it is malicious. The code remains isolated and prevented from running, protecting your system.

      TPM, Hello, UEFI with Secure Boot, VBS and HVCI all work together like a well-oiled machine.

      “Microsoft's rationale for Windows 11's strict official support requirements – including Secure Boot, a TPM 2.0 module, and virtualization support – has always been centered on security rather than raw performance.” – Andrew Cunningham, arstechnica.com

      “Windows 11 raises the bar for security by requiring hardware that can enable protections like Windows Hello, Device Encryption, virtualization-based security (VBS), hypervisor-protected code integrity (HVCI), and Secure Boot. These features in combination have been shown to reduce malware by 60% on tested devices.” – Steven J. Vaughan-Nichols, Computerworld

      Can any device upgrade to Windows 11?

      In addition to the security-related hardware requirements listed previously, which may exclude some devices from Windows 11 eligibility, Windows 11 also has a minimum requirement for other hardware components.

      Windows 7 and Windows 10 were publicized as being backward compatible and almost any hardware would be able to run those operating systems. That changed with Windows 11. Microsoft now insists that modern hardware is required for Windows 11 for not only security but also improved stability.

      Software Requirement

      You must be running Windows 10 version 2004 or greater to be eligible for a Windows 11 upgrade (“Windows 11 Requirements”).

      Complete hardware requirements for Windows 11

      • 1 GHz (or faster) compatible 64-bit processor with two or more cores
      • 4 GB RAM
      • 64 GB or more of storage space
      • Compatible with DirectX 12 or later with WDDM 2.0 driver
        • DirectX connects the hardware in your computer with Windows. It allows software to display graphics using the video card or play audio, as long as that software is DirectX compatible. Windows 11 requires version 12 (“What are DirectX 12 compatible graphics”).
        • WDDM is an acronym for Windows Display Driver Model. WDDM is the architecture for the graphics driver for Windows (“Windows Display Driver Model”).
        • Version 2.0 of WDDM is required for Windows 11.
      • 720p display greater than 9" diagonally with 8 bits per color channel
      • UEFI Secure Boot capable
      • TPM 2.0 chip
      • (“Windows 11 Requirements”)

      Windows 11 may challenge your virtual environment

      When Windows 11 was initially released, some IT administrators experienced issues when trying to install or upgrade to Windows 11 in the virtual world.

      The Challenge

      The issues appeared to be centered around the Windows 11 hardware requirements, which must be detected by the Windows 11 pre-install check before the operating system will install.

      The TPM 2.0 chip requirement was indeed a challenge and not offered as a configuration option with Citrix Hypervisor, the free VMware Workstation Player or Oracle VM VirtualBox when Windows 11 was released in October 2021, although it is on the roadmap for Oracle and Citrix Hypervisor. VMware provides alternative products to the free Workstation Player that do support a virtual TPM. Oracle and Citrix reported that the feature would be available in the future and Windows 11 would work on their platforms.

      Short-Term Solutions

      VMware and Microsoft users can add a vTPM hardware type when configuring a virtual Windows 11 machine. Microsoft Azure does offer Windows 11 as an option as a virtual desktop. Citrix Desktop-As-A-Service (DAAS) will connect to Azure, AWS, or Google Cloud and is only limited by the features of the hosting cloud service provider.

      Additional Insight

      According to Microsoft, any VM running Windows 11 must meet the following requirements (“Virtual Machine Support”):

      • It must be a generation 2 VM, and upgrading a generation 1 VM to Windows 11 (in-place) is not possible
      • 64 GB of storage or greater
      • Secure Boot capable with the virtual TPM enabled
      • 4 GB of memory or greater
      • 2 or more virtual processors
      • The CPU of the physical computer that is hosting the VM must meet the Windows 11 (“Windows Processor Requirements”)

      What’s new or updated in Windows 11?

      The following two slides highlight some of the new and updated features in Windows 11.

      Security

      The most important change with Windows 11 is what you cannot see – the security. Windows 11 adds requirements and controls to make the user and device more secure, as described in previous slides.

      Taskbar

      The most prominent change in relation to the look and feel of Windows 11 is the shifting of the taskbar (and Start button) to the center of the screen. Some users may find this more convenient but if you do not and prefer the taskbar and start button back on the left of your screen, you can change it in taskbar settings.

      Updated Apps

      Paint, Photos, Notepad, Media Player, Mail, and other standard Windows apps have been updated with a new look and in some cases minor enhancements.

      User Interface

      The first change users will notice after logging in to Windows 11 is the new user interface – the look and feel. You may not notice the additional colors added to the Windows palette, but you may have thought that the startup sound was different, and the logo also looks different. You would be correct. Other look-and-feel items that changed include the rounded corners on windows, slightly different icons, new wallpapers, and controls for volume and brightness are now a slide bar. File explorer and the settings app also have a new look.

      Microsoft Teams

      Microsoft Teams is now installed on the taskbar by default. Note that this is for a personal Microsoft account only. Teams for Work or School will have to be installed separately if you are using a work or school account.

      What’s new or updated in Windows 11?

      Snap Layouts

      Snap layouts have been enhanced and snap group functionality has been added. This will allow you to quickly snap one window to the side of the screen and open other Windows in the other side. This feature can be accessed by dragging the window you wish to snap to the left or right edge of the screen. The window should then automatically resize to occupy that half of the screen and allow you to select other Windows that are already open to occupy the remaining space on the screen. You can also hover your mouse over the maximize button in the upper right-hand corner of the window. A small screen with multiple snap layouts will appear for your selection. Multiple snapped Windows can be saved as a “Snap Group” that will open together if one of the group windows are snapped in the future.

      Widgets

      Widgets are expanding. Microsoft started the re-introduction of widgets in Windows 10, specifically focusing on the weather. Widgets now include other services such as news, sports, stock prices, and others.

      Android Apps

      Android apps can now run in Windows 11. You will have to use the Amazon store to access and install Android apps, but if it is available in the Amazon store, you can install it on Windows 11.

      Docking

      Docking has improved with Windows 11. Windows knows when you are docked and will minimize apps when you undock so they are not lost. They will appear automatically when you dock again.

      This is not intended to be an inclusive list but does cover some of the more prominent features.

      What’s missing from Windows 11?

      The following features are no longer found in Windows 11:

      • Backward compatibility
        • The introduction of the hardware requirements for Windows 11 removed the backward compatibility (from a hardware perspective) that made the transition from previous versions of Windows to their successor less of a hardware concern. If a computer could run Windows 7, then it could also run Windows 10. That does not automatically mean it can also run Windows 11.
      • Internet Explorer
        • Internet Explorer is no longer installed by default in Windows 11. Microsoft Edge is now the default browser for Windows. Other browsers can also be installed if preferred.
      • Tablet mode
        • Windows 11 does not have a "tablet" mode, but the operating system will maximize the active window and add more space between icons to make selecting them easier if the 2-in-1 hardware detects that you wish to use the device as a tablet (keyboard detached or device opened up beyond 180 degrees, etc.).
      • Semi-annual updates
        • It may take six months or more to realize that semi-annual feature updates are missing. Microsoft moved to an annual feature update schema but continued with monthly quality updates with Windows 11.
      • Specific apps
        • Several applications have been removed (but can be manually added from the Microsoft Store by the user). They include:
          • OneNote for Windows 10
          • 3D Viewer
          • Paint 3D
          • Skype
      • Cortana (by default)
        • Cortana is missing from Windows 11. It is installed but not enabled by default. Users can turn it on if desired.

      Microsoft included a complete list of features that have been removed or deprecated with Windows 11, which can be found here Windows 11 Specs and System Requirements.

      Windows 11 editions

      • Windows 11 is offered in several editions:
        • Windows 11 Home
        • Windows 11 Pro
        • Windows 11 Pro for Workstations
        • Windows 11 Enterprise Windows 11 for Education
        • Windows 11 SE for Education
      • Windows 11 hardware requirements and security features are common throughout all editions.
      • The new look and feel along with all the features mentioned previously are common to all editions as well.
      • Windows Home
        • Standard offering for home users
      • Pro versus Pro for Workstations
        • Windows 11 Pro and Pro for Workstations are both well suited for the business environment with available features such as support for Active Directory or Azure Active Directory, Windows Autopilot, OneDrive for Business, etc.
        • Windows Pro for Workstations is designed for increased demands on the hardware with the higher memory limits (2 TB vs. 6 TB) and processor count (2 CPU vs. 4 CPU).
        • Windows Pro for Workstations also features Resilient File System, Persistent Memory, and SMB Direct. Neither of these features are available in the Windows 11 Pro edition.
        • Windows 11 Pro and Pro for Workstations are both very business focused, although Pro may also be a common choice for non-business users (Home and Education).
      • Enterprise Offerings
        • Enterprise licenses are subscription based and are part of the Microsoft 365 suite of offerings.
        • Windows 11 Enterprise is Windows 11 Pro with some additional addons and functionality in areas such as device management, collaboration, and security services.
        • The level of the Microsoft 365 Enterprise subscription (E3 or E5) would dictate the additional features and functionality, such as the complete Microsoft Defender for Endpoint suite or the Microsoft phone system and Audio Conferencing, which are only available with the E5 subscription.

      Windows 11 Education Editions

      With the release of a laptop targeted specifically at the education market, Microsoft must be taking notice of the Google Chrome educational market penetration, especially with headlines like these.

      “40 Million Chromebooks in Use in Education” (Thurrott)

      “The Unprecedented Growth of the Chromebook Education Market Share” (Carklin)

      “Chromebooks Gain Market Share as Education Goes Online” (Hruska)

      “Chromebooks Gain Share of Education Market Despite Shortages” (Mandaro)

      “Chromebook sales skyrocketed in Q3 2020 with online education fueling demand” (Duke)

      • Education licenses are subscription based and are part of the Microsoft 365 suite of offerings. Educational pricing is one benefit of the Microsoft 365 Education model.
      • Windows 11 Education is Windows 11 Pro with some additional addons and functionality similar to the Enterprise offerings for Windows 11 in areas such as device management, collaboration, and security services. Windows 11 Education also adds some education specific settings such as Classroom Tools, which allow institutions to add new students and their devices to their own environment with fewer issues, and includes OneNote Class Notebook, Set Up School PCs app, and Take a Test app.
      • The level of the Microsoft 365 Education subscription (A3 or A5) would dictate the additional features and functionality, such as the complete Microsoft Defender for Endpoint suite or the Microsoft phone system and Audio Conferencing, which are only available with the A5 subscription.
      • Windows 11 SE for Education:
        • A cloud-first edition of Windows 11 specifically designed for the K-8 education market.
        • Windows 11 SE is a light version of Windows 11 that is designed to run on entry-level devices with better performance and security on that hardware.
        • Windows 11 SE requires Intune for Education and only IT admins can install applications.
      • Microsoft and others have come out with Windows SE specific devices at a low price point.
        • The Microsoft Surface Laptop SE comes pre-loaded with Windows 11 SE and can be purchased for US$249.00.
        • Dell, Asus, Acer, Lenovo, and others also offer Windows 11 SE specific devices (“Devices for Education”).

      Initial Reactions

      Below you can find some actual initial reactions to Windows 11.

      Initial reactions are mixed, as is to be expected with any new release of an operating system. The look and feel is new, but it is not a huge departure from the Windows 10 look and feel. Some new features are well received such as the snap feature.

      The shift of the taskbar (and start button) is the most popular topic of discussion online when it comes to Windows 11 reactions. Some love it and some do not. The best part about the shift of the taskbar is that you can adjust it in settings and move it back to its original location.

      The best thing about reactions is that they garner attention, and thanks in part to all the online reactions and comments, Microsoft is continually improving Windows 11 through quality updates and annual feature releases.

      “My 91-year-old Mum has found it easy!” Binns, Paul ITRG

      “It mostly looks quite nice and runs well.” Jmbpiano, Reddit user

      “It makes me feel more like a Mac user.” Chang, Ben Info-Tech

      “At its core, Windows 11 appears to be just Windows 10 with a fresh coat of paint splashed all over it.” Rouse, Rick RicksDailyTips.com

      “Love that I can snap between different page orientations.” Roberts, Jeremy Info-Tech

      “I finally feel like Microsoft is back on track again.” Jawed, Usama Neowin

      “A few of the things that seemed like issues at first have either turned out not to be or have been fixed with patches.” Jmbpiano, Reddit user

      “The new interface is genuinely intuitive, well-designed, and colorful.” House, Brett AnandTech

      “No issues. Have it out on about 50 stations.” Sandrews1313, Reddit User

      “The most striking change is to the Start menu.” Grabham, Dan pocket-lint.com

      How do I upgrade to Windows 11?

      The process is very similar to applying updates in Windows 10.

      • Windows 11 is offered as an upgrade through the standard Windows 10 update procedure. Windows Update will notify you when the Windows 11 upgrade is ready (assuming your device is eligible for Windows 11).
        • Allow the update (upgrade in this case) to proceed, reboot, and your endpoint will come back to life with Windows 11 installed and ready for you.
      • A fresh install can be delivered by downloading the required Windows 11 installation media from the Microsoft Software Download site for Windows 11.
      • Business users can control the timing and schedule of the Windows 11 rollout to corporate endpoints using Microsoft solutions such as WSUS, Configuration Manager, Intune and Endpoint Manager, or by using other endpoint management solutions.
      • WSUS and Configuration Manager will have to sync the product category for Windows 11 to manage the deployment.
      • Windows Update for Business policies will have to use the target version capability rather than using the feature update referrals alone.
      • Organizations using Intune and a Microsoft 365 E3 license will be able to use the Feature Update Deployments page to select Windows 11.
      • Other modern endpoint management solutions may also allow for a controlled deployment.

      Info-Tech Insight

      The upgrade itself may be a simple process but be prepared for the end-user reactions that will follow. Some will love it but others will despise it. It is not an optional upgrade in the long run, so everyone will have to learn to accept it.

      When can I upgrade to Windows 11?

      You can upgrade right now BUT there is no need to rush. Windows 11 was released in October 2021 but that doesn’t mean you have to upgrade everyone right away. Plan this out.

      • Build deployment rings into your Windows 11 upgrade approach: This approach, also referred to as Canary Releases or deployment rings, allows you to ensure that IT can support users if there's a major problem with the upgrade. Instead of disrupting all end users, you are only disrupting a portion of end users.
        • Deploy the initial update to your test environment.
        • After testing is successful or changes have been made, deploy Windows 11 to your pilot group of users.
        • After the pilot group gives you the thumbs up, deploy to the rest of production in phases. Phases are sometimes by office/location, sometimes by department, sometimes by persona (i.e. defer people that don't handle updates well), and usually by a combination of these factors.
        • Increase the size of each ring as you progress.
      • Always back up your data before any upgrade.

      Deployment Ring Example

      Pilot Ring - Individuals from all departments - 10 users

      Ring #1 - Dev, Finance - 20 Users

      Ring #2 - Research - 100 Users

      Ring #3 - Sales, IT, Marketing - 500 Users

      Upgrade your eligible devices and users to Windows 11

      Build Windows 11 Deployment Rings

      Instructions:

      1. Identify who will be in the pilot group. Use individuals instead of user groups.
      2. Identify how many standard rings you need. This number will be based on the total number of employees per office.
      3. Map groups to rings. Define which user groups will be in each ring.
      4. Allow some time to elapse between upgrades. Allow the first group to work with Windows 11 and identify any potential issues that may arise before upgrading the next group.
      5. Track and communicate. Record all information into a spreadsheet like the one on the right. This will aid in communication and tracking.
      Ring Department or Group Total Users Delay Time Before Next Group
      Pilot Ring Individuals from all departments 10 Three weeks
      Ring 1 Dev Finance 20 Two weeks
      Ring 2 Research 100 One week
      Ring 3 Sales, IT Marketing 500 N/A

      What are my options if my devices cannot upgrade to Windows 11?

      Don’t rush out to replace all the ineligible endpoint devices. You have some time to plan this out. Windows 10 will be available and supported by Microsoft until October 2025.

      Use asset management strategies and budget techniques in your Windows 11 upgrade approach:

      • Start with current inventory and determine which devices will not be eligible for upgrade to Windows 11.
      • Prioritize the devices for replacement, taking device age, the role of the user the device supports, and delivery times for remote users into consideration.
      • Take this opportunity to review overall device offerings and end-user compute strategy. This will help decide which devices to offer going forward while improving end-user satisfaction.
      • Determine the cost for replacement devices:
        • Compare vendor offerings using an RFP process.
      • Use the hardware asset management planning spreadsheet on the next slide to budget for the replacements over the coming months leading up to October 2025.

      Leverage Info-Tech research to improve your end-user computing strategy and hardware asset management processes:

      New to End User Computing Strategies? Start with Modernize and Transform Your End-User Computing Strategy.

      New to IT asset management? Use Info-Tech’s Implement Hardware Asset Management blueprint.

      Use Info-Tech’s HAM Budgeting Tool to plan your hardware asset budget

      Build a Windows 11 Device Replacement Budget

      The link below will open up a hardware asset management (HAM) budgeting tool. This tool can easily be modified to assist in developing and justifying the budget for hardware assets for the Windows 11 project. The tool will allow you to budget for hardware asset refresh and to adjust the budget as needed to accommodate any changes. Follow the instructions on each tab to complete the tool.

      A sample of a possible Windows 11 budgeting spreadsheet is shown on the right, but feel free to play with the HAM budgeting tool to fit your needs.

      HAM Budgeting Tool

      Windows 11 Replacement Schedule
      2022 2023 2024 2025
      Department Total to replace Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Left to allocate
      Finance 120 20 20 20 10 10 20 20 0
      HR 28 15 13 0
      IT 30 15 15 0
      Research 58 8 15 5 20 5 5 0
      Planning 80 10 15 15 10 15 15 0
      Other 160 5 30 5 15 15 30 30 30 0
      Totals 476 35 38 35 35 35 35 38 35 50 35 35 35 35 0

      Related Info-Tech Research

      Modernize and Transform Your End-User Computing Strategy

      This project helps support the workforce of the future by answering the following questions: What types of computing devices, provisioning models, and operating systems should be offered to end users? How will IT support devices? What are the policies and governance surrounding how devices are used? What actions are we taking and when? How do end-user devices support larger corporate priorities and strategies?

      Implement Hardware Asset Management

      This project will help you analyze the current state of your HAM program, define assets that will need to be managed, and build and involve the ITAM team from the beginning to help embed the change. It will also help you define standard policies, processes, and procedures for each stage of the hardware asset lifecycle, from procurement through to disposal.

      Bibliography

      aczechowski, et al. “Windows 11 Requirements.” Microsoft, 3 June 2022. Accessed 13 June 2022.

      Binns, Paul. Personal interview. 07 June 2022.

      Butler, Sydney. “What Is Trusted Platform Module (TPM) and How Does It Work?” Help Desk Geek, 5 August 2021. Accessed 18 May 2022.

      Carklin, Nicolette. “The Unprecedented Growth of the Chromebook Education Market Share.” Parallels International GmbH, 26 October 2021. Accessed 19 May 2022.

      Chang, Ben. Personal interview. 26 May 2022.

      Cunningham, Andrew. “Why Windows 11 has such strict hardware requirements, according to Microsoft.” Ars Technica, 27 August 2021. Accessed 19 May 2022.

      Dealnd-Han, et al. “Windows Processor Requirements.” Microsoft, 9 May 2022. Accessed 18 May 2022.

      “Desktop Operating Systems Market Share Worldwide.” Statcounter Globalstats, June 2021–June 2022. Accessed 17 May 2022.

      “Devices for education.” Microsoft, 2022. Accessed 13 June 2022.

      Duke, Kent. “Chromebook sales skyrocketed in Q3 2020 with online education fueling demand.” Android Police, 16 November 2020. Accessed 18 May 2022.

      Grabham, Dan. “Windows 11 first impressions: Our initial thoughts on using Microsoft's new OS.” Pocket-Lint, 24 June 2021. Accessed 3 June 2022.

      Hachman, Mark. “Why is there a Windows 11 if Windows 10 is the last Windows?” PCWorld, 18 June 2021. Accessed 17 May 2022.

      Howse, Brett. “What to Expect with Windows 11: A Day One Hands-On.” Anandtech, 16 November 2020. Accessed 3 June 2022.

      Hruska, Joel. “Chromebooks Gain Market Share as Education Goes Online.” Extremetech, 26 October 2020. Accessed 19 May 2022.

      Jawed, Usama. “I am finally excited about Windows 11 again.” Neowin, 26 February 2022. Accessed 3 June 2022.

      Jmbpiano. “Windows 11 - What are our initial thoughts and feelings?” Reddit, 22 November 2021. Accessed 3 June 2022.

      Lumunge, Erick. “UEFI and Legacy boot.” OpenGenus, n.d. Accessed 18 May 2022.

      Bibliography

      Mandaro, Laura. “Chromebooks Gain Share of Education Market Despite Shortages.” The Information, 9 September 2020. Accessed 19 May 2022.

      Murtaza, Fawad. “What Is Virtualization Based Security in Windows?” Valnet Inc, 24 October 2021. Accessed 17 May 2022.

      Roberts, Jeremy. Personal interview. 27 May 2022.

      Rouse, Rick. “My initial thoughts about Windows 11 (likes and dislikes).” RicksDailyTips.com, 5 September 2021. Accessed 3 June 2022.

      Sandrews1313. “Windows 11 - What are our initial thoughts and feelings?” Reddit, 22 November 2021. Accessed 3 June 2022.

      “The Matrix Quotes." Quotes.net, n.d. Accessed 18 May 2022.

      Thurrott, Paul.” Google: 40 Million Chromebooks in Use in Education.” Thurrott, 21 January 2020. Accessed 18 May 2022.

      Vaughan-Nichols, Steven J. “The real reason for Windows 11.” Computerworld, 6 July 2021, Accessed 19 May 2022.

      “Virtual Machine Support.” Microsoft,3 June 2022. Accessed 13 June 2022.

      “What are DirectX 12 compatible graphics and WDDM 2.x.” Wisecleaner, 20 August 2021. Accessed 19 May 2022.

      “Windows 11 Specs and System Requirements.” Microsoft, 2022. Accessed 13 June 2022.

      “Windows Display Driver Model.” MiniTool, n.d. Accessed 13 June 2022.

      Infrastructure and Operations Priorities 2023

      • Buy Link or Shortcode: {j2store}54|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Disruptive & Emerging Technologies
      • Parent Category Link: /disruptive-emerging-technologies
      • Get out of your I&O silo. I&O teams must be expected to work alongside and integrate with cyber security operations.
      • Being unprepared for new ESG reporting mandates without a clear and validated ESG reporting process puts your organization at risk.
      • Get ahead of inflationary pressures with early budgetary planning and identify the gap between the catchup projects and required critical net new investments.

      Our Advice

      Critical Insight

      • Establish I&O within an AI governance program to build trust in AI results, behaviors, and limit legal exposure.
      • Develop data governance program that includes an I&O data steward for oversight.
      • Ready or not, the metaverse is coming to an infrastructure near you. Start expanding I&O technologies and processes to support a metaverse infrastructure.

      Impact and Result

      • Provide a framework that highlight the impacts the threats of an economic slowdown, growing regulatory reporting requirements, cyber security attacks and opportunity that smart governance over AI, data stewardship and the looming explosion of augmented reality and Web 3.0 technologies.
      • Info-Tech can help communicate your I&O priorities into compelling cases for your stakeholders.

      Infrastructure and Operations Priorities 2023 Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Infrastructure & Operations Priorities 2023 – A framework to dive deeper into the trends most relevant to you and your organization

      Discover Info-Tech's six priorities for Infrastructure & Operations leaders.

      Infographic

      Further reading

      Infrastructure &Operations Priorities 2023

      Navigate the liminal space between threats and opportunities.

      2023: A liminal space between threats and opportunities

      Over the last several years, successful CEOs turned to their Infrastructure and Operations (I&O) departments to survive the effects of the pandemic. It was I&O leaders who were able to reconfigure critical infrastructure on the fly to support remote work, adapt to critical supply chain shortages, and work with lines of business managers to innovate operational workflows.

      2023 promises to bring a new set of challenges. Building on the credibility established during the pandemic, I&O is in a unique position to influence the direction a business will take to be successful in a time of austerity.

      I&O members are going to be asked to mitigate the threats of volatility from recession pressures, new cybersecurity attacks, and operational process and litigation from regulatory mandates. At the same time, I&O members are being asked for fundamental digital transformation items to realize long-term opportunities to their organizations in 2023.

      Seemingly counter-intuitive in a time of economic slowdown, organizations in 2023 will want to start the groundwork to realizing the I&O opportunities that unstructured data and artificial intelligence have promised, while prepping for what has been mislabeled as the Metaverse.

      If you are in a traditionally risk adverse industry, you’re more likely to be impacted by the threat mitigation.

      Opportunistic I&O members will use 2023 to proactively jumpstart digital transformation.

      Introduction

      Welcome to the Info-Tech 2023 I&O Priorities Report

      If I&O members learned anything from the last few years, it’s how to tactically respond to the disruptive waves often arising from sources external to the organization. The good news is that Info-Tech’s I&O priorities report provides forward-looking insights to help members become more proactive to the tsunami of change predicted in our Trends Report to happen over the next three to five years.

      Info-Tech I&O priorities are generated through a phased approach. The first phase senses and identifies mega and macro tends in the digital landscape to formulate hypotheses about the trends for the next three to five years. These hypotheses are validated by sending out a survey to Info-Tech members. The responses from 813 members was used to produce an Info-Tech Trends Report focused on major long-term trends.

      The I&O Priorities were determined by combining the I&O member responses within the Info-tech Trends Survey with insightful signals from secondary research, economic markets, regulatory bodies, industry organizations, and vendors. The six I&O priorities identified in this report are presented in a framework that highlight the impacts of an economic slowdown, growing regulatory reporting requirements, cybersecurity threats, smart governance of AI, embracing stewardship of data, and the looming explosion of augmented reality and Web 3.0 technologies.

      We also have a challenge exercise to help you communicate which priorities to focus your I&O organization on. Additionally, we linked some Info-tech research and tools related to the priorities that help your I&O organization formulate actionable plans for each area.

      Priorities

      Six forward-looking priorities for the next year.

      Focus

      Activity to help select which priorities are relevant for you.

      Actions

      Actionable Info-tech research and tools to help you deliver.

      Infrastructure & Operations priorities

      The I&O priorities were determined by combining I&O member responses from the Tech Trends and Priorities 2023 survey with insightful signals from secondary research, economic markets, regulatory bodies, industry organizations, and vendors.

      The image contains a screenshot of the Infrastructure & Operations priorities.

      I&O Priorities 2023

      The image contains a screenshot of the I&O Priorities.

      I&O priorities framework

      Threats signals

      Enhance I&O Cybersecurity

      Produce ESG Reporting

      Recession Readiness

      Get out of your silo. Forget your job description and start doing what needs to be done.

      Infrastructure rarely has authority in these areas, but somehow it ends up with many of the responsibilities. You can't afford to be reactive. Forget about your traditional silo and get out in front of these topics. Not in your job description? Find out whose job it is and make them aware. Better yet – take charge! If you're going to be responsible you might as well be in control.

      Opportunities signals

      AI Governance: Watching the Watchers

      Prep for A Brave New Metaverse

      Data Governance: Cornerstone of Value

      Proper stewardship of data is an I&O must. If thought you had problems with your unstructured data, wait until you see the data sprawl coming from the metaverse.

      I&O needs to be so much more than just an order taker for the dev teams and lines of business. The sprawl of unstructured data in Word, Excel, PDF and PowerPoint was bad historically; imagine those same problems at metaverse scale! Simple storage and connectivity is no longer enough – I&O must move upstream with more sophisticated service and product offerings generated through proper governance and stewardship.

      Challenge: Expand the I&O border

      The hidden message in this report is that I&O priorities extend beyond the traditional scope of I&O functions. I&O members need to collaborate across functional areas to successfully address the priorities presented in this report.

      Info-Tech can help! Align your priorities with our material on how to Build a Business-Aligned IT Strategy. Use a modified version of the Strategy Initiative Template (next slide) to convey your strong opinion on the priorities you need your stakeholders to know about. And do so in a way that is familiar so they will easily understand.

      The image contains a screenshot of Info-Tech's Maturity Ladder.
      Info-Tech 2023 Trends Survey Results

      Call your Executive Advisor or Counselor to help identify the one or two key messages you want to bring forward for success in 2023!

      Info-Tech IT Strategy Initiative Template, from the IT Strategy Presentation Template & Priorities Report Initiative Template

      .
      The image contains a screenshot of a template for your priorities.

      Protect from threats

      Get out of your silo. Forget your job description and just start doing what needs to be done.

      Enhance I&O Cybersecurity

      Produce ESG Reporting

      Recession Readiness

      Enhance cybersecurity response

      SIGNALS

      Cybersecurity incidents are
      a clear and present danger
      to I&O members.

      Cybersecurity incidents have
      a large financial impact
      on organizations.

      Related Info-Tech Research

      Of the surveyed I&O members, 53% identified cybersecurity incidents as the number one threat disrupting their operations in 2023. It’s understandable, as over 18% of surveyed I&O members experienced a cybersecurity incident in 2022. Alarmingly, 10% of surveyed I&O members didn’t know if they had a cybersecurity incident. The impact to the organization was with 14% of those incidents directly impacting their organizations for anywhere from 6 to 60 days.

      The 2022 report “Cost of a Data Breach” was conducted by IBM and the Ponemon Institute using data from 550 companies (across 17 countries) that experienced a security incident during a 12-month period ending in March 2022. It highlighted that the average total organizational cost of a security breach globally was USD 4.35M (locally these numbers expand to USA at USD 9.44M, Canada at USD 5.64, UK at USD 5.05M, Germany at USD 4.85M).

      (Source: IBM, 2022)

      Enhance cybersecurity response

      SIGNALS

      Organizations' exposure comes from internal and external sources.

      The right tools and process can reduce the impact of a cybersecurity incident.

      Related Info-Tech Research

      The IBM/Ponemon Institute report highlighted the following:

      • 59% of organizations didn’t deploy a zero-trust architecture on critical infrastructure to reduce exposure.
      • 19% of the breaches originated from within their business partner eco-system.
      • 45% were cloud-based.

      (Source: IBM, 2022)

      The IBM/Ponemon Institute report also identified technologies and procedures to reduce the fiscal impacts of cybersecurity breaches. Having a dedicated security incident response team with a regularly tested plan reduced the incident cost by an average of USD 2.66M. A fully implemented AI security deduction and response automation system can provide average incident savings of 27.6%.

      Enhance cybersecurity response

      SIGNALS

      Cybersecurity spending is a major and expanding expenditure for our members.

      Cybersecurity is going
      to include brand misinformation.

      For 36% of surveyed I&O members, cybersecurity consumed between 10-20% of their total budget in 2022. Moreover, cybersecurity defense funding is expected to increase for 57% of I&O members.

      A third of surveyed I&O members viewed misinformation as a major risk to their organization for 2023 and 2024. Only 38% of the I&O members reported that they will have software in place to monitor and manage social media posts.

      Increasing environment and regulatory complexity demands more sophisticated cybersecurity operations.

      Infrastructure teams must be expected to work alongside and integrate with cybersecurity operations.

      Enhance cybersecurity response

      CALL TO ACTION

      Get out of your I&O silo and form cross-functional cybersecurity teams.

      I&O priority actions

      Establish a cross-functional security steering committee to coordinate security processes and technologies. The complexity of managing security across modern applications, cloud, IoT, and network infrastructure that members operate is greater than ever before and requires coordinated teamwork.

      Contain the cyber threat with zero trust (ZT) architecture. Extend ZT to network and critical infrastructure to limit exposure.

      Leverage AI to build vigilant security intelligence. Smart I&O operators will make use of AI automation to augment their security technologies to help detect threats and contain security incidents on critical infrastructure.

      Enhance cybersecurity response

      I&O priority actions

      Build specialized cybersecurity incident management protocols with your service desk. Build integrated security focused teams within service desk operations that continually test and improve security incident response protocols internally and with specialized security vendors. In some organizations, security incident response teams extend beyond traditional infrastructure into social media. Work cross-functionally to determine the risk exposure to misinformation and incident response procedures.

      Treat lost or stolen equipment as a security incident. Develop hardware asset management protocols for tracking and reporting on these incidents and keep a record of equipment disposal. Implement tools that allow for remote deletion of data and report on lost or stolen equipment.

      Produce ESG reporting

      SIGNALS

      Government mandates present an operational risk to I&O members.

      ESG reporting is
      often incomplete.

      Related Info-Tech Research

      Surveyed members identified government-enacted policy changes to be a top risk to disrupting to their business operations in 2023. One of the trends identified by Info-Tech is that the impact of regulations on environmental, social, and governance (ESG) reporting are being rolled out by governments worldwide.

      Alarmingly, only 7% of surveyed members responded that they could very accurately report on their carbon footprint and 23% said they were not able to report accurately at all.

      Produce ESG reporting

      SIGNALS

      ESG mandates are being rolled out globally.

      ESG reporting has greatly expanded since a 2017 report by Task Force on Climate-Related Financial Disclosures (TCFD, 2017) which recommended that organizations disclose climate-related financial metrics for investors to appropriately price climate-related risks to share price. In 2021, the Swiss Finance Institute research paper (Sautner, 2021) identified 29 countries that require ESG reporting, primarily for larger public companies, financial institutions, and state-owned corporations.

      Global ESG mandates

      The image contains a screenshot of a world map that demonstrates the Global ESG Mandates.

      29 nations with ESG mandates identified by the Swiss Finance Institute

      Produce ESG reporting

      SIGNALS

      ESG mandates are being rolled out globally.

      The EU has mandated ESG reporting for approximately 11,700 large public companies with more than 500 employees under the Non-Financial Reporting Directive (NFRD), since 2014. The EU is going to replace the NFRD with the Corporate Sustainability Reporting Directive (European Council, 2022), which has set a 3-year timetable for escalating the ESG reporting level to what is estimated to be about 75% of EU total turnover (WorldFavor, 2022).

      • 2024: Companies with 500 or more employees.
      • 2025: Companies with 250 or more employee or 40M EU in revenue/20M in total assets.
      • 2026: SMEs, smaller credit financial, and captive insurance institutions.

      It's been a long time since most enterprises had to report on things like power efficiency factors.

      But don't think that being in the cloud will insulate you from a renewed interest in ESG reporting.

      Produce ESG reporting

      CALL TO ACTION

      Being unprepared for new ESG reporting mandates without a clear and validated ESG reporting process puts your organization at risk.

      I&O priority actions

      Understand ESG risk exposure. Define the gap between what ESG reporting is required in your jurisdiction and current reporting capabilities to meet them. Build the I&O role with responsibility for ESG reporting.

      Include vendors in ESG reporting. Review infrastructure facilities with landlords, utilities, and hosting providers to see if they can provide ESG reporting on sustainable power generation, then map it to I&O power consumption as part of their contractual obligations. Ask equipment vendors to provide ESG reporting on manufacturing materials and energy consumption to boot-strap data collection.

      Implement a HAM process to track asset disposal and other types of e-waste. Update agreements with disposal vendors to get reporting on waste and recycle volumes.

      Produce ESG reporting

      I&O priority actions

      Implement an ESG reporting framework. There are five major ESG reporting frameworks being used globally. Select one of the frameworks below that makes sense for your organization, and implement it.

      ISO 14001 Environmental Management: Part of the ISO Technical Committee family of standards that allows your organization to understand its legal requirements to become certified in ESG.

      Global Reporting Initiative (GRI) Sustainability Reporting Standards: GRI has been developing ESG reporting standards since 1997. GRI provides a modular ESG framework applicable to all sizes and sectors of organizations worldwide.

      Principles for Responsible Investment: UN-developed framework for ESG reporting framework for disclosure in responsible investments.

      Sustainability Accounting Standards Board (SASB): ESG report framework to be used by investors.

      UN Global Compact: ESG reporting framework based on 10 principles that organizations can voluntarily contribute data to.

      Implement a HAM process to track asset disposal and other types of e-waste. Update agreements with disposal vendors to get reports on waste and recycle volumes.

      Recession readiness

      SIGNALS

      Managing accelerated technical debt.

      Recessionary pressures.

      Related Info-Tech Research

      I&O members experienced a spike in technical debt following the global pandemic economic shutdown, workforce displacement, and highly disrupted supply chains. 2023 presents a clear opportunity to work on these projects.

      The shortages in workforce and supply chain have accelerated inflation post pandemic. Central banks have started to slow down inflation in 2022 by raising interest rates. However, the World Bank has forecast a potential 2% rise in interest rates as the battle with inflation continues into 2023 and beyond, which could set off a global slowdown in GDP growth to 0.5%, qualifying as a recession. If interest rates continue to climb, I&O members may struggle with the higher cost of capital for their investments.

      (Source: World Bank Organization, 2022)

      Recession readiness

      SIGNALS

      I&O budgets expected to increase.

      Focused budgetary increases.

      Despite economists’ prediction of a looming recession and inflationary pressures, only 11% of I&O members surveyed indicated that they anticipated any reduction in IT budgets for 2023. In fact, 44% of I&O members expected an increase of IT budgets of between 6% and 30%.

      These increases in budget are not uniform across all investments. Surveyed I&O members indicated that the largest anticipated budget increases (compared to 2022) were in the areas of:

      • AI/machine learning ( +7.5%)
      • 5G (+7%)
      • Data Mesh/Fabric and Data Lake infrastructure (+5.7% and +4.4%, respectively)
      • Mixed reality technologies (augmented or virtual reality) (+3.3%)
      • Next generation cybersecurity (+1.7%)

      "2022 has been the first true opportunity to start getting caught up on technical debt stemming from the post pandemic supply chain and resource shortages. That catch-up is going to continue for some time.

      Unfortunately, the world isn't sitting still while doing that. In fact, we see new challenges around inflationary pressures. 2023 planning is going to be a balancing act between old and new projects."

      Paul Sparks,
      CTO at Brookshire Grocery Company

      Recession readiness

      SIGNALS

      Tough choices on budgetary spends.

      The responses indicated that I&O members expect decreased reinvestment for 2023 for the following:

      • API programming (-21.7%)
      • Cloud computing (-19.4%)
      • 44% of I&O members indicated if 2023 requires costs cutting, 5-20% of their cloud computing investment will be at risk of the chopping block!
      • Workforce management (-9.4%)
      • No-code /low-code infrastructure (-5.3%)

      Make sure you can clearly measure the value of all budgeted I&O activities.

      Anything that can't demonstrate clear value to leadership is potentially on the chopping block.

      Recession readiness

      CALL TO ACTION

      Get ahead of inflationary pressures with early budgetary planning, and identify the gap between the catch-up projects and required critical net new investments.

      II&O priority actions

      Hedge against inflation on infrastructure projects. Develop and communicate value-based strategies to lock in pricing and mitigate inflationary risk with vendors.

      Communicate value-add on all I&O budgeted items. Define an infrastructure roadmap to highlight which projects are technical debt and which are new strategic investments, and note their value to the organization.

      Look for cost saving technologies. Focus on I&O projects that automate services to increase productivity and optimize head count.

      Realize opportunities

      Build on a record of COVID-related innovation success and position the enterprise to take advantage of 2023.

      AI governance: Watching the watchers

      Data stewardship: Cornerstone of value

      Prep for a brave new metaverse

      AI governance: Watching the watchers

      SIGNALS

      Continued investment
      in AI technologies

      AI technology is permeating diverse I&O functional areas.

      Related Info-Tech Research

      About 32% of survey respondents who work in I&O said that they already invest in AI, and 40% intend to invest in 2023.

      I&O members have identified the following areas as the top five focal points for AI uses within their organizations.

      • Automated repetitive, low-level tasks
      • Business analytics or intelligence
      • Identification of risks and improvement of security response
      • Monitoring and governance
      • Sensor data analysis

      AI governance: Watching the watchers

      SIGNALS

      Consequences for misbehaving AI.

      I&O leaders can expect to have silos of AI in pockets scattered across the enterprise. Without oversight on the learning model and the data used for training and analytics there is a risk of overprovisioning, which could reduce the efficiency and effectiveness of AI models and results.

      This scale advantage of AI could result in operational inefficiencies without oversight. For example, bad governance means garbage in / garbage out. Which is worse: getting 100 outputs from a system with a 1% error rate, or getting 10,000 outputs from a system with an 1% error rate?

      These are just the operational issues; legally you can be on the hook, as well. The EU Parliament has issued a civil liability regime for AI (European Parliament, n.d.) which imposes liability to operators of AI systems, regardless of whether they acted with operational due diligence. Additionally, the IEEE (IEEE, 2019) is advocating for legal frameworks and accountability for AI that violates human rights and privacy laws and causes legal harm.

      Who is going to instill standards for AI Operations? Who is going to put in the mechanisms to validate and explain the output of AI black boxes?

      If you said it’s going to end up
      being Infrastructure and Operations – you were right!

      AI governance: Watching the watchers

      CALL TO ACTION

      Establish I&O within an AI governance program to build trust in AI results and behaviors and limit legal exposure.

      I&O priority actions

      Define who has overall AI accountability for AI governance within I&O. This role is responsible for establishing strategic governance metrics over AI use and results, and identifying liability risks.

      Maintain an inventory of AI use. Conduct an audit of where AI is used within I&O, and identify gaps in documentation and alignment with I&O processes and organizational values.

      Define an I&O success map. Provide transparency of AI use by generating pseudo code of AI models, and scorecard AI decision making with expected predictions and behavioral actions taken.

      AI governance: Watching the watchers

      Manage bias in AI decision making. Work with AI technology vendors to identify how unethical bias can enter the results, using operational data sets for validation prior to rollout.

      Protect AI data sets from manipulation. Generate new secure storage for AI technology audit trails on AI design making and results. Work with your security team to ensure data sets used by AI for training can’t be corrupted.

      Data governance: Cornerstone of value

      SIGNALS

      Data volumes grow
      with time.

      Data is seen as a source for generating new value.

      Related Info-Tech Research

      Of surveyed I&O members, 63% expected to see the data storage grow by at least 10% in 2023, and 15% expected a 30% or more growth in data storage volumes.

      I&O members identified the top three ways data brings value to the organization:

      • Helping reduce operational costs.
      • Presenting value-added to existing products and services.
      • Acquiring new customers.

      Data governance: Cornerstone of value

      SIGNALS

      Approach to data analysis is primarily done in-house.

      85% of surveyed I&O members are doing data analysis with custom-made or external tools. Interestingly, 10% of I&O members do not conduct any data analysis.

      Members are missing a formal data governance process.

      81% of surveyed I&O members do not have a formal or automated process for data governance. Ironically, 24% of members responded that they aim to have publicly accessible data-as-a-service or information repositories.

      Despite investment in data initiatives, organizations carry high levels of data debt.

      Info-Tech research, Establish Data Governance, points out that data debt, the accumulated cost associated with sub-optimal governance of data assets, is a problem for 78% of organizations.

      What the enterprise expects out of enterprise storage is much more complicated in 2023.

      Data protection and governance are non-negotiable aspects of enterprise storage, even when it’s unstructured.

      Data governance: Cornerstone of value

      SIGNALS

      Data quality is the primary driver for data governance.

      The data governance market
      is booming.

      Related Info-Tech Research

      In the 2022 Zaloni survey of data governance professionals, 71% indicated that consistent data quality was the top metric for data governance, followed by reduced time to insight and regulatory compliance.

      (Source: Zaloni DATAVERSITY, 2022)

      The Business Research Company determined that the global data governance market is expected to grow from $3.28 billion in 2022 to $7.42 billion in 2026 at a CAGR of 22.7% in response to 74 zettabytes of data in 2021, with a growth rate of 1.145 trillion MB of new data being created every day.

      (Source: Business Research Company, 2022)

      Data governance: Cornerstone of value

      CALL TO ACTION

      Develop a data governance program that includes an I&O data steward for oversight.

      I&O priority actions

      Establish an I&O data steward. Make data governance by establishing a data steward role with accountability for governance. The steward works collaboratively with DataOPs to control access to I&O data, enforce policies, and reduce the time to make use of the data.

      Define a comprehensive storage architecture. If you thought you had a data sprawl problem before, wait until you see the volume of data generated from IoT and Web 3.0 applications. Get ahead of the problem by creating an infrastructure roadmap for structured and unstructured data storage.

      Build a solid backbone for AI Operations using data quality best practices. Data quality is the foundation for generation of operational value from the data and artificial intelligence efforts. Focus on using a methodology to build a culture of data quality within I&O systems and applications that generate data rather than reactive fixes.

      Look to partner with third-party vendors for your master data management (MDM) efforts. Modern MDM vendors can work with your existing data fabrics/lake and help leverage your data governance policies into the cloud.

      Prep for a brave new metaverse

      SIGNALS

      From science fiction to science fact.

      The term metaverse was coined in 1992 by Neal Stephenson and is a common theme in science fiction. For most I&O surveyed professionals, the term metaverse conjures up more confusion than clarity, as it’s not one place, but multiple metaverse worlds. The primordial metaverse was focused on multiplayer gaming and some educational experiences. It wasn’t until recently that it gained a critical mass in the fashion and entertainment industries with the use of non-fungible tokens (NFT). The pandemic created a unique opportunity for metaverse-related technologies to expand Web 3.0.

      Related Info-Tech Research

      Prep for a brave new metaverse

      SIGNALS

      Collaboration and beyond.

      On one hand, metaverse technologies virtual reality(VR)/augmented reality (AR) headsets can be a method of collaborating internally within a single organization. About 10% of our surveyed I&O members engaged this type of collaborative metaverse in 2022, with another 24% looking to run proof of concept projects in 2023. However, there is a much larger terrain for metaverse projects outside of workforce collaboration, which 17% of surveyed I&O members are planning to engage with in 2023.

      These are sophisticated new metaverse worlds, and digital twins of production environments are being created for B2B collaboration, operations, engineering, healthcare, architecture, and education that include the use of block chain, NFTs, smart contracts, and other Web 3.0 technologies

      “They are the audiovisual bodies that people use to communicate with each other in the Metaverse.”

      Neal Stephenson,
      Snow Crash 1992

      Prep for a brave new metaverse

      SIGNALS

      Metaverse requires multidimensional security.

      Security in the context of the metaverse presents new challenges to I&O. The infrastructure that runs the metaverse is still vulnerable to “traditional” security threats. New attack vectors include financial and identity fraud, privacy and data loss, along with new cyber-physical threats which are predicted to occur as the metaverse begins to integrate with IoT and other 3D objects in the physical world.

      The ultimate in "not a product" – the metaverse promises to be a hodgepodge of badly standardized technologies for the near future.

      Be prepared to take care of pets and not cattle for the foreseeable future, but keep putting the fencing around the ranch.

      Prep for a brave new metaverse

      SIGNALS

      Generating new wave of sophisticated engineering coming.

      Economics boom around metaverse set to explode.

      Related Info-Tech Research

      Beyond the current online educational resources, there are reputable universities around the world, including Stanford University, that are offering courses on metaverse and Web 3.0 concepts.

      (Source: Arti, 2022)

      So, what’s providing the impetus for all this activity and investment? Economics. In their 2022 report, Metaverse and Money, Citi estimated that the economic value of the metaverse(s) will have 900M to 1B VR/AR users and 5 billion Web 3.0 users with market sizes of $1-2T and $8-$13T, respectively. Yes, that’s a “T” for Trillions.

      (Source: Ghose, 2022)

      Prep for a brave new metaverse

      CALL TO ACTION

      Ready or not, the metaverse is coming to an infrastructure near you. Start expanding I&O technologies and processes to support a metaverse infrastructure.

      I&O priority actions

      Develop a plan for network upgrades.

      A truly immersive VR/AR experience requires very low latency. Identify gaps and develop a plan to enhance your network infrastructure surrounding your metaverse space(s) and end users.

      Extend security posture into the metaverse.

      Securing the infrastructure that runs your metaverse is going to extend the end-user equipment used to navigate it. More importantly, security policies need to encompass the avatars that navigate it and the spatial web that they interact with, which can include physical world items like IoT.

      Prep for a brave new metaverse

      I&O priority actions

      Metaverse theft prevention

      Leverage existing strategies to identify management in the metaverse. Privacy policies need to extend their focus to data loss prevention within the metaverse.

      Collaborate

      The skill set required to build, deploy, manage, and support the metaverse is complex. Develop a metaverse support organization that extends beyond I&O functions into security, DevOps, and end-user experiences.

      Educate

      Web 3.0 technologies and business models are complex. Education of I&O technical- and commerce-focused team members is going to help prevent you from getting blindsided. Seek out specialized training programs for technical staff and strategic education for executives, like the Wharton School of Business certification program.

      Authors

      John Annand

      Theo Antoniadis

      John Annand

      Principal Research Director

      Theo Antoniadis

      Principal Research Director

      Contributors

      Paul Sparks,
      CTO at Brookshire Grocery Company

      2 Anonymous Contributors

      Figuring out the true nature of the “Turbo” button of his 486DX100 launched John on a 20-year career in managed services and solution architecture, exploring the secrets of HPC, virtualization, and DIY WANs built with banks of USR TotalControl modems. Today he focuses his research and advisory on software-defined infrastructure technologies, strategy, organization, and service design in an increasingly Agile and DevOps world.

      Theo has decades of operational and project management experience with start-ups and multinationals across North America and Europe. He has held various consulting, IT management and operations leadership positions within telecommunications, SaaS, and software companies.

      Bibliography

      “3 Cybersecurity Trends that are Changing Financial Data Management." FIMA US. Accessed August 2022.
      Arti. “While much of the world is just discovering the Metaverse, a number of universities have already established centers for studying Web 3." Analytics Insight. 10 July 2022.
      “Artificial intelligence (AI) for cybersecurity." IBM. Accessed September 2022
      “Business in the Metaverse Economy." Wharton School of University of Pennsylvania. Accessed October 2022.
      “Cost of a data breach 2022: A million-dollar race to detect and respond." IBM. Accessed September 2022.
      “Countries affected by mandatory ESG reporting – here’s the list." New Zealand Ministry of Business, Innovation & Employment. Accessed September 2022.
      “Countries affected by mandatory ESG reporting – here’s the list.” WorldFavor. Accessed September 2022.
      Crenshaw, Caroline A. “SEC Proposes to Enhance Disclosures by Certain Investment Advisers and Investment Companies About ESG Investment Practices." U.S. Securities and Exchange Commission. May 2022.
      “Cutting through the metaverse hype: Practical guidance and use cases for business." Avanade. Accessed October 2022.
      “Data Governance Global Market Sees Growth Rate Of 25% Through 2022." The Business Research Company. August 2022.
      “DIRECTIVE 2014/95/EU OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 22 October 2014 amending Directive 2013/34/EU as regards disclosure of non-financial and diversity information by certain large undertakings and groups." UER-Lex. Accessed September 2022.
      "Ethically Aligned Design: A Vision for Prioritizing Human Well-being with Autonomous and Intelligent Systems." IEEE. March 2019.
      “European Parliament resolution of 20 October 2020 with recommendations to the Commission on a civil liability regime for artificial intelligence." European Parliament. Accessed October 2022.
      Ghose, Ronit et al. "Metaverse and Money." Citi GPS. March 2022.
      Hernandez, Roberto, et al. “Demystifying the metaverse." PWC. Accessed August 2022.
      Info-Tech Trends Report Survey, 2023; N=813.
      “ISO 14000 Family: Environmental Management." ISO. Accessed October 2022.
      Knight, Michelle & Bishop, Annie, ”The 2022 State of Cloud Data Governance.“ Zaloni DATAVERSITY. 2022.

      Bibliography

      Kompella, Kashyap, “What is AI governance and why do you need it?“ TechTarget. March 2022.
      “Management of electronic waste worldwide in 2019, by method." Statista. 2022.
      “Model Artificial Intelligence Governance Framework and Assessment Guide.“ World Economic Forum. Accessed September 2022.
      “Model Artificial Intelligence Governance Framework." PDPC Singapore. Accessed October 2022.
      “New rules on corporate sustainability reporting: provisional political agreement between the Council and the European Parliament.“ European Council. June 2022.
      "OECD Economic Outlook Volume 2022." OECD iLibrary. June 2022.
      "Recommendations of the Task Force on Climate-related Financial Disclosures." TCFD. Accessed August 2022.
      “Risk of Global Recession in 2023 Rises Amid Simultaneous Rate Hikes.” World Bank Organization. September 2022.
      Sautner, Zacharias, et al. “The Effects of Mandatory ESG Disclosure around the World.” SSRN. November 2021.
      Sondergaard, Peter. “AI GOVERNANCE – WHAT ARE THE KPIS? AND WHO IS ACCOUNTABLE?“ The Sondergaard Group. November 2019.
      Srivastavam Sudeep, “How can your business enter the Metaverse?." Appinventiv.
      September 2022.
      “Standards Overview." SASB. Accessed October 2022.
      Stephenson, Neal. Snow Crash. Bantam Books, 1992.
      “Sustainability Reporting Standards." Global Reporting Initiative. Accessed October 2022.
      “The Ten Principles of the UN Global Compact." UN Global Compact. Accessed October 2022.
      Tian Tong Lee, Sheryl. "China Unveils ESG Reporting Guidelines to Catch Peers.” Bloomberg. May 2022.
      “What are the Principles for Responsible Investment?" UNPRI. Accessed October 2022.
      "What is the EU's Corporate Sustainability Reporting Directive (CSRD)?" WorldFavor.
      June 2022.
      West, Darrell M. “Six Steps to Responsible AI in the Federal Government.“ Brookings Institution. March 2022. Web.

      Build a Better Manager

      • Buy Link or Shortcode: {j2store}603|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Train & Develop
      • Parent Category Link: /train-and-develop
      • Management skills training is needed, but organizations are struggling to provide training that makes a long-term difference in the skills managers actually use in their day to day.
      • Many training programs are ineffective because they offer the wrong content, deliver it in a way that is not memorable, and are not aligned with the IT department’s business objectives.

      Our Advice

      Critical Insight

      • More of the typical manager training is not enough to solve the problem of underprepared first-time IT managers.
      • You must overcome the key pitfalls of ineffective training to deliver training that is better than the norm.
      • Offer tailored training that focuses on skill building and is aligned with measurable business goals to make your manager training a tangible success.

      Impact and Result

      Use Info-Tech’s tactical, practical training materials to deliver training that is:

      • Specifically tailored to first-time IT managers.
      • Designed around practical application of new skills.
      • Aligned with your department’s business goals.

      Build a Better Manager Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Build a Better Manager Capstone Deck – This deck will guide you through identifying the critical skills your managers need to succeed and planning out a training program tailored to your team and organization.

      This deck presents a behind-the-scenes explanation for the training materials, enabling a facilitator to deliver the training.

      • Build a Better Manager – Phases 1-3

      2. Facilitation Guides – These ready-to-deliver presentation decks span 8 modules. Each module covers a key management skill. The modules can be delivered independently or as a series.

      The modules are complete with presentation slides, speaker’s notes, and accompanying participant workbooks and provide everything you need to deliver the training to your team.

      • Accountability Facilitation Guide
      • Coaching and Feedback Facilitation Guide
      • Communicate Effectively Facilitation Guide
      • Manage Conflict Constructively Facilitation Guide
      • Your Role in Decision Making Facilitation Guide
      • Master Time Facilitation Guide
      • Performance Management Facilitation Guide
      • Your Role in the Organization Facilitation Guide

      3. Participant Workbooks and Supporting Materials – Each training module comes with a corresponding participant workbook to help trainees record insights and formulate individual skill development plans.

      Each workbook is tailored to the presentation slides in its corresponding facilitation guide. Some workbooks have additional materials, such as role play scenarios, to aid in practice. Every workbook comes with example entries to help participants make the most of their training.

      • Communicate Effectively Participant Workbook
      • Performance Management Participant Workbook
      • Coaching and Feedback Participant Workbook
      • Effective Feedback Training Role Play Scenarios
      • Your Role in the Organization Participant Workbook
      • Your Role in Decision Making Participant Workbook
      • Decision Making Case Study
      • Manage Conflict Constructively Participant Workbook
      • Conflict Resolution Role Play Scenarios
      • Master Time Participant Workbook
      • Accountability Participant Workbook
      [infographic]

      Workshop: Build a Better Manager

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Build a Better Manager

      The Purpose

      Attend training on the specific topics necessary for each individual management team.

      Each workshop consists of four days, one 3-hour training session per day. One module is delivered per day, selecting from the following pool of topics:

      Master Time

      Accountability

      Your Role in the Organization

      Your Role in Decision Making

      Manage Conflict Constructively

      Effective Communication

      Performance Management

      Coaching & Feedback

      Key Benefits Achieved

      Managers learn about best practices, practice their application, and formulate individual skill development plans.

      Activities

      1.1 Training on one topic per day, for four days (selected from a pool of eight possible topics)

      Outputs

      Completed workbook and action plan

      Further reading

      Build a Better Manager

      Support IT success with a solid management foundation.

      Analyst Perspective

      Training that delivers results.

      Jane Koupstova.

      Ninety-eight percent of managers say they need more training, but 93% of managers already receive some level of manager training. Unfortunately, the training typically provided, although copious, is not working. More of the same will never get you better outcomes.

      How many times have you sat through training that was so long, you had no hope of implementing half of it?

      How many times have you been taught best practices, with zero guidance on how to apply them?

      To truly support our managers, we need to rethink manager training. Move from fulfilling an HR mandate to providing truly trainee-centric instruction. Teach only the right skills – no fluff – and encourage and enable their application in the day to day.

      Jane Kouptsova
      Research Director, People & Leadership
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Common Obstacles

      Info-Tech’s Approach

      IT departments often promote staff based on technical skill, resulting in new managers feeling unprepared for their new responsibilities in leading people.

      The success of your organization hinges on managers’ ability to lead their staff; by failing to equip new managers adequately, you are risking the productivity of your entire department.

      Despite the fact that $14 billion is spent annually on leadership training in the US alone (Freedman, 2016), only one in ten CIOs believe their department is very effective at leadership, culture, and values (Info-Tech, 2019).

      Training programs do not deliver results due to trainee overwhelm, ineffective skill development, and a lack of business alignment.

      Use Info-Tech’s tactical, practical approach to management training to deliver training that:

      • Is specifically tailored to first-time IT managers.
      • Is designed around practical application of new skills.
      • Is aligned with your department’s business goals.
      • Equips your new managers with essential skills and foundational competencies

      Info-Tech Insight

      When it comes to manager training, more is not more. Attending training is not equal to being trained. Even good information is useless when it doesn’t get applied. If your role hasn’t required you to use your training within 48 hours, you were not trained on the most relevant skills.

      Effective managers drive effective departments by engaging their teams

      The image contains a screenshot to demonstrate effective managers.

      Engaged teams are:

      • 52% more willing to innovate*
      • 70% more likely to be at the organization a year from now**
      • 57% more likely to exceed their role’s expectations**

      Engaged teams are driven by managers:

      • 70% of team-level engagement is accounted for by managers***
      *McLean & Company; N=3,395; **McLean & Company; N=5,902; ***Gallup, 2018

      Despite the criticality of their role, IT organizations are failing at supporting new managers

      87% of middle managers wish they had more training when they were first promoted

      98% of managers say they need more training

      Source: Grovo, 2016

      IT must take notice:

      IT as an industry tends to promote staff on the basis of technical skill. As a result, new managers find themselves suddenly out of their comfort zone, tasked with leading teams using management skills they have not been trained in and, more often than not, having to learn on the job. This is further complicated because many new IT managers must go from a position of team member to leader, which can be a very complex transition.

      The truth is, many organizations do try and provide some degree of manager training, it just is not effective

      99% of companies offer management training*

      93% of managers attend it*

      $14 billion spent annually in the US on leadership training**

      Fewer than one in ten CIOs believe their IT department is highly effective at leadership, culture, and values.

      The image contains a screenshot of a pie chart that demonstrates the effectiveness of the IT department at leadership, culture, and values.

      *Grovo, 2016; **Chief Executive, 2016
      Info-Tech’s Management & Governance Diagnostic, N=337 CIOs

      There are three key reasons why manager training fails

      1. Information Overload

      Seventy-five percent of managers report that their training was too long to remember or to apply in their day to day (Grovo, 2016). Trying to cover too much useful information results in overwhelm and does not deliver on key training objectives.

      2. Limited Implementation

      Thirty-three percent of managers find that their training had insufficient follow-up to help them apply it on the job (Grovo, 2016). Learning is only the beginning. The real results are obtained when learning is followed by practice, which turns new knowledge into reliable habits.

      3. Lack of departmental alignment

      Implementing training without a clear link to departmental and organizational objectives leaves you unable to clearly communicate its value, undermines your ability to secure buy-in from attendees and executives, and leaves you unable to verify that the training is actually improving departmental effectiveness.

      Overcome those common training pitfalls with tactical solutions

      MOVE FROM

      TO

      1. Information Overload

      Timely, tailored topics

      The more training managers attend, the less likely they are to apply any particular element of it. Combat trainee overwhelm by offering highly tactical, practical training that presents only the essential skills needed at the managers’ current stage of development.

      2. Limited Implementation

      Skills-focused framework

      Many training programs end when the last manager walks out of the last training session. Ensure managers apply their new knowledge in the months and years after the training by relying on a research-based framework that supports long-term skill building.

      3. Lack of Departmental Alignment

      Outcome-based measurement

      Setting organizational goals and accompanying metrics ahead of time enables you to communicate the value of the training to attendees and stakeholders, track whether the training is delivering a return on your investment, and course correct if necessary.

      This research combats common training challenges by focusing on building habits, not just learning ideas

      Manager training is only useful if the skills it builds are implemented in the day-to-day.

      Research supports three drivers of successful skill building from training:

      Habits

      Organizational Support

      The training modules include committing to implementing new skills on the job and scheduling opportunities for feedback.

      Learning Structure

      Training activities are customizable, flexible, and accompanied by continuous learning self-evaluation.

      Personal Commitment

      Info-Tech’s methodology builds in activities that foster accountability and an attitude of continuous improvement.

      Learning

      Info-Tech Insight

      When it comes to manager training, stop thinking about learning, and start thinking about practice. In difficult situations, we fall back on habits, not theoretical knowledge. If a manager is only as good as their habits, we need to support them in translating knowledge into practice.

      This research focuses on building good management habits to drive enterprise success

      Set up your first-time managers for success by leveraging Info-Tech’s training to focus on three key areas of management:

      • Managing people as a team
      • Managing people as individuals
      • Managing yourself as a developing leader

      Each of these areas:

      • Is immediately important for a first-time manager
      • Includes practical, tactical skills that can be implemented quickly
      • Translates to departmental and organizational benefits

      Info-Tech Insight

      There is no such thing as “effective management training.” Various topics will be effective at different times for different roles. Delivering only the highest-impact learning at strategic points in your leadership development program will ensure the learning is retained and translates to results.

      This blueprint covers foundational training in three key domains of effective management

      Effective Managers

      • Self
        • Conflict & Difficult Conversations
        • Your Role in the Organization
        • Your Role in Decisions
      • Team
        • Communication
        • Feedback & Coaching
        • Performance Management
      • People
        • Master Time
        • Delegate
        • Accountability

      Each topic corresponds to a module, which can be used individually or as a series in any order.

      Choose topics that resonate with your managers and relate directly to their day-to-day tasks. Training on topics that may be useful in the future, while interesting, is less likely to generate lasting skill development.

      Info-Tech Best Practice

      This blueprint is not a replacement for formal leadership or management certification. It is designed as a practical, tactical, and foundational introduction to key management capabilities.

      Info-Tech’s training tools guide participants through successful skill building

      Practical facilitation guides equip you with the information, activities, and speaker’s notes necessary to deliver focused, tactical training to your management team.

      The participant’s workbook guides trainees through applying the three drivers of skill building to solidify their training into habits.

      Measure the effectiveness of your manager training with outcomes-focused metrics

      Linking manager training with measurable outcomes allows you to verify that the program is achieving the intended benefits, course correct as needed, and secure buy-in from stakeholders and participants by articulating and documenting value.

      Use the metrics suggested below to monitor your training program’s effectiveness at three key stages:

      Program Metric

      Calculation

      Program enrolment and attendance

      Attendance at each session / Total number enrolled in session

      First-time manager (FTM) turnover rate

      Turnover rate: Number of FTM departures / Total number of FTMs

      FTM turnover cost

      Number of departing FTMs this year * Cost of replacing an employee

      Manager Effectiveness Metric

      Calculation

      Engagement scores of FTM's direct reports

      Use Info-Tech's Employee Engagement surveys to monitor scores

      Departures as a result of poor management

      Number of times "manager relationships" is selected as a reason for leaving on an exit survey / Total number of departures

      Cost of departures due to poor management

      Number of times "manager relationships" is selected as a reason for leaving on an exit survey * Cost associated with replacing an employee

      Organizational Outcome Metric

      Calculation

      On-target delivery

      % projects completed on-target = (Projects successfully completed on time and on budget / Total number of projects started) * 100

      Business stakeholder satisfaction with IT

      Use Info-Tech’s business satisfaction surveys to monitor scores

      High-performer turnover rate

      Number of permanent, high-performing employee departures / Average number of permanent, high-performing employees

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      Phase 1 Phase 2 Phase 3

      Call #1: Scope requirements, objectives, and your specific challenges.

      Call #2: Review selected modules and discuss training delivery.

      Call #3: Review training delivery, discuss lessons learned. Review long-term skill development plan.

      A Guided Implementation (GI) is a series

      of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 1 to 3 calls over the course of several months, depending on training schedule.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4

      3-Hour Training Session

      3-Hour Training Session

      3-Hour Training Session

      3-Hour Training Session

      Activities

      Training on topic 1 (selected from a pool of 8 possible topics)

      Training on topic 2 (selected from a pool of 8 possible topics)

      Training on topic 3 (selected from a pool of 8 possible topics)

      Training on topic 4 (selected from a pool of 8 possible topics)

      Deliverables

      Completed workbook and action plan

      Completed workbook and action plan

      Completed workbook and action plan

      Completed workbook and action plan

      Pool of topics:

      • Master Time
      • Accountability
      • Your Role in the Organization
      • Your Role in Decision Making
      • Manage Conflict Constructively
      • Effective Communication
      • Performance Management
      • Coaching & Feedback

      Phase 1

      Prepare to facilitate training

      Phase 1 Phase 2 Phase 3
      • Select training topics
      • Customize the training facilitation guide for your organization
      • Deliver training modules
      • Confirm skill development action plan with trainees
      • Secure organizational support from trainees' supervisors

      Outcomes of this phase:

      • Training facilitation deck customized to organizational norms
      • Training workbook distributed to participants
      • Training dates and facilitator finalized

      1.1 Select training modules

      1-3 hours

      1. Review the module descriptions on the following slides.
      2. Identify modules that will address managers’ most pressing development needs.
        To help make this decision, consult the following:
        • Trainees’ development plans
        • Trainees’ supervisors
      Input Output
      • Module descriptions
      • Trainees’ development goals and needs
      • Prioritized list of training modules
      Materials Participants
      • Prioritized list of training modules
      • Training sponsor
      • Trainees’ supervisors

      Effective Communication

      Effective communication is the cornerstone of good management

      Effective communication can make or break your IT team’s effectiveness and engagement and a manager’s reputation in the organization. Effective stakeholder management and communication has a myriad of benefits – yet this is a key area where IT leaders continue to struggle.


      There are multiple ways in which you communicate with your staff. The tactics you will learn in this section will help you to:

      1. Understand communication styles. Every staff member has a predisposition in terms of how they give, receive, and digest information. To drive effective communication new managers need to understand the profiles of each of their team members and adjust their communicate style to suit.
      2. Understand what your team members want communicated to them and how. Communication is highly personal, and a good manager needs to clearly understand what their team wants to be informed about, their desired interactions, and when they need to be involved in decision making. They also must determine the appropriate channels for communication exchanges.
      3. Make meetings matter. Many new managers never receive training on what differentiates a good and bad meeting. Effective meetings have a myriad of benefits, but more often than not meetings are ineffective, wasting both the participants’ and organizer’s time. This training will help you to ensure that every team meeting drives a solid outcome and gets results.

      Benefits:

      • Better buy-in, understanding, and communication.
      • Improved IT reputation with the organization.
      • Improved team engagement.
      • Improved stakeholder satisfaction.
      • Better-quality decision making.
      • Improved transparency, trust, and credibility.
      • Less waste and rework.
      • Greater ability to secure support and execute the agenda.
      • More effective cooperation on activities, better quality information, and greater value from stakeholder input.
      • Better understanding of IT performance and contribution.

      Effective Communication

      Effective manager communication has a direct impact on employee engagement

      35% Of organizations say they have lost an employee due to poor internal communication (project.co, 2021).

      59% Of business leaders lose work time to mistakes caused by poor communication (Grammarly, 2022).

      $1.2 trillion Lost to US organizations as a result of poor communication (Grammarly, 2022).

      Effective Communication

      Effective communication is crucial to all parts of the business

      Operations

      Human Resources

      Finance

      Marketing

      Increases production by boosting revenue.

      Reduces the cost of litigation and increases revenue through productivity improvements.

      Reduces the cost of failing to comply with regulations.

      Increases attraction and retention of key talent.

      Effective Communication

      The Communicate Effectively Facilitation Guide covers the following topics:

      • Understand Communication Styles
      • Tailor Communication Methods to Activities
      • Make Meetings Matter

      Learning outcomes:

      Main goal: Become a better communicator across a variety of personal styles and work contexts.

      Key objectives:

      • Reaffirm why effective communication matters.
      • Work with people with different communication styles.
      • Communicate clearly and effectively within a team.
      • Make meetings more effective.

      Info-Tech Insight

      First-time IT managers face specific communication challenges that come with managing people for the first time: learning to communicate a greater variety of information to different kinds of people, in a variety of venues. Tailored training in these areas helps managers focus and fast-track critical skill development.

      Performance Management

      Meaningful performance measures drive employee engagement, which in turn drives business success

      Meaningful performance measures help employees understand the rationale behind business decisions, help managers guide their staff, and clarify expectations for employees. These factors are all strong predictors of team engagement:

      The image contains a screenshot to demonstrate the relationship and success between performance measures and employee engagement.

      Performance Management

      Clear performance measures benefit employees and the organization

      Talent Management Outcomes

      Organizational Outcomes

      Performance measure are key throughout the talent management process.

      Candidates:

      • Want to know how they will be assessed
      • Rely on measures to become productive as soon as possible

      Employees:

      • Benefit from training centered on measures that are aligned with business outcomes
      • Are rewarded, recognized, and compensated based on measurable guidelines

      Promotions and Evaluations:

      • Are more effective when informed by meaningful performance measures that align with what leadership believes is important

      Performance measures benefit the organization by:

      • Helping employees know the steps to take to improve their performance
      • Ensuring alignment between team objectives and organizational goals
      • Providing a standardized way to support decision making related to compensation, promotions, and succession planning
      • Reducing “gaming” of metrics, when properly structured, thereby reducing risk to the organization
      • Affording legal defensibility by providing an objective basis for decision making

      Performance Management

      The Performance Management Facilitation Guide covers the following topics:

      • Develop Meaningful Goals
      • Set Meaningful Metrics

      Learning outcomes:

      Main goal: Become proficient in setting, tracking, and communicating around performance management goals.

      Key objectives:

      • Understand the role of managers and employees in the performance management process.
      • Learn to set SMART, business-aligned goals for your team.
      • Learn to help employees set useful individual goals.
      • Learn to set meaningful, holistic metrics to track goal progression.
      • Understand the relationship between goals, metrics, and feedback.

      Info-Tech Insight

      Goal and metric development holds special significance for first-time IT managers because it now impacts not only their personal performance, but that of their employees and their team collectively. Training on these topics with a practical team- and employee-development approach is a focused way to build these skills.

      Coaching & Feedback

      Coaching and feedback are effective methods to influence employees and drive business outcomes

      COACHING is a conversation in which a manager asks an employee questions to guide them to solve problems themselves, instead of just telling them the answer.

      Coaching increases employee happiness, and decreases turnover.1

      Coaching promotes innovation.2

      Coaching increases employee engagement, effort and performance.3

      FEEDBACK is information about the past, given in the present, with the goal of influencing behavior or performance for the future. It includes information given for reinforcement and redirection.

      Honest feedback enhances team psychological safety.4

      Feedback increases employee engagement.5

      Feedback boosts feelings of autonomy and drives innovation.6

      1. Administrative Sciences, 2022
      2. International Review of Management and Marketing, 2020
      3. Current Psychology, 2021
      4. Quantum Workplace, 2021
      5. Issues and Perspectives in Business and Social Sciences, 2022
      6. Sustainability, 2021

      Coaching & Feedback

      The Coaching & Feedback Facilitation Guide covers the following topics:

      • The 4 A’s of Coaching
      • Effective Feedback

      Learning outcomes:

      Main goal: Get prepared to coach and offer feedback to your staff as appropriate.

      Key objectives:

      • Understand the difference between coaching and feedback and when to apply each one.
      • Learn the importance of a coaching mindset.
      • Learn effective coaching via the 4 A’s framework.
      • Understand the actions that make up feedback and the factors that make it successful.
      • Learn to deal with resistance to feedback.

      Info-Tech Insight

      First-time managers often shy away from giving coaching and feedback, stalling their team’s performance. A focused and practical approach to building these skills equips new managers with the tools and confidence to tackle these challenges as soon as they arise.

      Your Role in the Organization

      IT managers who understand the business context provide more value to the organization

      Managers who don’t understand the business cannot effect positive change. The greater understanding that IT managers have of business context, the more value they provide to the organization as seen by the positive relationship between IT’s understanding of business needs and the business’ perception of IT value.

      The image contains a screenshot of a scatter plot grid demonstrating business satisfaction with IT Understanding of Needs across Overall IT Value.

      Source: Info-Tech Research Group

      Your Role in the Organization

      Knowing your stakeholders is key to understanding your role in the business and providing value to the organization

      To understand your role in the business, you need to know who your stakeholders are and what value you and your team provide to the organization. Knowing how you help each stakeholder meet their wants needs and goals means that you have the know-how to balance experience and outcome-based behaviors. This is the key to being an attentive leader.


      The tactics you will learn in this section will help you to:

      1. Know your stakeholders. There are five key stakeholders the majority of IT managers have: management, peers, direct reports, internal users, and external users or customers. Managers need to understand the goals, needs, and wants of each of these groups to successfully provide value to the organization.
      2. Understand the value you provide to each stakeholder. Stakeholder relationship management requires IT managers to exhibit drive and support behaviors based on the situation. By knowing how you drive and support each stakeholder, you understand how you provide value to the organization and support its mission, vision, and values.
      3. Communicate the value your team provides to the organization to your team. Employees need to understand the impact of their work. As an IT manager, you are responsible for communicating how your team provides value to the organization. Mission statements on how you provide value to each stakeholder is an easy way to clearly communicate purpose to your team.

      Benefits:

      • Faster and higher growth.
      • Improved team engagement.
      • Improved stakeholder satisfaction.
      • Better quality decision making.
      • More innovation and motivation to complete goals and tasks.
      • Greater ability to secure support and execute on goals and tasks.
      • More effective cooperation on activities, better quality information, and greater value from stakeholder input.
      • Better understanding of IT performance and contribution.

      Your Role in the Organization

      The Your Role in the Organization Facilitation Guide covers the following topics:

      • Know Your Stakeholders
      • Understand the Value You Provide to the Organization
      • Develop Learnings Into Habits

      Learning outcomes:

      Main goal: Understand how your role and the role of your team serves the business.

      Key objectives:

      • Learn who your stakeholders are.
      • Understand how you drive and support different stakeholder relationships.
      • Relate your team’s tasks back to the mission, vision, and values of the organization.
      • Create a mission statement for each stakeholder to bring back to your team.

      Info-Tech Insight

      Before training first-time IT managers, take some time as the facilitator to review how you will serve the wants and needs of those you are training and your stakeholders in the organization.

      Decision Making

      Bad decisions have tangible costs, so managers must be trained in how to make effective decisions

      To understand your role in the decision-making process, you need to know what is expected of you and you must understand what goes into making a good decision. The majority of managers report they have no trouble making decisions and that they are good decision makers, but the statistics say otherwise. This ease at decision making is due to being overly confident in their expertise and an inability to recognize their own ignorance.1


      The tactics you will learn in this section will help you to:

      1. Effectively communicate decisions. Often, first-time managers are either sharing their decision recommendations with their manager or they are communicating a decision down to their team. Managers need to understand how to have these conversations so their recommendations provide value to management and top-down decisions are successfully implemented.
      2. Provide valuable feedback on decisions. Evaluating decisions is just as critical as making decisions. If decisions aren’t reviewed, there is no data or feedback to discover why a decision was a success or failure. Having a plan in place before the decision is made facilitates the decision review process and makes it easier to provide valuable feedback.
      3. Avoid common decision-making mistakes. Heuristics and bias are common decision pitfalls even senior leaders are susceptible to. By learning what the common decision-making mistakes are and being able to recognize them when they appear in their decision-making process, first-time managers can improve their decision-making ability.

      20% Of respondents say their organizations excel at decision making (McKinsey, 2018).

      87% “Diverse teams are 87% better at making decisions” (Upskillist, 2022).

      86% of employees in leadership positions blame the lack of collaboration as the top reason for workplace failures (Upskillist, 2022).

      Decision Making

      A decision-making process is imperative, even though most managers don’t have a formal one

      1. Identify the Problem and Define Objectives
      2. Establish Decision Criteria
      3. Generate and Evaluate Alternatives
      4. Select an Alternative and Implement
      5. Evaluate the Decision

      Managers tend to rely on their own intuition which is often colored by heuristics and biases. By using a formal decision-making process, these pitfalls of intuition can be mitigated or avoided. This leads to better decisions.

      First-time managers are able to apply this framework when making decision recommendations to management to increase their likelihood of success, and having a process will improve their decisions throughout their career and the financial returns correlated with them.

      Decision Making

      Recognizing personal heuristics and bias in the decision-making process improves more than just decision results

      Employees are able to recognize bias in the workplace, even when management can’t. This affects everything from how involved they are in the decision-making process to their level of effort and productivity in implementing decisions. Without employee support, even good decisions are less likely to have positive results. Employees who perceive bias:

      Innovation

      • Hold back ideas and solutions
      • Intentionally fail to follow through on important projects and tasks

      Brand Reputation

      • Speak negatively about the company on social media
      • Do not refer open positions to qualified persons in their network

      Engagement

      • Feel alienated
      • Actively seek new employment
      • Say they are not proud to work for the company

      Decision Making

      The Decision Making Facilitation Guide covers the following topics:

      • Effectively Communicate Decisions
      • Provide Valuable Feedback on Decisions
      • Avoid Common Decision-Making Mistakes

      Learning outcomes:

      Main goal: Understand how to successfully perform your role in the decision process.

      Key objectives:

      • Understand the decision-making process and how to assess decisions.
      • Learn how to communicate with your manager regarding your decision recommendations.
      • Learn how to effectively communicate decisions to your team.
      • Understand how to avoid common decision-making errors.

      Info-Tech Insight

      Before training a decision-making framework, ensure it is in alignment with how decisions are made in your organization. Alternatively, make sure leadership is on board with making a change.

      Manage Conflict Constructively

      Enable leaders to resolve conflicts while minimizing costs

      If you are successful in your talent acquisition, you likely have a variety of personalities and diverse individuals within your IT organization and in the business, which means that conflict is inevitable. However, conflict does not have to be negative – it can take on many forms. The presence of conflict in an organization can actually be a very positive thing: the ability to freely express opinions and openly debate can lead to better, more strategic decisions being made.

      The effect that the conflict is having on individuals and the work environment will determine whether the conflict is positive or counterproductive.

      As a new manager you need to know how to manage potential negative outcomes of conflict by managing difficult conversations and understanding how to respond to conflict in the workplace.


      The tactics you will learn in this section will help you to:

      1. Apply strategies to prepare for and navigate through difficult conversations.
      2. Expand your comfort level when handling conflict, and engage in constructive conflict resolution approaches.

      Benefits:

      • Relieve stress for yourself and your co-workers.
      • Save yourself time and energy.
      • Positively impact relationships with your employees.
      • Improve your team dynamic.
      • Remove roadblocks to your work and get things done.
      • Save the organization money.
      • Improve performance.
      • Prevent negative issues from reoccurring.

      Manage Conflict Constructively

      Addressing difficult conversations is beneficial to you, your people, and the organization

      When you face a difficult conversation you…

      • Relieve stress on you and your co-workers.
      • Save yourself time and energy.
      • Positively impact relationships with your employees.
      • Improve your team dynamic.
      • Remove roadblocks to your work
      • Save the organization money.
      • Improve performance.
      • Prevent negative issues from reoccurring.

      40% Of employees who experience conflict report being less motivated as a result (Acas, 2021).

      30.6% Of employees report coming off as aggressive when trying to resolve a conflict
      (Niagara Institute, 2022).

      Manage Conflict Constructively

      The Manage Conflict Constructively Facilitation Guide covers the following topics:

      • Know Your Ideal Time Mix
      • Calendar Diligence
      • Effective Delegation
      • Limit Interruptions

      Learning outcomes:

      Main goal: Effectively manage your time and know which tasks are your priority and which tasks to delegate.

      Key objectives:

      • Understand common reasons for difficult conversations.
      • Learn Info-Tech’s six-step process to best to prepare for difficult conversations.
      • Follow best practices to approach difficult conversations.
      • Learn the five approaches to conflict management.
      • Practice conflict management skills.

      Info-Tech Insight

      Conflict does not have to be negative. The presence of conflict in an organization can actually be a very positive thing: the ability to freely express opinions and openly debate can lead to better, more strategic decisions being made.

      Master Time

      Effective leaders spend their time in specific ways

      How effective leaders average their time spent across the six key roles:

      Leaders with effective time management skills spend their time across six key manager roles: strategy, projects, management, operations, innovation, and personal. While there is no magic formula, providing more value to the business starts with little practices like:

      • Spending time with the right stakeholders and focusing on the right priorities.
      • Evaluating which meetings are important and productive.
      • Benchmarking yourself against your peers in the industry so you constantly learn from them and improve yourself.


      The keys to providing this value is time management and delegation. The tactics in this section will help first-time managers to:

      1. Discover your ideal time. By analyzing how you currently spend your time, you can see which roles you are under/over using and, using your job description and performance metrics, discover your ideal time mix.
      2. Practice calendar diligence. Time blocking is an effective way to use your time, see your week, and quickly understand what roles you are spending your time in. Scheduling priority tasks first gives insight into which tasks should be delegated.
      3. Effectively delegation. Clear expectations and knowing the strengths of your team are the cornerstone to effective delegation. By understanding the information you need to communicate and identifying the best person on your team to delegate to, tasks and goals will be successfully completed.
      4. Limit interruptions. By learning how to limit interruptions from your team and your manager, you are better able to control your time and make sure your tasks and goals get completed.

      Strategy

      23%

      Projects

      23%

      Management

      19%

      Operations

      19%

      Innovation

      13%

      Personal

      4%

      Source: Info-Tech, N=85

      Master Time

      Signs you struggle with time management

      Too many interruptions in a day to stay focused.

      Too busy to focus on strategic initiatives.

      Spending time on the wrong things.

      The image contains a screenshot of a bar graph that demonstrates struggle with time management.

      Master Time

      The Master Time Facilitation Guide covers the following topics:

      • Understand Communication Styles
      • Tailor Communication Methods to Activities
      • Make Meetings Matter

      Learning outcomes:

      Main goal: Become a better communicator across a variety of personal styles and work contexts.

      Key objectives:

      • Understand how you spend your time.
      • Learn how to use your calendar effectively.
      • Understand the actions to take to successfully delegate.
      • Learn how to successfully limit interruptions.

      Info-Tech Insight

      There is a right and wrong way to manage your calendar as a first-time manager and it has nothing to do with your personal preference.

      Accountability

      Accountability creates organizational and team benefits

      Improves culture and innovation

      Improves individual performance

      Increases employee engagement

      Increases profitability

      Increases trust and productivity

      Enables employees to see how they contribute

      Increases ownership employees feel over their work and outcomes

      Enables employees to focus on activities that drive the business forward

      Source: Forbes, 2019

      Accountability

      Accountability increases employee empowerment

      Employee empowerment is the number one driver of employee engagement. The extent to which you can hold employees accountable for their own actions and decisions is closely related to how empowered they are and how empowered they feel; accountability and empowerment go hand in hand. To feel empowered, employees must understand what is expected of them, have input into decisions that affect their work, and have the tools they need to demonstrate their talents.

      The image contains a screenshot to demonstrate how accountability increases employee empowerment.

      Source: McLean & Company Engagement Database, 2018; N=71,794

      Accountability

      The Accountability Facilitation Guide covers the following topics:

      • Create Clarity and Transparency
      • Articulate Expectations and Evaluation
      • Help Your Team Remove Roadblocks
      • Clearly Introduce Accountability to Your Team

      Learning outcomes:

      Main goal: Create a personal accountability plan and learn how to hold yourself and your team accountable.

      Key objectives:

      • Understand why accountability matters.
      • Learn how to create clarity and transparency.
      • Understand how to successfully hold people accountable through clearly articulating expectations and evaluation.
      • Know how to remove roadblocks to accountability for your team.

      Info-Tech Insight

      Accountability is about focusing on the results of a task, rather than just completing the task. Create team accountability by keeping the team focused on the result and not “doing their jobs.” First-time managers need to clearly communicate expectations and evaluation to successfully develop team accountability.

      Use the Build a Better Manager Participant Workbooks to help participants set accountabilities and track their progress

      A key feature of this blueprint is built-in guidance on transferring your managers’ new knowledge into practical skills and habits they can fall back on when their job requires it.

      The Participant Workbooks, one for each module, are structured around the three key principles of learning transfer to help participants optimally structure their own learning:

      • Track your learning. This section guides participants through conducting self-assessments, setting learning goals, recording key insights, and brainstorming relapse-prevention strategies
      • Establish your personal commitment. This section helps participants record the actions they personally commit to taking to continually practice their new skills
      • Secure organizational support. This section guides participants in recording the steps they will take to seek out support from their supervisor and peers.

      The image contains a screenshot of the Build a Better Manager Participant Workbooks.

      Info-Tech Insight

      Participants should use this workbook throughout their training and continue to review it for at least three months after. Practical skills take an extended amount of time to solidify, and using the workbook for several months will ensure that participants stay on track with regular practice and check-ins.

      Set your trainees up for success by reviewing these training best practices

      Cultural alignment

      It is critical that the department leadership team understand and agree with the best practices being presented. Senior team leads should be comfortable coaching first-time managers in implementing the skills developed through the training. If there is any question about alignment with departmental culture or if senior team leads would benefit from a refresher course, conduct a training session for them as well.

      Structured training

      Ensure the facilitator takes a structured approach to the training. It is important to complete all the activities and record the outputs in the workbook where appropriate. The activities are structured to ensure participants successfully use the knowledge gained during the workshop to build practical skills.

      Attendees

      Who should attend the training? Although this training is designed for first-time IT managers, you may find it helpful to run the training for the entire management team as a refresher and to get everyone on the same page about best practices. It is also helpful for senior leadership to be aware of the training because the attendees may come to their supervisors with requests to discuss the material or coaching around it.

      Info-Tech Insight

      Participants should use this workbook throughout their training and continue to review it for at least three months after. Practical skills take an extended amount of time to solidify, and using the workbook for several months will ensure that participants stay on track with regular practice and check-ins.

      1.2 Customize the facilitation guides

      1-3 hours

      Prior to facilitating your first session, ensure you complete the following steps:

      1. Read through all the module content, including the speaker’s notes, to familiarize yourself with the material and ensure the tactics presented align with your department’s culture and established best practices.
      2. Customize the slides with a pencil icon with information relevant to your organization.
      3. Ensure you are comfortable with all material to be presented and are prepared to answer questions. If you require clarification on any of the material, book a call with your Info-Tech analyst for guidance.
      4. Ensure you do not delete or heavily customize the self-assessment activities and the activities in the Review and Action Plan section of the module. These activities are structured around a skill building framework and designed to aid your trainees in applying their new knowledge in their day to day. If you have any concerns about activities in these sections, book a call with your Info-Tech analyst for guidance.
      Input Output
      • List of selected modules
      • Customized facilitation guides
      Materials Participants
      • Facilitation guides from selected modules
      • Training facilitator

      1.3 Prepare to deliver training

      1-3 hours

      Complete these steps in preparation for delivering the training to your first-time managers:

      1. Select a facilitator.
        • The right person to facilitate the meeting depends on the dynamics within your department. Having a senior IT leader can lend additional weight to the training best practices but may not be feasible in a large department. In these cases, an HR partner or external third party can be asked to facilitate.
      2. Distribute the workbooks to attendees before the first training session.
        • Change the header on the workbook templates to your own organization’s, if desired.
        • Email the workbooks to attendees prior to the first session. There is no pre-work to be completed.
      Input Output
      • List of selected modules
      • Facilitator selected
      • Workbook distributed
      Materials Participants
      • Workbooks from selected modules
      • Training sponsor
      • Training facilitator

      Phase 2

      Deliver training

      Phase 1 Phase 2 Phase 3
      • Select training topics
      • Customize the training facilitation guide for your organization
      • Deliver training modules
      • Confirm skill development action plan with trainees
      • Secure organizational support from trainees' supervisors

      Outcomes of this phase:

      • Training delivered
      • Development goals set by attendees
      • Action plan created by attendees

      2.1 Deliver training

      3 hours

      When you are ready, deliver the training. Ensure you complete all activities and that participants record the outcomes in their workbooks.

      Tips for activity facilitation:

      • Encourage and support participation from everyone. And be sure no one on the team dismisses anyone’s thoughts or opinions – they present the opportunity for further discussion and deeper insight.
      • Debrief after each activity, outlining any lessons learned, action items, and next steps.
      • Encourage participants to record all outcomes, key insights, and action plans in their workbooks.
      Input Output
      • Facilitation guides and workbooks for selected modules
      • Training delivered
      • Workbooks completed
      Materials Participants
      • Facilitation guides and workbooks for selected modules
      • Training facilitator
      • Trainees

      Phase 3

      Enable long-term skill development

      Phase 1Phase 2Phase 3
      • Select training topics
      • Customize the training facilitation guide for your organization
      • Deliver training modules
      • Confirm skill development action plan with trainees
      • Secure organizational support from trainees' supervisors

      Outcomes of this phase:

      • Attendees reminded of action plan and personal commitment
      • Supervisors reminded of the need to support trainees' development

      3.1 Email trainees with action steps

      0.5 hours

      After the training, send an email to attendees thanking them for participating and summarizing key next steps for the group. Use the template below, or write your own:

      “Hi team,

      I want to thank you personally for attending the Communicate Effectively training module. Our group led some great discussion.

      A reminder that the next time you will reconvene as a group will be on [Date] to discuss your progress and challenges to date.

      Additionally, your manager is aware and supportive of the training program, so be sure to follow through on the commitments you’ve made to secure the support you need from them to build your new skills.

      I am always open for questions if you run into any challenges.

      Regards,

      [Your name]”

      InputOutput
      • The date of participants’ next discussion meeting
      • Attendees reminded of next meeting date and encouraged to follow through on action plan
      MaterialsParticipants
      • Training facilitator

      3.2 Secure support from trainees’ supervisors

      0.5 hours

      An important part of the training is securing organizational support, which includes support from your trainees’ supervisors. After the trainees have committed to some action items to seek support from their supervisors, it is important to express your support for this and remind the supervisors of their role in guiding your first-time managers. Use the template below, or write your own, to remind your trainees’ supervisors of this at the end of training (if you are going through all three modules in a short period of time, you may want to wait until the end of the entire training to send this email):

      “Hi team,

      We have just completed Info-Tech’s first-time manager training with our new manager team. The trainees will be seeking your support in developing their new skills. This could be in the form of coaching, feedback on their progress, reviewing their development plan, etc.

      Supervisor support is a crucial component of skill building, so I hope I can count on all of you to support our new managers in their learning. If you are not sure how to handle these requests, or would like a refresher of the material our trainees covered, please let me know.

      I am always open for questions if you run into any challenges.

      Regards,

      [Your name]”

      InputOutput
      • List of trainees’ direct supervisors
      • Supervisors reminded to support trainees’ skill practice
      MaterialsParticipants
      • Training facilitator

      Contributors

      Brad Armstrong

      Brad Armstrong, Senior Engineering Manager, Code42 Software

      I am a pragmatic engineering leader with a deep technical background, now focused on building great teams. I'm energized by difficult, high-impact problems at scale and with the cloud technologies and emerging architectures that we can use to solve them. But it's the power of people and organizations that ultimately lead to our success, and the complex challenge of bringing all that together is the work I find most rewarding.

      We thank the expert contributors who chose to keep their contributions anonymous.

      Bibliography

      360Solutions, LLC. “The High Cost of Poor Communication: How to Improve Productivity and Empower Employees Through Effective Communication.” 360Solutions, 2009. Web.

      Ali, M., B. Raza, W. Ali, and N. Imtaiz. Linking Managerial Coaching with Employees’ Innovative Work Behaviors through Affective Supervisory Commitment: Evidence from Pakistan. International Review of Management and Marketing, vol. 10, no. 4, 2020, pp. 11-16.

      Allen, Frederick E. “The Terrible Management Technique That Cost Microsoft Its Creativity.” Forbes.com, 3 July 2012. Web.

      Allen, Renee. “Generational Differences Chart.” West Midland Family Center, n.d. Web.

      American Management Association. “Leading the Four Generations at Work.” American Management Association, Sept. 2014. Web.

      Aminov, Iskandar, Aaron De Smet, Gregor Jost, and David Mendelsohn. “Decision making in the age of urgency.” McKinsey & Company, 30 April 2019. Web.

      AON Hewitt. “Aon Hewitt Study Reveals Strong Link Between Employee Engagement and Employee Perceptions of Total Rewards. Honest Leader Communication Also Influences Engagement.” PR Newswire, 8 April 2015. Web.

      Armstrong, Brad. “How to Fail as a New Engineering Manager.” Noteworthy - The Journal Blog, 19 Feb. 2018. Web.

      Asmus, Mary Jo. “Coaching vs. Feedback.” Aspire-CS, 9 Dec. 2009. Web.

      Baldwin, Timothy T., et al. “The State of Transfer of Training Research: Moving Toward More Consumer-Centric Inquiry.” Human Resource Development Quarterly, vol. 28, no. 1, March 2017, pp. 17-28. Crossref, doi:10.1002/hrdq.21278.

      Batista, Ed. “Building a Feedback-Rich Culture from the Middle.” Ed Batista, April 2015. Web.

      Bilalic, Merim, Peter McLeod, and Fernand Gobet. Specialization Effect and Its Influence on Memory and Problem Solving in Expert Chess Players. Wiley Online Journal, 23 July 2009, doi: https://doi.org/10.1111/j.1551-6709.2009.01030.x

      Blume, Brian D., et al. “Transfer of Training: A Meta-Analytic Review.” Journal of Management, vol. 36, no. 4, July 2010, pp. 1065-105. Crossref, doi:10.1177/0149206309352880.

      BOH Training Guide. Wild Wing, Jan. 2017. Web.

      Bosler, Shana. “9 Strategies to Create Psychological Safety at Work.” Quantum Workplace, 3 June 2021. Web.

      Building Communication Skills. ACQUIRE Project/EngenderHealth, n.d. Web.

      Bucaro, Frank C. “The real issue in conflict is never about things…” Frank Bucaro blog, 7 March 2014. Web.

      Burke, Lisa A., and Holly M. Hutchins. “Training Transfer: An Integrative Literature Review.” Human Resource Development Review, vol. 6, no. 3, Sept. 2007, pp. 263-96. Crossref, doi:10.1177/1534484307303035.

      Caprino, Kathy. “Separating Performance Management from Compensation: New Trend for Thriving Organizations.” Forbes, 13 Dec. 2016. Web.

      Caprino, Kathy. “Why the Annual Review Process Damages Employee Engagement.” Forbes, 1 March 2016. Web.

      Carpineanu, Silvana. “7 Mistakes You Might Be Making When Writing A Meeting Agenda.” Time Doctor, 12 January 2021. Web.

      Cecchi-Dimeglio, Paola. “How Gender Bias Corrupts Performance Reviews, and What to Do About It.” Harvard Business Review, 12 April 2017. Web.

      Chartered Institute of Personnel and Development (CIPD). “PESTLE Analysis.” Chartered Institute of Personnel and Development, 2010. Web.

      Chiaburu, Dan S., et al. “Social Support in the Workplace and Training Transfer: A Longitudinal Analysis: Social Support and Training Transfer.” International Journal of Selection and Assessment, vol. 18, no. 2, June 2010, pp. 187-200. Crossref, doi:10.1111/j.1468-2389.2010.00500.x.

      Christensen, Ulrik Juul. “How to Teach Employees Skills They Don’t Know They Lack.” Harvard Business Review, 29 Sept. 2017. Web.

      CIPD. “Rapid evidence assessment of the research literature on the effect of goal setting on workplace performance.” Charted Institute of Personnel and Development, Dec. 2016. Web.

      CIPD. Annual Survey Report: Learning & Development 2015. Charted Institute of Personnel and Development, 2015. Web.

      Communication and Organizational Skills: NPHW Training Manual. Population Health Research Institute (PHRI), 17 Sept. 2015. Web.

      Cookson, Phil. “It’s time to see performance management as a benefit, not a burden.” CIPD. 17 March 2017. Web.

      Communication Statistics 2021. Project.co, 2021. Web.

      Connors, Roger. “Why Accountability?” The Oz Principle, Partners In Leadership, 2014.

      Coutifaris, Constantinos G. V., and Adam M. Grant “Taking Your Team Behind the Curtain: The Effects of Leader Feedback-Sharing and Feedback-Seeking on Team Psychological Safety.” Organization Science, vol. 33,
      no. 4, 2021, pp. 1574-1598. https://doi.org/10.1287/orsc.2021.1498

      Coy, Charles. “Peer Feedback: 6 Tips for Successful Crowdsourcing.” Rework, 25 June 2014. Web.

      “CQ Learn What Really Matters.” CQ Evidence-Based Management Learning Platform, n.d. Web.

      Darwant, Sarah. Coaching Training Course Book. Elite Training, 2012. Web.

      De Smet, Aaron, et al. How Companies Manage the Front Line Today: McKinsey Survey Results. McKinsey, Feb. 2010. Web.

      DeNault, Charles. “Employee Coaching Survey Results: Important and Engaging.” Saba, 22 April 2015. Web.

      Dermol, Valerij, and Tomaž Čater. “The Influence of Training and Training Transfer Factors on Organisational Learning and Performance.” Personnel Review, vol. 42, no. 3, April 2013, pp. 324–48. Crossref, doi:10.1108/00483481311320435.

      dgdotto. “Fail to Plan, Plan to Fail.” visual.ly, 30 April 2013. Web.

      Duggan, Kris. “Why the Annual Performance Review is Going Extinct.” Fast Company, 20 Oct. 2015. Web.

      Duhigg, Charles. “What Google Learned From Its Quest to Build the Perfect Team.” The New York Times, 25 Feb. 2016. Web.

      Earley, P. Christopher, and Randall S. Peterson. “The Elusive Cultural Chameleon: Cultural Intelligence as a New Approach to Intercultural Training for the Global Manager.” Academy of Management Learning & Education, vol. 3, no. 1, March 2004, pp. 100-15. Crossref, doi:10.5465/amle.2004.12436826.

      Edmondson, Amy. “Psychological Safety and Learning Behavior in Work Teams.” Administrative Science Quarterly, vol. 44, no. 2, June 1999, pp. 350-383. Web.

      “Effective Employee Communications Fosters Corporate Reputation.” The Harris Poll, 10 June 2015. Web.

      Eichenwald, Kurt. “How Microsoft Lost its Mojo: Steve Ballmer and Corporate American’s Most Spectacular Decline.” Vanity Fair, 24 July 2012. Web.

      Essential Supervisory Skills. University of Washington, 2016. Web.

      “Estimating the Costs of Workplace Conflict.” Acas, 11 May 2021. Web.

      Falcone, Paul. “Viewpoint: How to Redesign Your Performance Appraisal Template.” Society for Human Resource Management, 7 June 2017. Web.

      Fermin, Jeff. “Statistics On The Importance Of Employee Feedback.” Officevibe, 7 Oct. 2014. Web.

      Filipkowski, Jenna, et al. Building a Coaching Culture with Millennial Leaders. Human Capital Institute, 18 Sept. 2017. Web.

      First Time Manager Training to Help New Managers Develop Essential Skills. The Ken Blanchard Companies, n.d. Web.

      Fisher, Dan. Feedback vs. Coaching, What’s the Difference? Menemsha Group, 28 June 2018. Web.

      Freedman, Erica. “How to Build an Internal Leadership Development Program.” Chief Executive, 2016. Web.

      "Futureproof Your Organization with These 8 Manager Effectiveness Metrics.” Visier Inc., 8 Aug. 2017. Web.

      Gallo, Amy. “How to Manage Your Former Peers.” Harvard Business Review, Dec. 2012. Web.

      Gandhi, Vipula. “Want to Improve Productivity? Hire Better Managers.” Gallup, 3 Aug. 2018. Web.

      Gallup. State of the Global Workplace. 1st edition, Gallup Press, 2017. Web.

      Global Workplace Analytics. “Latest Telecommuting Statistics.” Global Workplace Analytics. Sept. 2013. Web.

      Goldsmith, Marshall. “Try Feedforward Instead of Feedback.” Leader to Leader Institute, 5 April 2011. Web.

      Goldsmith, Marshall. "11 Guidelines for Influencing Top Decision Makers." Marshall Goldsmith, n.d. Web.

      Goldsmith, Marshall. "I Know Less Than You Do – and It’s Okay!" Marshall Goldsmith, n.d. Web.

      Goldsmith, Marshall. "Is It Worth It to Add Value? Not Always." Marshall Goldsmith, n.d. Web.

      Goler, L., J. Gale, and A. Grant. “Let’s Not Kill Performance Evaluations Yet.” Harvard Business Review, Nov. 2016. Web.

      Good Manager, Bad Manager. Grovo, 2016. Web.

      Google People Operations. “Guide: Understand Team Effectiveness.” Google, n.d. Web.

      Google’s New Manager Student Workbook. re:Work with Google, n.d. Web.

      Google’s New Manager Training Facilitator Guide. re:Work with Google, n.d. Web.

      Gossen, Paul. A Coaching Culture Transformation ~ Case Study. Athena Training and Consulting, 1 April 2011. Web.

      Goudreau, Jenna. “How to Communicate in the New Multi-Generational Office.” Forbes Magazine, Feb. 2013. Web.

      Govaerts, Natalie, and Filip Dochy. “Disentangling the Role of the Supervisor in Transfer of Training.” Educational Research Review, vol. 12, June 2014, pp. 77-93. Crossref, doi:10.1016/j.edurev.2014.05.002.

      Grenchus, Gabrielle. “Keep employees engaged with clear priorities and crowdsourced recognition.” IBM thinkLeaders. 8 June 2015. Web.

      Grossman, Rebecca, and Eduardo Salas. “The Transfer of Training: What Really Matters: The Transfer of Training.” International Journal of Training and Development, vol. 15, no. 2, June 2011, pp. 103-20. Crossref, doi:10.1111/j.1468-2419.2011.00373.x.

      Grote, Dick. “3 Popular Goal-Setting Techniques Managers Should Avoid.” Harvard Business Review. 2 Jan. 2017. Web.

      Hall, John. “Why Accountability Is Vital To Your Company.” Forbes, 6 Oct. 2019. Web.

      Hancock, Bryan, et al. “The Fairness Factor in Performance Management.” McKinsey, 5 April 2018. Web.

      Harkins, Phil. “10 Leadership Techniques for Building High-Performing Teams.” Linkage Inc., 2014. Web.

      HCI. Building a Coaching Culture with Managers and Leaders. Human Capital Institute, 2016. Web.

      Heathfield, Susan M. “Tips to Create Successful Performance Appraisal Goals.” The Balance, Aug. 2016. Web.

      Hills, Jan. Brain-Savvy Business: 8 Principles From Neuroscience and How to Apply Them. Head Heart + Brain, 2016. Print.

      Hoffman, Mitchell, and Steven Tadelis. People Management Skills, Employee Attrition, and Manager Rewards: An Empirical Analysis. p. 96.

      “How to Create an Effective Feedback Culture.” eXplorance Inc. Feb. 2013. Web.

      “Importance of Performance Management Process & Best Practices To Optimize Monitoring Performance Work Reviews/Feedback and Goal Management.” SAP Success Factors, n.d. Web.

      Jacobson, Darcy. “How Bad Performance Management Killed Microsoft’s Edge.” Globoforce Blog, 5 July 2012. Web.

      Jaidev, Uma Pricilda, and Susan Chirayath. Pre-Training, During-Training and Post-Training Activities as Predictors of Transfer of Training. no. 4, 2012, p. 18.

      Jensen, Michael C. “Paying People to Lie: The Truth about the Budgeting Process.” European Financial Management, vol. 9, no. 3, 2003, pp. 379-406. Print.

      Kahneman, Daniel, and Ram Charan. HBR's 10 Must Reads on Making Smart Decisions. Harvard Business Review, 26 March 2013. Ebook.

      Kirkpatrick, J., and W. Kirkpatrick. “The Kirkpatrick Four Levels: A Fresh Look After 50 Years 1959-2009.” Kirkpatrickpartners.com, 2009. Web.

      Kirwan, Cyril. Improving Learning Transfer. Routledge, 2016.

      Kline, Theresa J.B., and Lorne M. Sulsky. “Measurement and Assessment Issues in Performance Appraisal.” Canadian Psychology, vol. 50, no. 3, 2009, pp. 161-171. Proquest. Web.

      Kowalski, Kyle. “Create a Daily Routine with Calendar Time Blocking (+ 7 Pro Tips).” Sloww, 29 May 2018. Web.

      Krentz, Susanna E., et al. ”Staying on Course with Strategic Metrics.” Healthcare Financial Management, vol. 60, no. 5, 2006, pp. 86-94. Proquest. Web.

      Kuligowski, Kiely. Tips for First-Time Managers. 15 Feb. 2019. Web.

      Laker, Dennis R., and Jimmy L. Powell. “The Differences between Hard and Soft Skills and Their Relative Impact on Training Transfer.” Human Resource Development Quarterly, vol. 22, no. 1, March 2011, pp. 111-22. Crossref, doi:10.1002/hrdq.20063.

      Lawrence, Paul. “Managerial coaching – A literature review.” International Journal of Evidence Based Coaching and Mentoring, vol. 15, no. 2, 2017, pp. 43-66. Web.

      Ledford, Gerald E. Jr., George Benson, and Edward E. Lawler III. “Cutting-Edge Performance Management.” WorldatWork Research, Aug. 2016. Web.

      Lee, W.R.; Choi, S.B.; Kang, S.-W. How Leaders’ Positive Feedback Influences Employees’ Innovative Behavior: The Mediating Role of Voice Behavior and Job Autonomy. Sustainability, vol. 13, no. 4, 2021, pp. 1901. https://doi.org/10.3390/su13041901

      Leopold, Till Alexander, Vesselina Ratcheva, and Saadia Zahidi. The Future of Jobs. World Economic Forum, 2016. Web.

      Levy, Dan. “How to Build a Culture That Embraces Feedback.” Inc. Magazine, March 2014. Web.

      Lighthouse Research & Advisory. “Insights from the CHRO Panel at Workhuman 2017.” Lighthouse Research & Advisory, June 2017. Web.

      Lipman, Victor. “For New Managers, Boundaries Matter (A Lot).” Forbes, 19 March 2018. Web.

      Lipman, Victor. “The Hardest Thing For New Managers.” Forbes, 1 June 2016. Web.

      Lipman, Victor. “The Move To New Manager May Be The Hardest Transition In Business.” Forbes, 2 Jan. 2018. Web.

      Lyons, Rich. “Feedback: You Need To Lead It.” Forbes, 10 July 2017. Web.

      “Managing Email Effectively.” MindTools, n.d. Web.

      Managing Performance Workbook. Trainer Bubble, 16 Feb. 2013. Web.

      Mayfield, Clifton, et al. “Psychological Collectivism and Team Effectiveness: Moderating Effects of Trust and Psychological Safety.” Journal of Organizational Culture, Communications and Conflict, vol. 20, no. 1, Jan. 2016, pp. 78-94. Web.

      McAlpin, Kevin and Hans Vaagenes. “Critical Decision Making.” Performance Coaching International. 17 Nov. 2017. Web.

      McCoy, Jim. “How to Align Employee Performance with Business Strategy.” Workforce Management, vol. 86, no. 12, 2007, pp. S5. Proquest. Web.

      “Measuring Time-To-Full Productivity.” FeverBee, n.d. Web.

      Meister, Jeanne. The 2020 Workplace: How Innovative Companies Attract, Develop, and Keep Tomorrow's Employees Today. HarperBusiness, 2010. Print.

      Meyer, Erin. “The Four Keys To Success With Virtual Teams.” Forbes Magazine, 19 Aug. 2010. Web.

      Morris, Donna. “Death to the Performance Review: How Adobe Reinvented Performance Management and Transformed Its Business.” WorldatWork, 2016, p. 10. Web.

      Myers-Briggs Company. “New Research: Time Spent on Workplace Conflict Has Doubled Since 2008.” Yahoo! Finance, 18 Oct. 2022. Web.

      Murdoch, Elisabeth. “Elisabeth Murdoch's MacTaggart lecture: full text.” The Guardian, 23 Aug. 2012. Web.

      NASA Governance and Strategic Management Handbook (NPD 1000.0B). NASA, June 2014. Web.

      NASA Space Flight Program and Project Management Handbook (NASA/SP-2014-3705). NASA, Sept. 2014. Web.

      New Manager Training: Management & Leadership Skills. Schulich School of Business, n.d. Web.

      O’Hanlon, Margaret. “It’s a Scandal! Manager Training Exposed! [Implementation Part 4].” Compensation Cafe, 16 Feb. 2012. Web.

      Ordonez, Lisa D., et al. “Goals Gone Wild: The Systematic Side Effects of Over-Prescribing Goal Setting.” Social Science Research Network. Harvard Business School, 11 Feb. 2009. Web.

      Paczka, Nina. “Meeting in the Workplace | 2023 Statistics.” LiveCareer, 25 July 2022. Web.

      Pavlou, Christina. “How to Calculate Employee Turnover Rate | Workable.” Recruiting Resources: How to Recruit and Hire Better, 13 July 2016. Web.

      Performance Management 101 Workbook. Halogen Software, 2015. Web.

      Personal Development and Review. Oxford Learning Institute, n.d. Web.

      Personal Development Plan. MindTools, 2014. Web.

      Porath, Christine, et al. “The Effects of Civility on Advice, Leadership, and Performance.” Journal of Applied Psychology, vol. 44, no. 5, Sept. 2015, pp. 1527-1541. Web.

      Project Management Institute. “PMI’s Pulse of The Profession: In-Depth Report.” PMI, May 2013. Web. June 2015.

      Quay, C. C., and A. Yusof. “The influence of employee participation, rewards and recognition, job security, and performance feedback on employee engagement.” Issues and Perspectives in Business and Social Sciences, vol. 2, no. 1, 2022, pp. 20. https://doi.org/10.33093/ipbss.2022.2.1.3

      Quinn, R. E., and J. Rohrbaugh. “A spatial model of effectiveness criteria: Towards a competing values approach to organizational analysis.” Management Science, vol. 29, 1983, pp. 363–377.

      Re:Work Guide: Develop and Support Managers. re:Work with Google, n.d. Web.

      Reardon, Kathleen Kelley. “7 Things to Say When a Conversation Turns Negative.” Harvard Business Review, 11 May 2016. Web.

      Reh, F. John. “Here Is a List of Mistakes New Managers Make and How to Avoid Them.” The Balance Careers, 30 Dec. 2018. Web.

      Richards, Leigh. “Why Is Employee Empowerment a Common Cornerstone of Organizational Development & Change Programs?” Houston Chronicle, Hearts Newspapers, LLC. 5 July 2013. Web.

      Robson, Fiona. Southwood School – A Case Study: Performance Management Systems. Society for Human Resource Management, 2009. Crossref, doi:10.4135/9781473959552.

      Rock, David, and Beth Jones. “Why More and More Companies are Ditching Performance Ratings.” Harvard Business Review, 8 Sept. 2015. Web.

      Rock, David. “SCARF: A Brain-Based Model for Collaborating With and Influencing Others.” NeuroLeadership Journal, 2008. Web..

      Romão, Soraia, Neuza Ribeiro, Daniel Roque Gomes, and Sharda Singh. “The Impact of Leaders’ Coaching Skills on Employees’ Happiness and Turnover Intention.” Administrative Sciences, vol. 12, no. 84, 2022. https://doi.org/10.3390/ admsci12030084

      Romero, Joseluis. “Yes - you can build a feedback culture.” Skills 2 Lead, Aug. 2014. Web.

      Runde, Craig E., and Tim A. Flanagan. “Conflict Competent Leadership.” Leader to Leader, Executive Forum, Winter 2008. PDF.

      Saks, Alan M., and Lisa A. Burke-Smalley. “Is Transfer of Training Related to Firm Performance?: Transfer and Firm Performance.” International Journal of Training and Development, vol. 18, no. 2, June 2014, pp. 104–15. Crossref, doi:10.1111/ijtd.12029.

      Saks, Alan M., et al. “The Transfer of Training: The Transfer of Training.” International Journal of Training and Development, vol. 18, no. 2, June 2014, pp. 81–83. Crossref, doi:10.1111/ijtd.12032.

      Salomonsen, Summer. Grovo’s First-Time Manager Microlearning® Program Will Help Your New Managers Thrive in 2018. Grovo, 2018. Web.

      Schwartz, Dan. “3 Topics Every New Manager Training Should Include.” Training Industry, 12 April 2017. Web.

      Scott, Dow, Tom McMullen, and Mark Royal. “Retention of Key Talent and the Role of Rewards.” WorldatWork, June 2012. Web.

      “Seeking Agility in Performance Management.” Human Resource Executive, 2016. Web.

      “Should You Always Involve Your Team in Decision Making?” Upskillist, 25 April 2022. Web.

      “SHRM Workplace Forecast.” The Top Workplace Trends According to HR Professionals, May 2013. Web.

      Singhal, Nikhyl. “Eight Tips for First Time Managers.” Medium, 20 Aug. 2017. Web.

      Singhania, Prakriti, et al. “2020 Global Marketing Trends.” Deloitte, 2019. Web.

      SMART Goals: A How to Guide. University of California, n.d. Web.

      Smith, Benson, and Tony Rutigliano. “Scrap Your Performance Appraisal System.” Gallup, 2002. Article.

      “State of the Modern Meeting 2015.” BlueJeans, Aug. 2015. Web.

      Sternberg, Larry, and Kim Turnage. “Why Make Managers A Strategic Priority?” Great Leadership, 12 Oct. 2017. Web.

      Sullivan, Dr. John. “Facebook’s Difference: A Unique Approach For Managing Employees.”TLNT, Sept. 2013. Web.

      Tal, David. “A 'Culture of Coaching' Is Your Company's Most Important Ingredient for Success.” Entrepreneur, 27 Sept. 2017. Web.

      Tenut, Jeff. “How Management Development Training Reduces Turnover.” DiscoverLink, 3 July 2018. Web.

      “The 5 Biggest Biases That Affect Decision-Making.” NeuroLeadership Institute, 2 August 2022. Web.

      “The Different Impact of Good and Bad Leadership.” Barna Group, 2015. Web.

      “The Engaged Workplace.” Gallup, 2017. Web.

      “The Individual Development Plan Guide.” Wildland Fire Leadership Development Program, April 2010, p. 15.

      The State of Business Communication. Grammarly, 2022. Web.

      Thomas, Kenneth. “Conflict and Conflict Management.” The Handbook of Industrial and Organizational Psychology, Rand McNally, 1976. In “The Five Conflict-Handling Modes.” The Myers Briggs Company, n.d. PDF.

      Thompson, Rachel. “What Is Stakeholder Management?” MindTools, n.d. Web.

      Tollet, Francoise. “Distracted? Learn how to (re)focus.” Business Digest, 12 July 2021. Podcast.

      Tonhauser, Cornelia, and Laura Buker. Determinants of Transfer of Training: A Comprehensive Literature Review, p. 40.

      Towers Watson. “Clear Direction in a Complex World: How Top Companies Create Clarity, Confidence and Community to Build Sustainable Performance.” Change and Communication ROI Study Report, 2011-2012. Web.

      Trudel, Natalie. “Improve Your Coaching Skills by Understanding the Psychology of Feedback.” TLNT, 12 July 2017. Web.

      “Understanding When to Give Feedback.” Harvard Business Review, Dec. 2014. Web.

      Vacassin, Daniel. “There are no 'good' performance management systems – there are just good line managers.” LinkedIn, 4 Oct. 2016. Web.

      van der Locht, Martijn, et al. “Getting the Most of Management Training: The Role of Identical Elements for Training Transfer.” Personnel Review, vol. 42, no. 4, May 2013, pp. 422–39. Crossref, doi:10.1108/PR-05-2011-0072.

      Vaughan, Liam. “Banks Find New Ways to Measure Staff.” Financial News, 10 Jan. 2011. Web.

      Watkins, Michael, et al. “Hit the Ground Running:Transitioning to New Leadership Roles.” IMD Business School, May 2014. Web.

      Whitney, Kelley. “Kimberly-Clark Corp.: Redesigning Performance Management.” Talent Management Magazine, vol. 2, no. 1, 2006. Web.

      “Whole Foods 2015 Report.” The Predictive Index, n.d. Web.

      “Whole Foods Market Reports Fourth Quarter and Fiscal Year 2016 Results.” Whole Foods, 2 Feb. 2016. Web.

      Wisniewski, Dan. “Here's why everybody hates meetings.” HR Morning, 14 Dec. 2012. Web.

      Woolum, Janet, and Brent Stockwell. Aligning Performance Measurement to Mission, Goals, and Strategy Workbook. Arizona State University, Jan. 2016. Web.

      Worall, Les, et al. The Quality of Working Life. Chartered Management Institute, 2016. Web.

      “Workplace Conflict Statistics: How We Approach Conflict at Work.” Niagara Institute, 11 Aug. 2022. Web.

      “You Waste a Lot of Time at Work Infographic.” Atlassian, 23 August 2012. Web.

      Zenger, Jack, and Joe Folkman. “Feedback: The Leadership Conundrum.” Talent Quarterly: The Feedback Issue, 2015. Web.

      Zuberbühler, P., et al. “Development and validation of the coaching-based leadership scale and its relationship with psychological capital, work engagement, and performance.” Current Psychology, vol. 42, no. 10, 2021, pp. 1-22.

      Purchase Storage Without Buyer's Remorse

      • Buy Link or Shortcode: {j2store}505|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Storage & Backup Optimization
      • Parent Category Link: /storage-and-backup-optimization
      • Storage is a big ticket item that often only gets purchased every three to five years. Many buyers focus on capital costs and rely on vendors for scoping of requirements leading to overspending and buyer’s remorse.
      • Three-quarters of storage buyers are dissatisfied with at least one aspect of their most recent storage purchase, and over 40% of organizations switched vendors, making it critical to understand the market and the important factors to avoiding buyer’s remorse.

      Our Advice

      Critical Insight

      • Know where to negotiate on price. Many organizations spend as much or more effort on negotiating a better price as they do on assessing current and future requirements; yet, more than 35% of organizations report dissatisfaction with hardware, software, and/or maintenance and support costs from their most recent purchase.
      • Understand support agreements and vendor offerings. Organizations satisfied with their storage purchase spent more effort evaluating support capabilities of vendors and assessing current and future requirements.
      • Determine costs to scale-up your storage. More than 35% of organizations report dissatisfaction with costs to scale their solutions by adding disks or disk trays, following their initial contract, making it crucial to establish scaling costs with your vendor.

      Impact and Result

      • Get peace of mind knowing that the quote you’re about to sign delivers the solution and capabilities around software and support that you think you are getting.
      • Understand contract discounting levels and get advice around where further discounting can be negotiated with the reseller.
      • Future-proof your purchase by capitalizing on Info-Tech’s exposure to other clients’ past experiences.

      Purchase Storage Without Buyer's Remorse Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Purchase storage without buyer's remorse

      Ensure the purchase is the lowest cost with fewest future headaches.

      • Storyboard: Purchase Storage Without Buyer's Remorse

      2. Evaluate storage vendors and their product capabilities

      Select the most appropriate offering for business needs at a competitive price point.

      3. Ensure vendors reveal all details regarding strengths and weaknesses

      Get the lowest priced feature set for the selected product.

      • Storage Reseller Interrogation Script
      [infographic]

      Embed Security Into the DevOps Pipeline

      • Buy Link or Shortcode: {j2store}265|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $31,515 Average $ Saved
      • member rating average days saved: 26 Average Days Saved
      • Parent Category Name: Secure Cloud & Network Architecture
      • Parent Category Link: /secure-cloud-network-architecture
      • Your organization is starting its DevOps journey and is looking to you for guidance on how to ensure that the outcomes are secure.
      • Or, your organization may have already embraced DevOps but left the security team behind. Now you need to play catch-up.

      Our Advice

      Critical Insight

      • Shift security left. Identify opportunities to embed security earlier in the development pipeline.
      • Start with minimum viable security. Use agile methodologies to further your goals of secure DevOps.
      • Treat “No” as a finite resource. The role of security must transition from that of naysayer to a partner in finding the way to “Yes.”

      Impact and Result

      • Leverage the CLAIM (Culture, Learning, Automation, Integration, Measurement) Framework to identify opportunities to close the gaps.
      • Collaborate to find new ways to shift security left so that it becomes part of development rather than an afterthought.
      • Start with creating minimum viable security by developing a DevSecOps implementation strategy that focuses initially on quick wins.

      Embed Security Into the DevOps Pipeline Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should secure the DevOps pipeline, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify opportunities

      Brainstorm opportunities to secure the DevOps pipeline using the CLAIM Framework.

      • Embed Security Into the DevOps Pipeline – Phase 1: Identify Opportunities

      2. Develop strategy

      Assess opportunities and formulate a strategy based on a cost/benefit analysis.

      • Embed Security Into the DevOps Pipeline – Phase 2: Develop Strategy
      • DevSecOps Implementation Strategy Template
      [infographic]

      Improve IT Team Effectiveness

      • Buy Link or Shortcode: {j2store}521|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $16,549 Average $ Saved
      • member rating average days saved: 5 Average Days Saved
      • Parent Category Name: Lead
      • Parent Category Link: /lead
      • Organizations rely on team-based work arrangements to provide organizational benefits and to help them better navigate the volatile, uncertain, complex, and ambiguous (VUCA) operating environment.
      • This is becoming more challenging in a hybrid model as interactions now rely less on casual encounters and now must become more intentional.
      • A high-performing team is more than productive. They are more resilient and able to recognize opportunities. They are proactive instead of reactive due to trust and a high level of communication and collaboration.
      • IT teams are more unique, which also provides unique challenges other teams don’t experience.

      Our Advice

      Critical Insight

      IT teams have:

      • Multiple disciplines that tend to operate in parallel versus within a sequence of events.
      • Multiple incumbent roles where people operate in parallel versus needing to share information to produce an outcome.
      • Multiple stakeholders who create a tension with competing priorities.

      Impact and Result

      Use Info-Tech’s phased approach to diagnose your team and use the IDEA model to drive team effectiveness.

      The IDEA model includes four factors to identify team challenges and focus on areas for improvement: identity, decision making, exchanges within the team, and atmosphere of team psychological safety.

      Improve IT Team Effectiveness Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Team Effectiveness Storyboard – A step-by-step document that walks you through how to properly assess your team’s effectiveness and activities that will identify solutions to overcome.

      The storyboard will walk you through three critical steps to assess, analyze, and build solutions to improve your team’s effectiveness.

    • Having your team members complete an assessment.
    • Reviewing and sharing the results.
    • Building a list of activities to select from based on the assessment results to ensure you target the problem you are facing.
      • Improve IT Team Effectiveness Storyboard – Phases 1-3

      2. The Team Effectiveness Survey – A tool that will determine what areas you are doing well in and where you can improve team relations and increase productivity.

      Each stage has a deliverable that will support your journey on increasing effectiveness starting with how to communicate to the assessment which will accumulate into a team charter and action plan.

      • IT Team Effectiveness Survey
      • IT Team Effectiveness Survey Tool

      3. Facilitation Guide – A collection of activities to select from and use with your team.

      The Facilitation Guide contains instructions to facilitating several activities aligned to each area of the IDEA Model to target your approach directly to your team’s results.

    • Determining roles and responsibilities on the team.
    • Creating a decision-making model that outlines levels of authority and who makes the decisions.
    • Assessing the team communications flow, which highlights the communication flow on the team and any bottlenecks.
    • Building a communication poster that articulates methods used to share different information within the team.
      • Improve IT Team Effectiveness Facilitation Guide
      • Identity – Responsibilities and Dependencies
      • Decision Making Accountability Workbook
      • Exchanges – Team Communications Flow
      • Exchanges – Communications Guide Poster Template
      • Atmosphere – SCARF Worksheet

      4. Action Plan – A template to help build your team action plan.

      The Action Plan Template captures next steps for the team on what they are committing to in order to build a more effective team.

      • Action Plan Template

      5. Team Charter – A template to create a charter for a work group or project team.

      A Team Charter captures the agreements your team makes with each other in terms of accepted behaviors and how they will communicate, make decisions, and create an environment that everyone feels safe contributing in.

      • IT Team Charter Template

      Infographic

      Workshop: Improve IT Team Effectiveness

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Assess the Team

      The Purpose

      Determine if proceeding is valuable.

      Key Benefits Achieved

      Set context for team members.

      Activities

      1.1 Review the business context.

      1.2 Identify IT team members to be included.

      1.3 Determine goals and objectives.

      1.4 Build execution plan and determine messaging.

      1.5 Complete IDEA Model assessment.

      Outputs

      Execution and communication plan

      IDEA Model assessment distributed

      2 Review Results and Action Plan

      The Purpose

      Review results to identify areas of strength and opportunity.

      Key Benefits Achieved

      As a team, discuss results and determine actions.

      Activities

      2.1 Debrief results with leadership team.

      2.2 Share results with team.

      2.3 Identify areas of focus.

      2.4 Identify IDEA Model activities to support objectives and explore areas of focus.

      Outputs

      IDEA assessment results

      Selection of specific activities to be facilitated

      3 Document and Measure

      The Purpose

      Review results to identify areas of strength and opportunity.

      Key Benefits Achieved

      build an action plan of solutions to incorporate into team norms.

      Activities

      3.1 Create team charter.

      3.2 Determine action plan for improvement.

      3.3 Determine metrics.

      3.4 Determine frequency of check-ins.

      Outputs

      Team Charter

      Action Plan

      Further reading

      Improve IT Team Effectiveness

      Implement the four critical factors required for all high-performing teams.

      Analyst Perspective

      All teams need to operate effectively; however, IT teams experience unique challenges.

      IT often struggles to move from an effective to a high-performing team due to the very nature of their work. They work across multiple disciplines and with multiple stakeholders.

      When operating across many disciplines it can become more difficult to identify the connections or points of interactions that define effective teams and separate them from being a working group or focus on their individual performance.

      IT employees also work in close partnership with multiple teams outside their IT domain, which can create confusion as to what team are they a primary member of. The tendency is to advocate for or on behalf of the team they primarily work with instead of bringing the IT mindset and alignment to IT roadmap and goals to serve their stakeholders.

      A Picture of Amanda Mathieson

      Amanda Mathieson
      Research Director, People & Leadership Practice
      Info-Tech Research Group

      Executive Summary

      The Challenge

      Organizations rely on team-based work arrangements to provide organizational benefits and better navigate the volatile, uncertain, complex, and ambiguous (VUCA) operating environment.

      This is becoming more challenging in a hybrid environment as interactions now rely less on casual encounters and must become more intentional.

      A high-performing team is more than productive. They are more resilient and able to recognize opportunities. They are proactive instead of reactive due to the trust and high level of communication and collaboration.

      Common Obstacles

      IT teams are more unique, which also provides unique challenges other teams don't experience:

      • Multiple disciplines that tend to operate in parallel versus within a sequence of events
      • Multiple incumbent roles where people operate in parallel versus needing to share information to produce an outcome
      • Multiple stakeholders that create a tension with competing priorities

      Info-Tech's Approach

      Use Info-Tech's phased approach to diagnose your team and use the IDEA model to drive team effectiveness.

      The IDEA model includes four factors to identify team challenges and focus on areas for improvement: identity, decision making, exchanges within the team, and atmosphere of team psychological safety.

      Info-Tech Insight

      IT teams often fail to reach their full potential because teamwork presents unique challenges and complexities due to the work they do across the organization and within their own group. Silos, not working together, and not sharing knowledge are all statements that indicate a problem. As a leader it's difficult to determine what to do first to navigate the different desires and personalities on a team.

      How this blueprint will help

      Assess, diagnose, and address issues to realize your team's full potential.

      This research helps IT support:

      • Work Teams: Operate under one organizational unit or function. Their membership is generally stable with well-defined roles.
      • Project Teams: Typically, are time-limited teams formed to produce a particular output or project. Their membership and expertise tend to vary over time.
      • Management or Leadership Teams: Provide direction and guidance to the organization and are accountable for overall performance. Membership is structured by the hierarchy of the organization and includes a diverse set of skills, experience, and expertise.

      Traditionally, organizations have tried to fix ineffective teams by focusing on these four issues: composition, leadership competencies, individual-level performance, and organizational barriers. While these factors are important, our research has shown it is beneficial to focus on the four factors of effective teams addressed in this blueprint first. Then, if additional improvement is needed, shift your focus to the traditional issue areas.

      Common obstacles

      These barriers make it difficult to address effectiveness for many IT teams:

      • Teams do not use one standard set of processes because they may have a wide variety of assignments requiring different sets of processes.
        Source: Freshworks
      • There are multiple disciplines within IT that require vastly different skill sets. Finding the connection points can be difficult when on the surface it seems like success doesn't require interconnectivity.
      • IT has many people in the same roles that act independently based on the stakeholder or internal customer they are serving. This can lead to duplication of effort if information and solutions aren't shared.
      • IT serves many parts of the organization that can bring competing priorities both across the groups they support and with the IT strategy and roadmap itself. Many IT leaders work directly in or for the business, which can see them associate with the internal client team more than their IT team – another layer of conflicting priorities.

      IT also experience challenges with maturity and data silos

      48%

      of IT respondents rate their team as low maturity.

      Maturity is defined by the value they provide the business, ranging from firefighting to innovative partner.

      Source: Info-Tech Research Group, Tech Trends, 2022

      20 Hours

      Data Silos: Teams waste more than 20 hours per month due to poor collaboration and communication.

      Source: Bloomfire, 2022

      Current realities require teams to operate effectively

      How High-Performing Teams Respond:

      Volatile: High degree of change happening at a rapid pace, making it difficult for organizations to respond effectively.

      Teams are more adaptable to change because they know how to take advantage of each others' diverse skills and experience.

      Uncertain: All possible outcomes are not known, and we cannot accurately assess the probability of outcomes that are known.

      Teams are better able to navigate uncertainty because they know how to work through complex challenges and feel trusted and empowered to change approach when needed.

      Complex: There are numerous risk factors, making it difficult to get a clear sense of what to do in any given situation.

      Teams can reduce complexity by working together to identify and plan to appropriately mitigate risk factors.

      Ambiguous: There is a lack of clarity with respect to the causes and consequences of events.

      Teams can reduce ambiguity through diverse situational knowledge, improving their ability to identify cause and effect.

      Teams struggle to realize their full potential

      Poor Communication

      To excel, teams must recognize and adapt to the unique communication styles and preferences of their members.

      To find the "just right" amount of communication for your team, communication and collaboration expectations should be set upfront.

      85% of tech workers don't feel comfortable speaking in meetings.
      Source: Hypercontext, 2022

      Decision Making

      Decision making is a key component of team effectiveness. Teams are often responsible for decisions without having proper authority.

      Establishing a team decision-making process becomes more complicated when appropriate decision-making processes vary according to the level of interdependency between team members and organizational culture.

      20% of respondents say their organization excels at decision making.
      Source: McKinsey, 2019

      Resolving Conflicts

      It is common for teams to avoid/ignore conflict – often out of fear. People fail to see how conflict can be healthy for teams if managed properly.

      Leaders assume mature adults will resolve conflicts on their own. This is not always the case as people involved in conflicts can lack an objective perspective due to charged emotions.

      56% of respondents prioritize restoring harmony in conflict and will push own needs aside.
      Source: Niagara Institute, 2022

      Teams with a shared purpose are more engaged and have higher performance

      Increased Engagement

      3.5x

      Having a shared team goal drives higher engagement. When individuals feel like part of a team working toward a shared goal, they are 3.5x more likely to be engaged.

      Source: McLean & Company, Employee Engagement Survey, IT respondents, 2023; N=5,427

      90%

      Engaged employees are stronger performers with 90% reporting they regularly accomplish more than what is expected.

      Source: McLean & Company, Employee Engagement Survey, IT respondents, 2023; N=4,363

      Effective and high-performing teams exchange information freely. They are clear on the purpose and goals of the organization, which enable empowerment.

      Info-Tech Insight

      Clear decision-making processes allow employees to focus on getting the work done versus navigating the system.

      Case Study

      Project Aristotle at Google – What makes a team effective at Google?

      INDUSTRY: Technology
      SOURCE: reWork

      Challenge

      Google wanted to clearly define what makes a team effective to drive a consistent meaning among its employees. The challenge was to determine more than quantitative measures, because more is not always better as it can just mean more mistakes to fix, and include the qualitative factors that bring some groups of people together better than others.

      Solution

      There was no pattern in the data it studied so Google stepped back and defined what a team is before embarking on defining effectiveness. There is a clear difference between a work group (a collection of people with little interdependence) and a team that is highly interdependent and relies on each other to share problems and learn from one another. Defining the different meanings took time and Google found that different levels of the organization were defining effectiveness differently.

      Results

      Google ended up with clear definitions that were co-created by all employees, which helped drive the meaning behind the behaviors. More importantly it was also able to define factors that had no bearing on effectiveness; one of which is very relevant in today's hybrid world – colocation.

      It was discovered that teams need to trust, have clarity around goals, have structure, and know the impact their work has.

      Overcoming barriers

      Teams often lack the skills or knowledge to increase effectiveness and performance.

      • Leaders struggle with team strife and ineffectiveness.
      • A leader's ability to connect with and engage team members is vital for driving desired outcomes. However, many team leads struggle to deal with low-performing or conflict-ridden teams.
      • Without adequate training on providing feedback, coaching, and managing difficult conversations, team leads often do not have the skills to positively affect team performance – and they do not appreciate the impact their actions have on desired outcomes.
      • Team leads often find it difficult to invest time and resources in addressing challenges when the team is working toward deadlines.
      • Team leads who are new to a management role within the organization often struggle to transition from independent contributor to leader – especially when they are tasked with managing team members who are former peers.
      • Some team leads believe that soliciting help will be viewed as a personal failure, so they are reluctant to seek support for team performance management from more-senior leaders.

      It's unrealistic to expect struggling teams to improve without outside help; if they were able to, they would have already done so.
      To improve, teams require:

      • A clearly defined team identity
      • A clearly defined decision-making paradigm
      • Consistently productive exchanges within the team
      • An atmosphere of psychological safety

      BUT these are the very things they are lacking when they're struggling.

      An image of Info-Tech's Insights for Improving IT Team Effectiveness.

      Improving team effectiveness

      Use the Info-Tech IDEA Model to assess and improve your team's effectiveness.

      Begin by assessing, recognizing, and addressing challenges in:

      • Identity – team goals, roles, responsibilities, and accountabilities
      • Decision-making paradigms and processes within the team.
      • Exchanges of information, motivation, and emotions between team members
      • Atmosphere of team psychological safety

      IDEA Model of Team Effectiveness

      Effective Team

      • Identity
      • Decisions
      • Exchanges
      • Atmosphere

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      Phase 1: Assess the team Phase 2: Review results and action plan Phase 3: Document and measure

      Call #1: Scope requirements, objectives, and your specific challenges.
      Call #2: Prepare to assess your team(s) using the assessment tool.

      Call #3: Review the assessment results and plan next steps.
      Call #4: Review results with team and determine focus using IDEA model to identify activity based on results.
      Call #5: Complete activity to determine solutions to build your action plan.

      Call #6: Build out your team agreement.
      Call #7: Identify measures and frequency of check-ins to monitor progress.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 6 to 12 calls over the course of 4 to 6 months.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Day 1
      (Half Day)

      Day 2

      Day 3

      Day 4

      Determine objectives and assess

      Review survey results

      Determine and conduct activities to increase effectiveness

      Bridge the gap and
      create the strategy

      Activities

      With Leader – 1 hour
      1.1 Review the business context.
      1.2 Identify IT team members to be included.
      1.3 Determine goals and objectives.
      1.4 Build execution plan and determine messaging.
      With Team – 90 minutes
      1.5 Share messaging, set context.
      1.6 Complete Team Effectiveness Survey.

      2.1 Debrief results with leadership team.
      2.2 Share results with team.
      2.3 Identify areas of focus.
      2.4 Identify IDEA Model activities to support objectives and explore areas of focus.

      3.1 Conduct IDEA Model Activities:

      • Identify – Clarify goals, roles, and responsibilities.
      • Decisions – Determine levels of authority; decision-making process.
      • Exchanges – Review information shared with communication methods and preferred styles of each team member.
      • Atmosphere – Create a psychologically safe environment.

      3.2 Record outcomes and actions.

      4.1 Create team charter or agreement.
      4.2 Identify metrics to measure progress.
      4.3 Identify risks.
      4.4 Determine frequency of check-ins to review progress.
      4.5 Check-in with sponsor.

      Deliverables

      1. Execution and communication plan
      2. Team Effectiveness Survey
      1. Assessment results
      2. IDEA Model team-building activities
      1. List of solutions to incorporate into team norms
      2. Action Plan
      1. Team Charter

      Phase 1

      Assess the team

      Phase 1

      Phase 2

      Phase 3

      1.1 Identify team members
      and behaviors to improve using IDEA Model
      1.2 Determine messaging including follow-up plan
      1.3 Send survey

      1.1 Review results with team
      1.2 Determine IDEA focus area(s)
      1.3 Conduct activity to determine solutions

      1.1 Document outcomes and actions
      1.2 Create team charter
      1.3 Identify metrics to show success
      1.4 Schedule check-in

      Improving team effectiveness

      Use the Info-Tech IDEA Model to assess and improve your team's effectiveness

      Begin by assessing, recognizing, and addressing challenges in:

      • Identity – team goals, roles, responsibilities, and accountabilities.
      • Decision-making paradigms and processes within the team.
      • Exchanges of information, motivation, and emotions between team members.
      • Atmosphere of team psychological safety.

      Effective Team

      • Identity
      • Decisions
      • Exchanges
      • Atmosphere

      Assess the shared understanding of team identity

      In addition to having a clear understanding of the team's goals and objectives, team members must also:

      • Understand their own and each other's roles, responsibilities, and accountabilities.
      • Recognize and appreciate the value of each team member.
      • Realize how their actions impact each others' work and the overall goals and objectives.
      • Understand that working in silos is considered a work group whereas a team coordinates activities, shares information, and supports each other to achieve their goals.

      Clear goals enable employees to link their contributions to overall success of the team. Those who feel their contributions are important to the success of the department are two times more likely to feel they are part of a team working toward a shared goal compared to those who don't (McLean & Company, Employee Engagement Survey, IT respondents, 2023; N=4,551).

      Goals matter in teamwork

      The goals and objectives of the team are the underlying reason for forming the team in the first place. Without a clear and agreed-upon goal, it is difficult for teams to understand the purpose of their work.

      Clear goals support creating clear roles and the contributions required for team success.

      Team Identity = Team goals and Objectives + Individual roles, responsibilities, and accountabilities

      Assess the shared understanding of decision making

      Decision making adds to the complexity of teamwork.
      Individual team members hold different information and opinions that need to be shared to make good decisions.
      Ambiguous decision-making processes can result in team members being unable to continue their work until they get clear direction.
      The most appropriate decision-making process depends on the type of team:

      • The higher the degree of interconnectivity in team members' work, the greater the need for a general consensus approach to decision making. However, if you opt for a general consensus approach, a backup decision-making method must be identified in the event consensus cannot be reached.
      • High-pressure and high-stakes environments tend to centralize decision making to make important decisions quickly.
      • Low-pressure and low-stakes environments are more likely to adopt consensus models.

      Spectrum of Decision Making

      General consensus between all team members.

      A single, final decision maker within the team.

      Ensure team members understand how decisions are made within the team. Ask:

      • Do team members recognize the importance of sharing information, opinions, and suggestions?
      • Do team members feel their voices are heard?
      • Must there be consensus between all team members?
      • Is there a single decision maker?

      Assess team exchanges by focusing on communication

      Evaluate exchanges within your team using two categories:

      These categories are related, but there is not always overlap. While some conflicts involve failures to successfully exchange information, conflict can also occur even when everyone is communicating successfully.

      Communication

      Managing Conflict

      Information, motivations, emotions

      Accepting and expressing diverse perspectives

      Resolving conflict (unified action through diverse perspectives)

      Transmission

      Reception
      (listening)

      Success is defined in terms of how well information, motivations, and emotions are transmitted and received as intended.

      Success is defined in terms of how well the team can move to united action through differences of opinion. Effective teams recognize that conflict can be healthy if managed effectively.

      Successful exchange behaviors

      • Shared understanding of how to motivate one another and how team members respond emotionally.
      • Team moving beyond conflict to united action.
      • Formalized processes used for resolving conflicts.
      • Platforms provided for expressing diverse or conflicting perspectives and opinions – and used in a constructive manner.
      • Use of agendas at meetings as well as clearly defined action items that reflect meeting outcomes.
      • Avoidance of language that is exclusive, such as jargon and inside jokes.

      Exchanges of information, emotion, and motivation

      When selecting a method of communication (for example, in-person versus email), consider how that method will impact the exchange of all three aspects – not just information.

      Downplaying the importance of emotional and motivational exchanges and focusing solely on information is very risky since emotional and motivational exchanges can impact human relationships and team psychological safety.

      • Information: data or opinions.
      • Emotions: feelings and evaluations about the data or opinions.
      • Motivations: what we feel like doing in response to the data or opinions.

      Communication affects the whole team

      Effects are not limited to the team members communicating directly:

      • How team members interact one on one transmits information and causes emotional and motivational responses in other group members not directly involved.
      • How the larger group receives information, emotions, and motivations will also impact how individuals relate to each other in group settings.

      Remember to watch the reactions and behavior of participants and observers when assessing how the team behaves.

      Managing conflict

      Identify how conflict management is embedded into team practices.

      • Resolving conflicts is difficult and uses up a lot of time and energy. This is especially true if the team needs to figure out what to do each and every time people disagree.
      • Teams that take the time to define conflict resolution processes upfront:
        • Demonstrate their commitment to resolving conflict in a healthy way.
        • Signal that diverse perspectives and opinions are valued, even if they spur disagreement sometimes.
        • Are ready for conflict when it arises – prepared to face it and thrive.

      Successfully communicating information, emotions, and motivations is not the same as managing conflict.

      Teams that are communicating well are more likely to uncover conflicting perspectives and opinions than teams that are not.

      Conflict is healthy and can be an important element of team success if it is managed.

      The team should have processes in place to resolve conflicts and move to united action.

      Assess the atmosphere

      Team psychological safety

      A team atmosphere that exists when all members feel confident that team members can do the following without suffering negative interpersonal consequences such as blame, shame, or exclusion:

      • Admit mistakes
      • Raise questions or concerns
      • Express dissenting views

      (Administrative Science Quarterly, 1999;
      The New York Times, 2016)

      What psychologically safe teams look like:

      • Open and learning-focused approach to error.
      • Effective conflict management within the team.
      • Emotional and relational awareness between team members.
      • Existence of work-appropriate interpersonal relationships between team members (i.e. beyond mere working relationships).

      (Administrative Science Quarterly, 1999;
      The New York Times, 2016)

      What "team psychological safety" is not:

      • A situation where all team members are friends.
        In some cases psychologically safe team atmospheres might be harder to create when team members are friends since they might be more reluctant to challenge or disagree with friends.
      • Merely trust. Being able to rely on people to honor their commitments is not the same as feeling comfortable admitting mistakes in front of them or disagreeing with them.

      "Psychological safety refers to an individual's perception of the consequences of taking an interpersonal risk or a belief that a team is safe for risk taking in the face of being seen as ignorant, incompetent, negative, or disruptive… They feel confident that no one on the team will embarrass or punish anyone else for admitting a mistake, asking a question, or offering a new idea."

      – re:Work

      Psychological safety

      The impact of psychological safety on team effectiveness

      Why does an atmosphere of team psychological safety matter?

      • Prevents groupthink.
        • People who do not feel safe to hold or express dissenting views gravitate to teams that think like they do, resulting in the well-known dangers of groupthink.
      • Encourages contribution and co-operation.
        • One study found that if team psychological safety is present, even people who tend to avoid teamwork will be more likely to contribute in team settings, thereby increasing the diversity of perspectives that can be drawn on (Journal of Organizational Culture, 2016).

      Creating psychological safety in a hybrid environment requires a deliberate approach to creating team connectedness.

      In the Info-Tech State of Hybrid Work in IT report autonomy and team connectedness present an interesting challenge in that higher levels of autonomy drove higher perceptions of lack of connectedness to the respondent's team. In a hybrid world, this means leaders need to be intentional in creating a safe team dynamic.

      47% of employees who experienced more control over their decisions related to where, when, and how they work than before the pandemic are feeling less connected to their teams.
      Source: Info-Tech, State of Hybrid Work in IT, 2022

      1.1 Prepare to launch the survey

      1-2 hours

      1. Review and record the objectives and outcomes that support your vision of a high-performing team:
        1. Why is this important to you?
        2. What reactions do you anticipate from the team?
      2. In your team meeting, share your vision of what a high-performing team looks like. Engage the team in a discussion:
        1. Ask how they work. Ask them to describe their best working team environment from a previous experience or an aspirational one.
        2. Option: Instruct them to write on sticky notes, one idea per note, and share. This approach will allow for theming of ideas.
      3. Introduce the survey as a way, together as a team, the current state can be assessed against the desired state discussed.
        1. Be clear that as the leader, you won't be completing the survey as you don't want to influence their perceptions of the team. As the leader, you hold authority, and therefore, experience the team differently. This is about them and their feedback.

      Input

      • Observations of team behavior
      • Clearly articulated goals for team cohesion

      Output

      • Speaking notes for introducing survey
      • Survey launch

      Materials

      • Whiteboard/flip charts
      • Sticky notes
      • IDEA Assessment

      Participants

      • Leader
      • Team Members

      Download the IT Team Effectiveness Survey

      1.2 Launch the survey

      1-2 hours

      1. Determine how the survey will be completed.
        1. Paper-based
          1. Email a copy of the Word document IT Team Effectiveness Survey for each person to complete individually.
          2. Identify one person to collect each survey and enter the results into the team effectiveness survey tool (tab 2. Data – Effectiveness Answers and tab 3. Data – Team Type Answers). This must be someone outside the team.
        2. Online direct input into Team Effectiveness Survey Tool
          1. Post the document in a shared folder.
          2. Instruct individuals to select one of the numbered columns and enter their information into tab 2. Data – Effectiveness Answers and tab 3. Data – Team Type Answers.
          3. To protect anonymity and keep results confidential, suggest each person opens document in "Cognito mode."
          4. Hide the Summary and Results tabs to avoid team members previewing them.

      Download the IT Team Effectiveness Survey Results Tool

      Paper-Based Cautions & Considerations

      • Heavily dependent on a trusted third party for genuine results
      • Can be time consuming to enter the results

      Online Direct Cautions & Considerations

      • Ensure that users keep to the same numbered column across both entry tabs
      • Seeing other team members' responses may influence others
      • Least amount of administration

      Phase 2

      Review Results and Action Plan

      Phase 1

      Phase 2

      Phase 3

      1.1 Identify team members
      and behaviors to improve using IDEA Model
      1.2 Determine messaging including follow-up plan
      1.3 Send survey

      1.1 Review results with team
      1.2 Determine IDEA focus area(s)
      1.3 Conduct activity to determine solutions

      1.1 Document outcomes and actions
      1.2 Create team charter
      1.3 Identify metrics to show success
      1.4 Schedule check-in

      This phase will walk you through the following activities:

      • Analyzing and debriefing the results to determine themes and patterns to come to a team consensus on what to focus on.
      • Facilitated activities to drive awareness, build co-created definitions of what an effective team looks like, and identify solutions the team can undertake to be more effective.

      This phase involves the following participants:

      • Leader of the team
      • All team members

      Deliverables:

      • A presentation that communicates the team assessment results
      • A plan for effectively delivering the assessment results

      Phase 2: Build a plan to review results and create an action plan

      Reviewing assessment results and creating an improvement action plan is best accomplished through a team meeting.

      Analyzing and preparing for the team meeting may be done by:

      • The person charged with team effectiveness (i.e. team coach).
      • For teams that are seriously struggling with team effectiveness, the coach should complete this step in its entirety.
      • The team coach and the team lead.
      • Truly effective teams are self-reliant. Begin upskilling team leads by involving team leads from the start.
      1. Analyze team assessment results
      2. Prepare to communicate results to the team
      3. Select team activities that will guide the identification of action items and next steps
      4. Facilitate the team meeting

      2.1 Analyze results

      Health Dials

      1. Once the results are final, review the Health Dials for each of the areas.
        1. For each area of the team's effectiveness
          • Red indicates a threat – this will derail the team and you will require an external person to help facilitate conversations.
            It would be recommended to contact us for additional guidance if this is one of your results.
          • Yellow is a growth opportunity.
          • Green is a strength and pay attention to where the dial is – deep into strength or just past the line?
        2. Think about these questions and record your initial reactions.
          1. What surprises you – either positively or negatively?
          2. What areas are as expected?
          3. What behaviors are demonstrated that support the results?

      Prioritize one to two factors for improvement by selecting those with:

      • The lowest overall score.
      • The highest variance in responses.
      • If psychological safety is low, be sure to prioritize this factor; it is the foundation of any effective team.

      An image of the Health dials for each area.

      2.2 Analyze results

      Alignment of Responses

      1. The alignment of responses area provides you with an overview of the range of responses from the team for each area.
        • The more variety in the bars indicates how differently each person is experiencing the team.
        • The more aligned the bars are the more shared the experiences.

      The flatter the bars are across the top, the more agreement there was. Factors that show significant differences in opinion should be discussed to diagnose what is causing the misalignment within your team.

      1. Recommendation is to look at high scores and the alignment and lower scores and the alignment to determine where you may want to focus.

      The alignment chart below shows varied responses; however, there are two distinct patterns. This will be an important area to review.
      Things to think about:

      • Are there new team members?
      • Has there been a leadership change?
      • Has there been a change that has impacted the team?
      An image showing the alignment of responses for Identity, Decisions; Exchange; and Atmosphere.

      2.3 Analyze results

      Team Characteristics and Stakes

      1. Team Characteristics. Use the Team Type Results tab in the IT Team Effectiveness Assessment Tool to identify how the team characterizes itself along the High-Low Scale. The closer the dark blue bar is to the right or left suggests to which degree the team views the characteristic.
        1. Interdependence highlights the team's view on how interconnected and dependent they are on each other to get work done. Think of examples where they should be sharing or collaborating, and they are not.
        2. Virtual describes the physicality of the team. This area has changed a lot since 2020; however, it's still important to note if the team shares the same understanding of work location. Are they thinking of team members in a different geography or referring to hybrid work?
        3. Decision making describes the scale of one decision maker or many. Where are most decisions made by on your team or who is making them?
        4. Stability refers to the degree to which the team stays the same – no membership change or turnover. It can be defined by length of time the group has been together. Looking at this will help understand alignment results. If alignment is varied, one might expect a less stable team.
      2. Stakes and Pressure
        1. Pressure refers to the conditions in which the team must work. How urgent are requests?
        2. Stakes refers to the degree of impact the work has. Will outputs impact safety, health, or a service?
        3. This category can be reviewed against decision making – high pressure, high stakes environments usually have a high concentration of authority. Low pressure, low stakes decisions can also be made either by one person as there is relatively no impact or with many as you have time to get many perspectives.
        4. This area informs what your decision-making protocols should look like.

      A bar graph for Team Characteristics, and a quadrant analysis for comparing Stakes and Pressure.

      2.4 Prepare for meeting

      1-2 hours

      1. Select a facilitator
        • The right person to facilitate the meeting and present the results is dependent upon the results themselves, the team lead's comfort level, and the root and degree of team dysfunction.
        • Typically, the team lead will facilitate and present the results. However, it will be more appropriate to have a member of the HR team or an external third party facilitate.
      2. Set the agenda (recommended sample to the right) that ensures:
        • Team members reflect on the results and discuss reaction to the results. (E.g. Are they surprised? Why/why not?)
        • Results are clearly understood and accepted by team members before moving on to activities.
        • The aim of the meeting is kept in mind. The purpose of the team meeting is to involve all team members in the creation of an effectiveness improvement plan.
      3. Customize the Facilitation Guide and activities in the Improve IT Team Effectiveness Facilitation Guide. (Activities are aligned with the four factors in the IDEA model.)
        • Identify a clear objective for each activity given the team assessment results. (E.g. What are the areas of improvement? What is the desired outcome of the activity?)
        • Review and select the activities that will best achieve the objectives.
        • Customize and prepare for chosen activities appropriately.
        • Obtain all necessary materials.
        • Practice by anticipating and preparing for questions, objectives, and what you will say and do.

      Facilitation Factors
      Select a third-party facilitator if:

      • The team lead is uncomfortable.
      • The leadership or organization is implicated in the team's dysfunction, a third party can be sought in place of HR.
      • Regardless of who facilitates, it is critical that the team lead understands the process and results and is comfortable answering any questions that arise.

      Agenda

      • Review the IDEA Model.
      • Discuss the assessment results.
      • Invite team members to reflect on the results and discuss reaction to the results.
      • Ensure results are clearly understood and accepted.
      • Examine team challenges and strengths through selected team activities.
      • Create a team charter and effectiveness improvement plan.

      Materials

      • IT Team Effectiveness Activities Facilitation Guide
      • IT Team Effectiveness Survey results

      Participants

      • Leader

      2.5 Run the meeting

      2-3 hours

      Facilitate the team meeting and agree on the team effectiveness improvement plan.

      Work with the team to brainstorm and agree on an action plan of continuous improvements.

      By creating an action plan together with the team, there is greater buy-in and commitment to the activities identified within the action plan.

      Don't forget to include timelines and task owners in the action plan – it isn't complete without them.

      Document final decisions in Info-Tech's Improve IT Team Effectiveness Action Plan Tool.

      Review activity Develop Team Charter in the Improve IT Team Effectiveness Facilitation Guide and conclude the team meeting by creating a team charter. With a team charter, teams can better understand:

      • Team objectives
      • Team membership and roles
      • Team ground rules

      Facilitation Factors

      Encourage and support participation from everyone.

      Be sure no one on the team dismisses anyone's thoughts or opinions – they present the opportunity for further discussion and deeper insight.

      Watch out for anything said or done during the activities that should be discussed in the activity debrief.

      Debrief after each activity, outlining any lessons learned, action items, and next steps.

      Agenda

      • Review the IDEA Model.
      • Discuss the assessment results.
      • Invite team members to reflect on the results and discuss reaction to the results.
      • Ensure results are clearly understood and accepted.
      • Examine team challenges and strengths through selected team activities.
      • Create a team charter and effectiveness improvement plan.

      Materials

      • IT Team Effectiveness Activities Facilitation Guide
      • Whiteboard/flip charts
      • Sticky notes
      • IT Team Effectiveness Survey results

      Participants

      • Leader
      • Team Members
      • Optional – External Facilitator

      Phase 3

      Document and measure

      Phase 1

      Phase 2

      Phase 3

      1.1 Identify team members
      and behaviors to improve using IDEA Model
      1.2 Determine messaging including follow-up plan
      1.3 Send survey

      1.1 Review results with team
      1.2 Determine IDEA focus area(s)
      1.3 Conduct activity to determine solutions

      1.1 Document outcomes and actions
      1.2 Create team charter
      1.3 Identify metrics to show success
      1.4 Schedule check-in

      This phase will walk you through the following activities:
      Building your team charter that will include:

      • Team vision, mission, and goals
      • Roles and responsibilities of each member
      • Decision-making responsibilities and process
      • How information will be shared and by whom
      • Ways to build psychological safety on the team

      This phase involves the following participants:

      • Leader of the team
      • All team members

      Document and agree to regular check-ins to reassess.

      As a team it will be important to drive your brainstormed solutions into an output that is co-created.

      • Agree to what actions can be implemented.
      • Capture agreed-to team goals, roles, responsibilities, and decision process into a team charter. Also include your communication protocol that articulates how information will be shared in future.
      1. Review suggestions and actions
      2. Capture in team charter
      3. Assign metrics to measure success and determine when to review
      4. Complete ongoing check-ins with team through team meeting and plan to reassess if agreed to

      Team Charter

      Never assume everyone "just knows."

      Set clear expectations for the team's interactions and behaviors.

      • Some teams call this a team agreement, team protocol, or ways of working. Determine the naming convention that works best for your team and culture.
      • This type of document saw a renewed popularity during COVID-19 as face-to-face interactions were more difficult, and as teams, news ways to work needed to be discovered, shared, and documented.
      • A co-created team charter is a critical component to onboarding new employees in the hybrid world.

      Info-Tech Insight – State of Hybrid Work in IT

      One contributor to the report shared the effort and intention around maintaining their culture during the pandemic. The team agreement created became a critical tool to enable conversations between leaders and their team – it was not a policy document.

      Team effectiveness is driven through thoughtful planned conversations. And it's a continued conversation.

      A screenshot of the IT Team Charter Template page

      Download the IT Team Charter Template

      Establish Baseline Metrics

      Baseline metrics will be improved through:

      Identify the impact that improved team effectiveness will have on the organization.
      Determine your baseline metrics to assess the success of your team interventions and demonstrate the impact to the rest of the organization using pre-determined goals and metrics.
      Share success stories through:

      • Newsletters or email announcements
      • Team meetings
      • Presentations to business partners or the organization

      Sample effectiveness improvement goal

      Sample Metric

      Increase employee engagement
      Increase overall employee engagement scores in the Employee Engagement survey by 5% by December 31, 2023.

      • Overall employee engagement

      Strengthen manager/employee relationships
      Increase manager driver scores in the Employee Engagement survey by 5% by December 31, 2023.

      • Employee engagement – manager driver
      • Employee engagement – senior leadership driver

      Reduce employee turnover (i.e. increase retention)
      Reduce voluntary turnover by 5% by December 31, 2023.

      • Voluntary turnover rate
      • Turnover by department or manager
      • Cost of turnover

      Increase organizational productivity
      Increase the value added by human capital by 5% by December 31, 2023.

      • Value added by human capital
      • Employee productivity
      • Human capital return on investment
      • Employee engagement

      Reassess team effectiveness

      Reassess and identify trends after they have worked on key focus areas for improvement.

      Track the team's progress by reassessing their effectiveness six to twelve months after the initial assessment.
      Identify if:

      • Team characteristics have changed.
      • Areas of team strengths are still a source of strength.
      • Areas for improvement have, in fact, improved.
      • There are opportunities for further improvement.

      As the team matures, priorities and areas of concern may shift; it is important to regularly reassess team effectiveness to ensure ongoing alignment and suitability.
      Note: It is not always necessary to conduct a full formal assessment; once teams become more effective and self-sufficient, informal check-ins by team leads will be sufficient.

      If you assess team effectiveness for multiple teams, you have the opportunity to identify trends:

      • Are there common challenges within teams?
      • If so, what are they?
      • How comfortable are teams with intervention?
      • How often is outside help required?

      Identifying these trends, initiatives, training, or tactics may be used to improve team effectiveness across the department – or even the organization.

      Teams are ultimately accountable for their own effectiveness.

      As teams mature, the team lead should become less involved in action planning. However, enabling truly effective teams takes significant time and resources from the team lead.

      Use the action plan created and agreed upon during the team meeting to hold teams accountable:

      • Ensure teams follow through on action items.
      • Ensure you are continuously assessing team effectiveness (formally or informally).

      The team coach should have a plan to transition into a supportive role by:

      • Providing teams with the knowledge, resources, and tools required to improve and sustain high effectiveness.
      • Providing team members and leads with a safe, open, and honest environment.
      • Stepping in as an objective third party when required.

      If the team continues to face barriers

      Other important information: If team effectiveness has not significantly improved, other interventions may be required that are beyond the scope of this project.

      The four factors outlined in the IDEA Model of team effectiveness are very important, but they are not the only things that have a positive or negative impact on teams. If attempts to improve the four factors have not resulted in the desired level of team effectiveness, evaluate other barriers:

      For organizational culture, ask if performance and reward programs do the following:

      • Value teamwork alongside individual achievement and competition
      • Provide incentives that promote a focus on individual performance over team performance
      • Reward or promote those who sabotage their teams

      For learning and development, ask:

      • Is team effectiveness included in our manager or leadership training?
      • Do we offer resources to employees seeking to improve their teamwork competencies?

      If an individual team member's or leader's performance is not meeting expectations, potential remedies include a performance improvement plan, reassignment, and termination of employment.

      These kinds of interventions are beyond the control of the team itself. In these cases, we recommend you consult with your HR department; HR professionals can be important advocates because they possess the knowledge, influence, and authority in the company to promote changes that support teamwork.

      Related Info-Tech Research

      Redesign Your IT Department

      • You could have the best IT employees in the world, but if they aren't structured well your organization will still fail in reaching its vision.
      • Increase the effectiveness of IT as a function.
      • Provide employees with clarity in their roles and responsibilities.

      Build an IT Employee Engagement Program

      • With the growing IT job market, turnover is a serious threat to IT's ability to deliver seamless value and continuously drive innovation.
      • Engagement initiatives are often seen as being HR's responsibility; however, IT leadership needs to take accountability for the retention and productivity of their employees in order to drive business value.

      Info-Tech Leadership Programs

      • Development of the leadership mind should never stop. This program will help IT leaders continue to craft their leadership competencies to navigate the ever-changing world in which we operate.
      • Actively delegate responsibilities and opportunities that engage and develop team members to build on current skills and prepare for the future.

      Research Contributors and Experts

      A picture of Carlene McCubbin

      Carlene McCubbin
      Practice Lead
      Info-Tech Research Group

      A picture of Nick Kozlo

      Nick Kozlo
      Senior Research Analyst
      Info-Tech Research Group

      A picture of Heather Leier-Murray

      Heather Leier-Murray
      Senior Research Analyst
      Info-Tech Research Group

      A picture of Stephen O'Conner

      Stephen O'Conner
      Executive Counselor
      Info-Tech Research Group

      A picture of Jane Kouptsova

      Jane Kouptsova
      Research Director
      Info-Tech Research Group

      Dr. Julie D. Judd, Ed.D.
      Chief Technology Officer
      Ventura County Office of Education

      Works Cited

      Aminov, I., A. DeSmet, and G. Jost. "Decision making in the age of urgency." McKinsey. April 2019. Accessed January 2023.
      Duhigg, Charles. "What Google Learned From Its Quest to Build the Perfect Team." The New York Times, 25 Feb. 2016. Accessed January 2023.
      Edmondson, Amy. "Psychological Safety and Learning Behavior in Work Teams." Administrative Science Quarterly, vol. 44, no. 2, June 1999, pp. 350-383.
      Gardner, Kate. "Julie Judd – Ventura County Office of Education." Toggle, 12 Sept. 2022. Accessed January 2023.
      Google People Operations. "Guide: Understand Team Effectiveness." reWork, n.d. Accessed February 2023.
      Harkins, Phil. "10 Leadership Techniques for Building High-Performing Teams." Linkage Inc., 2014. Accessed 10 April 2017.
      Heath, C. and D. Heath. Decision: How to make better choices in life and work. Random House, 2013, ISBN 9780307361141.
      Hill, Jon. "What is an Information Silo and How Can You Avoid It." Bloomfire, 23 March 2022. Accessed January 2023.
      "IT Team Management Software for Enhanced Productivity." Freshworks, n.d. Accessed January 2023.
      Jackson, Brian. "2022 Tech Trends." Info-Tech Research Group, 2022. Accessed December 2022.
      Kahneman, Daniel. Thinking fast and slow. Farrar, Straus and Giroux. 2011.
      Kouptsova, J., and A. Mathieson. "State of Hybrid Work in IT." Info-Tech Research Group, 2023. Accessed January 2023.
      Mayfield, Clifton, et al. "Psychological Collectivism and Team Effectiveness: Moderating Effects of Trust and Psychological Safety." Journal of Organizational Culture, Communications and Conflict, vol. 20, no. 1, Jan. 2016, pp. 78-94.
      Rock, David. "SCARF: A Brain-Based Model for Collaborating With and Influencing Others." NeuroLeadership Journal, 2008. Web.
      "The State of High Performing Teams in Tech Hypercontext." Hypercontext. 2022. Accessed November 2022.
      Weick, Carl, and Kathleen Sutcliff. Managing the unexpected. John Wiley & Sons, 2007.
      "Workplace Conflict Statistics: How we approach conflict at work." The Niagara Institute, August 2022. Accessed December 2022.

      Implement Risk-Based Vulnerability Management

      • Buy Link or Shortcode: {j2store}296|cart{/j2store}
      • member rating overall impact: 9.2/10 Overall Impact
      • member rating average dollars saved: $122,947 Average $ Saved
      • member rating average days saved: 34 Average Days Saved
      • Parent Category Name: Threat Intelligence & Incident Response
      • Parent Category Link: /threat-intelligence-incident-response
      • Vulnerability scanners, industry alerts, and penetration tests are revealing more and more vulnerabilities, and it is unclear how to manage them.
      • Organizations are struggling to prioritize the vulnerabilities for remediation, as there are many factors to consider, including the threat of the vulnerability and the potential remediation option itself.

      Our Advice

      Critical Insight

      • Patches are often considered the only answer to vulnerabilities, but these are not always the most suitable solution.
      • Vulnerability management does not equal patch management. It includes identifying and assessing the risk of the vulnerability, and then selecting a remediation option which goes beyond just patching alone.
      • There is more than one way to tackle the problem. Leverage your existing security controls to protect the organization.

      Impact and Result

      • After this blueprint, you will have created a full vulnerability management program that allows you to take a risk-based approach to vulnerability remediation.
      • Assessing a vulnerability’s risk will enable you to properly determine the true urgency of a vulnerability within the context of your organization; this ensures you are not just blindly following what the tool is reporting.
      • The risk-based approach allows you to prioritize your discovered vulnerabilities and take immediate action on critical and high vulnerabilities, while allowing your standard remediation cycle to address the medium to low vulnerabilities.
      • With your program defined and developed, you now need to configure your vulnerability scanning tool, or acquire one if you don’t already have a tool in place.
      • Lastly, while vulnerability management will help address your systems and applications, how do you know if you are secure from external malicious actors? Penetration testing will offer visibility, allowing you to plug those holes and attain an environment with a smaller risk surface.

      Implement Risk-Based Vulnerability Management Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should design and implement a vulnerability management program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Implement Risk-Based Vulnerability Management – Phases 1-4

      1. Identify vulnerability sources

      Begin the project by creating a vulnerability management team and determine how vulnerabilities will be identified through scanners, penetration tests, third-party sources, and incidents.

      • Vulnerability Management SOP Template

      2. Triage vulnerabilities and assign priorities

      Determine how vulnerabilities will be triaged and evaluated based on intrinsic qualities and how they may compromise business functions and data sensitivity.

      • Vulnerability Tracking Tool
      • Vulnerability Management Risk Assessment Tool
      • Vulnerability Management Workflow (Visio)
      • Vulnerability Management Workflow (PDF)

      3. Remediate vulnerabilities

      Address the vulnerabilities based on their level of risk. Patching isn't the only risk mitigation action; some systems simply cannot be patched, but other options are available. Reduce the risk down to medium/low levels and engage your regular operational processes to deal with the latter.

       

      4. Measure and formalize

      Evolve the program continually by developing metrics and formalizing a policy.

      • Vulnerability Management Policy Template
      • Vulnerability Scanning Tool RFP Template
      • Penetration Test RFP Template

      Infographic

      Workshop: Implement Risk-Based Vulnerability Management

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Vulnerability Sources

      The Purpose

      Establish a common understanding of vulnerability management, and define the roles, scope, and information sources of vulnerability detection.

      Key Benefits Achieved

      Attain visibility on all of the vulnerability information sources, and a common understanding of vulnerability management and its scope.

      Activities

      1.1 Define the scope & boundary of your organization’s security program.

      1.2 Assign responsibility for vulnerability identification and remediation.

      1.3 Develop a monitoring and review process of third-party vulnerability sources.

      1.4 Review incident management and vulnerability management

      Outputs

      Defined scope and boundaries of the IT security program

      Roles and responsibilities defined for member groups

      Process for review of third-party vulnerability sources

      Alignment of vulnerability management program with existing incident management processes

      2 Triage and Prioritize

      The Purpose

      We will examine the elements that you will use to triage and analyze vulnerabilities, prioritizing using a risk-based approach and prepare for remediation options.

      Key Benefits Achieved

      A consistent, documented process for the evaluation of vulnerabilities in your environment.

      Activities

      2.1 Evaluate your identified vulnerabilities.

      2.2 Determine high-level business criticality.

      2.3 Determine your high-level data classifications.

      2.4 Document your defense-in-depth controls.

      2.5 Build a classification scheme to consistently assess impact.

      2.6 Build a classification scheme to consistently assess likelihood.

      Outputs

      Adjusted workflow to reflect your current processes

      List of business operations and their criticality and impact to the business

      Adjusted workflow to reflect your current processes

      List of defense-in-depth controls

      Vulnerability Management Risk Assessment tool formatted to your organization

      Vulnerability Management Risk Assessment tool formatted to your organization

      3 Remediate Vulnerabilities

      The Purpose

      Identifying potential remediation options.

      Developing criteria for each option in regard to when to use and when to avoid.

      Establishing exception procedure for testing and remediation.

      Documenting the implementation of remediation and verification.

      Key Benefits Achieved

      Identifying and selecting the remediation option to be used

      Determining what to do when a patch or update is not available

      Scheduling and executing the remediation activity

      Planning continuous improvement

      Activities

      3.1 Develop risk and remediation action.

      Outputs

      List of remediation options sorted into “when to use” and “when to avoid” lists

      4 Measure and Formalize

      The Purpose

      You will determine what ought to be measured to track the success of your vulnerability management program.

      If you lack a scanning tool this phase will help you determine tool selection.

      Lastly, penetration testing is a good next step to consider once you have your vulnerability management program well underway.

      Key Benefits Achieved

      Outline of metrics that you can then configure your vulnerability scanning tool to report on.

      Development of an inaugural policy covering vulnerability management.

      The provisions needed for you to create and deploy an RFP for a vulnerability management tool.

      An understanding of penetration testing, and guidance on how to get started if there is interest to do so.

      Activities

      4.1 Measure your program with metrics, KPIs, and CSFs.

      4.2 Update the vulnerability management policy.

      4.3 Create an RFP for vulnerability scanning tools.

      4.4 Create an RFP for penetration tests.

      Outputs

      List of relevant metrics to track, and the KPIs, CSFs, and business goals for.

      Completed Vulnerability Management Policy

      Completed Request for Proposal (RFP) document that can be distributed to vendor proponents

      Completed Request for Proposal (RFP) document that can be distributed to vendor proponents

      Further reading

      Implement Risk-Based Vulnerability Management

      Get off the patching merry-go-round and start mitigating risk!

      Table of Contents

      4 Analyst Perspective

      5 Executive Summary

      6 Common Obstacles

      8 Risk-based approach to vulnerability management

      16 Step 1.1: Vulnerability management defined

      24 Step 1.2: Defining scope and roles

      34 Step 1.3: Cloud considerations for vulnerability management

      33 Step 1.4: Vulnerability detection

      46 Step 2.1: Triage vulnerabilities

      51 Step 2.2: Determine high-level business criticality

      56 Step 2.3: Consider current security posture

      61 Step 2.4: Risk assessment of vulnerabilities

      71 Step 3.1: Assessing remediation options

      Table of Contents

      80 Step 3.2: Scheduling and executing remediation

      85 Step 3.3: Continuous improvement

      89 Step 4.1: Metrics, KPIs, and CSFs

      94 Step 4.2: Vulnerability management policy

      97 Step 4.3: Select & implement a scanning tool

      107 Step 4.4: Penetration testing

      118 Summary of accomplishment

      119 Additional Support

      120 Bibliography

      Analyst Perspective

      Vulnerabilities will always be present. Know the unknowns!

      In this age of discovery, technology changes at such a rapid pace. New things are discovered, both in new technology and in old. The pace of change can often be very confusing as to where to start and what to do.

      The ever-changing nature of technology means that vulnerabilities will always be present. Taking measures to address these completely will consume all your department’s time and resources. That, and your efforts will quickly become stale as new vulnerabilities are uncovered. Besides, what about the systems that simply can’t be patched? The key is to understand the vulnerabilities and the levels of risk they pose to your organization, to prioritize effectively and to look beyond patching.

      A risk-based approach to vulnerability management will ensure you are prioritizing appropriately and protecting the business. Reduce the risk surface!

      Vulnerability management is more than just systems and application patching. It is a full process that includes patching, compensating controls, segmentation, segregation, and heightened diligence in security monitoring.

      Jimmy Tom, Research Advisor – Security, Privacy, Risk, and Compliance, Info-Tech Research Group. Jimmy Tom
      Research Advisor – Security, Privacy, Risk, and Compliance
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Vulnerability scanners, industry alerts, and penetration tests are revealing more and more vulnerabilities, and it is unclear how to manage them.

      Organizations are struggling to prioritize the vulnerabilities for remediation, as there are many factors to consider, including the threat of the vulnerability and the potential remediation option.

      Common Obstacles

      Patches are often seen as the answer to vulnerabilities, but these are not always the most suitable solution.

      Some systems deemed vulnerable simply cannot be patched or easily replaced.

      Companies are unaware of the risk implications that come from leaving the vulnerability open and from the remediation option itself.

      Info-Tech’s Approach

      Design and implement a vulnerability management program that identifies, prioritizes, and remediates vulnerabilities.

      Understand what needs to be considered when implementing remediation options, including patches, configuration changes, and defense-in-depth controls.

      Build a process that is easy to understand and allows vulnerabilities to be remediated proactively, instead of in an ad hoc fashion.

      Info-Tech Insight

      Vulnerability management does not always equal patch management. There is more than one way to tackle the problem, particularly if a system cannot be easily patched or replaced. If a vulnerability cannot be completely remediated, steps to reduce the risk to a tolerable level must be taken.

      Common obstacles

      These barriers make vulnerability management difficult to address for many organizations:
      • The value of vulnerability management is not well articulated in many organizations. As a result, investment in vulnerability scanning technology is often insufficient.
      • Many organizations feel that a “patch everything” approach is the most effective path.
      • Vulnerability management is commonly misunderstood as being a process that only supports patch management.
      • There is often misalignment between SecOps and ITOps in remediation action and priority, affecting the timeliness of remediation.
      CVSS Score Distribution From the National Vulnerability Database: Pie Charts presenting the CVSS Core Distribution for the National Vulnerability Database. The left circle represents 'V3' and the right 'V2', where V3 has an extra option for 'Critical', above 'High', 'Medium', and 'Low', and V2 does not.
      (Source: NIST National Vulnerability Database Dashboard)

      Leverage risk to sort, triage, and prioritize vulnerabilities

      Reduce your risk surface to avoid cost to your business; everything else is table stakes.

      Reduce the critical and high vulnerabilities below the risk threshold and operationalize the remediation of medium/low vulnerabilities by following your effective vulnerability management program cycles.

      Identify vulnerability sources

      An inventory of your scanning tool and vulnerability threat intelligence data sources will help you determine a viable strategy for addressing vulnerabilities. Defining roles and responsibilities ahead of time will ensure you are not left scrambling when dealing with vulnerabilities.

      Triage and prioritize

      Bring the vulnerabilities into context by assessing vulnerabilities based on your security posture and mechanisms and not just what your data sources report. This will allow you to gauge the true urgency of the vulnerabilities based on risk and determine an effective mitigation plan.

      Remediate vulnerabilities

      Address the vulnerabilities based on their level of risk. Patching isn't the only risk mitigation action; some systems simply cannot be patched, but other options are available.

      Reduce the risk down to medium/low levels and engage your regular operational processes to deal with the latter.

      Measure and formalize

      Upon implementation of the program, measure with metrics to ensure that the program is successful. Improve the program with each iteration of vulnerability mitigation to ensure continuous improvement.

      Tactical Insight 1

      All actions to address vulnerabilities should be based on risk and the organization’s established risk tolerance.

      Tactical Insight 2

      Reduce the risk surface down below the risk threshold.

      The industry has shifted to a risk-based approach

      Traditional vulnerability management is no longer viable.

      “For those of us in the vulnerability management space, ensuring that money, resources, and time are strategically spent is both imperative and difficult. Resources are dwindling fast, but the vulnerability problem sure isn’t.” (Kenna Security)

      “Using vulnerability scanners to identify unpatched software is no longer enough. Keeping devices, networks, and digital assets safe takes a much broader, risk-based vulnerability management strategy – one that includes vulnerability assessment and mitigation actions that touch the entire ecosystem.” (Balbix)

      “Unlike legacy vulnerability management, risk-based vulnerability management goes beyond just discovering vulnerabilities. It helps you understand vulnerability risks with threat context and insight into potential business impact.” (Tenable)

      “A common mistake when prioritizing patching is equating a vulnerability’s Common Vulnerability Scoring System (CVSS) score with risk. Although CVSS scores can provide useful insight into the anatomy of a vulnerability and how it might behave if weaponized, they are standardized and thus don’t reflect either of the highly situational variables — namely, weaponization likelihood and potential impact — that factor into the risk the vulnerability poses to an organization.” (SecurityWeek)

      Why a take risk-based approach?

      Vulnerabilities, by the numbers

      60% — In 2019, 60% of breaches were due to unpatched vulnerabilities.

      74% — In the same survey, 74% of survey responses said they cannot take down critical applications and systems to patch them quickly. (Source: SecurityBoulevard, 2019)

      Info-Tech Insight

      Taking a risk-based approach will allow you to focus on mitigating risk, rather than “just patching” your environment.

      The average cost of a breach in 2020 is $3.86 million, and “…the price tag was much less for mature companies and industries and far higher for firms that had lackluster security automation and incident response processes.” (Dark Reading)

      Vulnerability Management

      A risk-based approach

      Reduce the risk surface to avoid cost to your business, everything else is table stakes

      Logo for Info-Tech.
      Logo for #iTRG.

      1

      Identify

      4

      Address

        Mitigate the risk surface by reducing the time across the phases › Mitigate the risk by implementing:
      • patch systems & apps
      • compensating controls
      • systems and apps hardening
      • systems segregation
      Chart presenting an example of 'Risk Surface' with the axes 'Risk Level' and 'Time' with lines created by individual risks. The highlighted line begins in 'Critical' and eventually drops to low. The area between the line and your organization's risk tolerance is labelled 'Risk Surface'.

      Objective: reduce risk surface by reducing time to address

      Your organization's risk tolerance threshold

        Identify vulnerability management scanning tools & external threat intel sources (Mitre CVE, US-CERT, vendor alerts, etc.) Vulnerability information feeds:
      • scanning tool
      • external threat intel
      • internal threat intel

      2

      Analyze

        Assign actual risk (impact x urgency) to the organization based on current security posture

      Triage based on risk ›

      Your organization's risk tolerance threshold

      Risk tolerance threshold map with axes 'Impact' and 'Likelihood'. High levels of one and low levels of the other, or medium levels of both, is 'Medium', High level of one and Medium levels of the other is 'High', and High levels of both is 'Critical'.

      3

      Assess

        Plan risk mitigation strategy › Consider:
      • risk tolerance
      • compensating controls
      • business impact

      Info-Tech’s vulnerability management methodology

      Focus on developing the most efficient processes.

      Vulnerability management isn’t “old school.”

      The vulnerability management market is relatively mature; however, vulnerability management remains a very relevant and challenging topic.

      Security practitioners are inundated with the advice they need to prioritize their vulnerabilities. Every vulnerability scanning vendor will proclaim their ability to prioritize the identified vulnerabilities.

      Third-party prioritization methodology can’t be effectively applied across all organizations. Each organization is too unique with different constraints. No tool or service can account for these variables.

      Equation to find 'Vulnerability Priority'.

      When patching is not possible, other options exist: configuration changes (hardening), defense-in-depth, compensating controls, and even elevated security monitoring are possible options.

      Info-Tech Insight

      Vulnerability management is not only patch management. Patching is only one aspect.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Key deliverable:

      Vulnerability Management SOP

      The Standard operating procedure (SOP) will comprise the end-to-end description of the program: roles & responsibilities, data flow, and expected outcomes of the program.

      Sample of the key deliverable, Vulnerability Management SOP.
      Vulnerability Management Policy

      Template for your vulnerability management policy.

      Sample of the Vulnerability Management Policy blueprint. Vulnerability Tracking Tool

      This tool offers a template to track vulnerabilities and how they are remedied.

      Sample of the Vulnerability Tracking Tool blueprint.
      Vulnerability Scanning RFP Template

      Request for proposal template for the selection of a vulnerability scanning tool.

      Sample of the Vulnerability Scanning RFP Template blueprint. Vulnerability Risk Assessment Tool

      Methodology to assess vulnerability risk by determining impact and likelihood.

      Sample of the Vulnerability Risk Assessment Tool blueprint.

      Blueprint benefits

      IT Benefits

      • A standardized, consistent methodology to assess, prioritize, and remediate vulnerabilities.
      • A risk-based approach that aligns with what’s important to the business.
      • A way of dealing with the high volumes of vulnerabilities that your scanning tool is reporting.
      • Identification of “where to start” in terms of vulnerability management.
      • Ability to not lose yourself in the patch madness but rather take a sound approach to scheduling and prioritizing patches and updates.
      • Knowledge of what to do when patching is simply not possible or feasible.

      Business Benefits

      • Alignment with IT in ensuring that business processes are only interrupted when absolutely necessary while maintaining a regular cadence of vulnerability remediation.
      • A consistent program that the business can plan around and predict when interruptions will occur.
      • IT’s new approach being integrated with existing IT operations processes, offering the most efficient yet expedient method of dealing with vulnerabilities.

      Info-Tech’s process can save significant financial resources

      Phase Measured Value
      Phase 1: Identify vulnerability sources
        Define the process, scope, roles, vulnerability sources, and current state
        • Consultant at $100 an hour for 16 hours = $1,600
      Phase 2: Triage vulnerabilities and assign urgencies
        Establish triaging and vulnerability evaluation process
        • Consultant at $100 an hour for 16 hours = $1,600
        Determine high-level business criticality and data classifications
        • Consultant at $100 an hour for 40 hours = $4,000
        Assign urgencies to vulnerabilities
        • Consultant at $100 an hour for 8 hours = $800
      Phase 3: Remediate vulnerabilities
        Prepare documentation for the vulnerability process
        • Consultant at $100 an hour for 8 hours = $800
        Establish defense-in-depth modelling
        • Consultant at $100 an hour for 24 hours = $2,400
        Identify remediation options and establish criteria for use
        • Consultant at $100 an hour for 40 hours = $4,000
        Formalize backup and testing procedures, including exceptions
        • Consultant at $100 an hour for 8 hours = $800
        Remediate vulnerabilities and verify
        • Consultant at $100 an hour for 24 hours = $2,400
      Phase 4: Continually improve the vulnerability management process
        Establish a metrics program for vulnerability management
        • Consultant at $100 an hour for 16 hours = $1,600
        Update vulnerability management policy
        • Consultant at $100 an hour for 8 hours = $800
        Develop a vulnerability scanning tool RFP
        • Consultant at $100 an hour for 40 hours = $4,000
        Develop a penetration test RFP
        • Consultant at $100 an hour for 40 hours = $4,000
      Potential financial savings from using Info-Tech resources Phase 1 ($1,600) + Phase 2 ($6,400) + Phase 3 ($10,400) + Phase 4 ($10,400) = $28,800

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

      What does a typical GI on this topic look like?

      Phase 1

      Phase 2

      Phase 3

      Phase 4

      Call #1: Scope requirements, objectives, and your specific challenges.

      Call #2: Discuss current state and vulnerability sources.

      Call #3: Identify triage methods and business criticality.

      Call #4:Review current defense-in-depth and discuss risk assessment.

      Call #5: Discuss remediation options and scheduling.

      Call #6: Review release and change management and continuous improvement.

      Call #7: Identify metrics, KPIs, and CSFs.

      Call #8: Review vulnerability management policy.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

        Day 1 Day 2 Day 3 Day 4 Day 5
      Activities
      Identify vulnerability sources

      1.1 What is vulnerability management?

      1.2 Define scope and roles

      1.3 Cloud considerations for vulnerability management

      1.4 Vulnerability detection

      Triage and prioritize

      2.1 Triage vulnerabilities

      2.2 Determine high-level business criticality

      2.3 Consider current security posture

      2.4 Risk assessment of vulnerabilities

      Remediate vulnerabilities

      3.1 Assess remediation options

      3.2 Schedule and execute remediation

      3.3 Drive continuous improvement

      Measure and formalize

      4.1 Metrics, KPIs & CSFs

      4.2 Vulnerability Management Policy

      4.3 Select & implement a scanning tool

      4.4 Penetration testing

      Next Steps and Wrap-Up (offsite)

      5.1 Complete in-progress deliverables from previous four days

      5.2 Set up review time for workshop deliverables and to discuss next steps

      Deliverables
      1. Scope and boundary definition of vulnerability management program
      2. Responsibility assignment for vulnerability identification and remediation
      3. Monitoring and review process of third-party vulnerability sources
      4. Incident management and vulnerability convergence
      1. Methodology for evaluating identified vulnerabilities
      2. Identification of high-level business criticality
      3. Defined high-level data classifications
      4. Documented defense-in-depth controls
      5. Risk assessment criteria for impact and likelihood
      1. Documented risk assessment methodology and remediation options
      1. Defined metrics, key performance indicators (KPIs), and critical success factors (CSFs)
      2. Initial draft of vulnerability management policy
      3. Scanning tool selection criteria
      4. Introduction to penetration testing
      1. Completed vulnerability management standard operating procedure
      2. Defined vulnerability management risk assessment criteria
      3. Vulnerability management policy draft

      Implement Risk-Based Vulnerability Management

      Phase 1

      Identify Vulnerability Sources

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      Establish a common understanding of vulnerability management, define the roles, scope, and information sources of vulnerability detection.

      This phase involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Step 1.1

      Vulnerability Management Defined

      Activities

      None for this section

      This step will walk you through the following activities:

      Establish a common understanding of vulnerability management and its place in the IT organization.

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Foundational knowledge of vulnerability management in your organization.

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      What is vulnerability management?

      It’s more than just patching.

      • Vulnerability management is the regular and ongoing practice of scanning an operating environment to uncover vulnerabilities. These vulnerabilities can be outdated applications, unpatched operating systems and software, open ports, obsolete hardware, or any combination of these.
      • The scanning and detection of vulnerabilities is the first step. Planning and executing of remediation is next, along with the approach, prioritized sequence of events, and timing.
      • A vendor-supplied software patch or firmware update is often the easy answer, however, this is not always a viable solution. What if you can’t patch in a timely fashion? What if patching is not possible as it will break the application and bring down operations? What if no patch exists due to the age of the application or operating platform?

      “Most organizations do not have a formal process for vulnerability management.” (Morey Haber, VP of Technology, BeyondTrust, 2016)

      Effective vulnerability management

      It’s not easy, but it’s much harder without a process in place.
      • Effective vulnerability management requires a formal process for organizations to follow; without one, vulnerabilities are dealt with in an ad hoc fashion.
      • Patching isn’t the only solution, but it’s the one that often draws focus.
      • Responsibilities for the different aspects of vulnerability management are often unclear, such as for testing, remediation, and implementation.
      • Identifying new threats without proper vulnerability scanning tools can be a near-impossible task.
      • Determining which vulnerabilities are most urgent can be an inconsistent process, increasing the organizational risk.
      • Measuring the effectiveness of your vulnerability remediation activities can help you better manage resources in SecOps and ITOps. Your staff will be spending the appropriate effort on vulnerabilities that warrant that level of attention.

      You’re not just doing this for yourself. It’s also for your auditors.

      Many compliance and regulatory obligations require organizations to have thorough documentation of their vulnerability management practices.

      Vulnerability management revolves around your asset security services

      Diagram with 'Asset Security Services' at the center. On either side are 'Network Security Services' and 'Identity Security Services', all three of which flow up into 'Security Analytics | Security Incident Response', and all four share a symbiotic flow with 'Management' below and contribute to 'Mega Trend Mapping' above. Management is supported by 'Governance'. Vulnerabilities can be found primarily within your assets but also connect to your information risk management. These must be effectively managed as part of a holistic security program.

      Without management, vulnerabilities left unattended can be easy for attackers to exploit. It becomes difficult to identify the correct remediation option to mitigate against the vulnerabilities.

      Vulnerability management works in tandem with SecOps and ITOps

      Vulnerability Management Process Inputs/Outputs:
      'Vulnerability Management (Process and Tool)' outputs are 'Incident Management', 'Release Management', 'Change Management', 'IT Asset Management', 'Application Security Testing', 'Threat Intelligence', and 'Security Risk Management'; inputs are 'Vulnerability Disclosure', 'Threat Intelligence', and 'Security Risk Management'.

      Arrows denote direction of information feed

      Vulnerability management serves as the input into a number of processes for remediation, including:
      • Incident management, to deal with issues
      • Release management, for patch management
      • Change management, for change control
      • IT asset management, to track version information, e.g. for patching
      • Application security testing, for the verification of vulnerabilities

      A two-way data flow exists between vulnerability management and:

      • Security risk management, for the overall risk posture of the organization
      • Threat intelligence, as vulnerability management reveals only one of several threat vectors

      For additional information please refer to Info-Tech’s research for each area:

      • Vulnerability management can leverage your existing processes to gain an operational element for the program.
      • As you strive to mature each of the processes on their own, vulnerability management will benefit accordingly.
      • Review our research for each of these areas and speak to one of our analysts if you wish to improve any of the listed processes.

      Info-Tech’s Information Security Program Framework

      Vulnerability management is a component of the Infrastructure Security section of Security Management

      Information Security Framework with Level 1 and Level 2 capabilities in two main sections, 'Management' and 'Governance'. Level 2 capabilities are grouped within Level 1 capabilities. For more information, review our Build an Information Security Strategy blueprint, or speak to one of our analysts.

      Info-Tech Insight

      Vulnerability management is but one piece of the information security puzzle. Ensure that you have all the pieces!

      Case Study

      Logo for Cimpress.
      INDUSTRY: Manufacturing
      SOURCE: Cimpress, 2016

      One organization is seeing immediate benefits by formalizing its vulnerability management program.

      Challenge

      Cimpress was dealing with many challenges in regards to vulnerability management. Vulnerability scanning tools were used, but the reports that were generated often gave multiple vulnerabilities that were seen as critical or high and required many resources to help address them. Scanning was done primarily in an attempt to adhere to PCI compliance rather than to effectively enable security. After re-running some scans, Cimpress saw that some vulnerabilities had existed for an extended time period but were deemed acceptable.

      Solution

      The Director of Information Security realized that there was a need to greatly improve this current process. Guidelines and policies were formalized that communicated when scans should occur and what the expectations for remediations should be. Cimpress also built a tiered approach to prioritize vulnerabilities for remediation that is specific to Cimpress instead of relying on scanning tool reports.

      Results

      Cimpress found better management of the vulnerabilities within its system. There was no pushback to the adoption of the policies, and across the worldwide offices, business units have been proactively trying to understand if there are vulnerabilities. Vulnerability management has been expanded to vendors and is taken into consideration when doing any mergers and acquisitions. Cimpress continues to expand its program for vulnerability management to include application development and vulnerabilities within any existing legacy systems.

      Step 1.2

      Defining the scope and roles

      Activities
      • 1.2.1 Define the scope and boundary of your organization’s security program
      • 1.2.2 Assign responsibility for vulnerability identification and remediation

      This step will walk you through the following activities:

      Define and understand the scope and boundary of the security program. For example, does it include OT? Define roles and responsibilities for vulnerability identification and remediation

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Understand how far vulnerability management extends and what role each person in IT plays in the remediation of vulnerabilities

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Determine the scope of your security program

      This will help you adjust the depth and breadth of your vulnerability management program.
      • Determining the scope will help you decide how much organizational risk the vulnerability management program will oversee.
      • Scope can be defined along four aspects:
        • Data Scope – What data elements in your organization does your security program cover? How is data classified?
        • Physical Scope – What physical scope, such as geographies, does the security program cover?
        • Organizational Scope – How are business units engaged with security initiatives? Does the scope cover all subsidiary organizations?
        • IT Scope – What parts of the organization does IT cover? Does their coverage include operational technology (OT) and industrial control systems (ICS)?
      Stock image of figures standing in connected circles.

      1.2.1 Define the scope and boundary of your organization’s security program

      60 minutes

      Input: List of Data Scope, Physical Scope, Organization Scope, and IT Scope

      Output: Defined scope and boundaries of the IT security program

      Materials: Whiteboard/Flip Charts, Sticky Notes, Markers, Vulnerability Management SOP Template

      Participants: Business stakeholders, IT leaders, Security team members

      1. On a whiteboard, write the headers: Data Scope, Physical Scope, Organizational Scope, and IT Scope.
      2. Give each group member a handful of sticky notes. Ask them to write down as many items as possible for the organization that could fall under one of the four scope buckets.
      3. In a group, discuss the sticky notes and the rationale for including them. Discuss your security-related locations, data, people, and technologies, and define their scope and boundaries.

      The goal is to identify what your vulnerability management program is responsible for and document it.

      Consider the following:

      How is data being categorized and classified? How are business units engaged with security initiatives? How are IT systems connected to each other? How are physical locations functioning in terms of information security management?

      Download the Vulnerability Management SOP Template

      Assets are part of the scope definition

      An inventory of IT assets is necessary if there is to be effective vulnerability management.

      • Organizations need an up-to-date and comprehensive asset inventory for vulnerability management. This is due to multiple reasons:
        • When vulnerabilities are announced, they will need to be compared to an inventory to determine if the organization has any relevant systems or versions.
        • It indicates where all IT assets can be found both physically and logically.
        • Asset inventories typically have owners assigned to the assets and systems whose responsibility it is to carry out remediations for vulnerabilities.
      • Furthermore, asset inventories can provide insight into where data can be found within the organization. This is extremely useful within a formal data classification program, which plays a large factor in vulnerability management.
      If you need assistance building your asset inventory, review Info-Tech’s Implement Hardware Asset Management and Implement Software Asset Management blueprints.

      Info-Tech Insight

      Create a formal IT asset inventory before continuing with the rest of this project. Otherwise, you risk being at the mercy of a weak vulnerability management program.

      Assign responsibility for vulnerability identification and remediation

      Determine who is critical to effectively detecting and managing vulnerabilities.
      • Some of the remediation steps will involve members of IT management to identify the true organizational risk of a vulnerability.
      • Vulnerability remediation comes in different shapes and sizes. In addition to patching, this can include implementing compensating controls, server and application hardening, or the segregating of vulnerable systems.
        • Who carries out each of these activities? Who coordinates the activities and tracks them to ensure completion?
      • The people involved may be members outside of the security team, such as members from IT operations, infrastructure, and applications. The specific roles that each of these groups play should be clearly identified.
      Stock image of many connected profile photos in a cloud network.

      1.2.2 Assign responsibility for vulnerability identification and remediation

      60 minutes

      Input: Sample list of vulnerabilities and requisite actions from each group, High-level organizational chart with area functions

      Output: Defined set of roles and responsibilities for member groups

      Materials: Vulnerability Management SOP Template

      Participants: CIO, CISO, IT Management representatives for each area of IT

      1. Display the table of responsibilities that need to be assigned.
      2. List all the positions within the IT security team.
      3. Map these to the positions that require IT security team members.
      4. List all positions that are part of the IT team.
      5. Map these to the positions that require IT team members.

      If your organization does not have a dedicated IT security team, you can perform this exercise by mapping the relevant IT staff to the different positions shown on the right.

      Download the Vulnerability Management SOP Template Sample of the Roles and Responsibilities table from the Vulnerability Management SOP Template.

      Step 1.3

      Cloud considerations for vulnerability management

      Activities

      None for this section.

      This step will walk you through the following activities:

      Review cloud considerations for vulnerability management

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Understand the various types of cloud offerings and the implications (and limitations) of vulnerability management in a cloud environment.

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Cloud considerations

      Cloud will change your approach to vulnerability management.
      • There will be a heavy dependence on the cloud service provider to ensure that vulnerabilities in their foundational technologies have been addressed.
      • Depending on the level of “as-a-Service,” customers will have varying degrees of control and visibility into the underlying operations.
      • With vendor acquiescence, you can set your tool to scan a given cloud environment, depending on how much visibility you have into their environment based on the service you have purchased.
      • Due to compliance obligations of their customers, there is a growing trend among cloud providers to allow more scanning of cloud environments.
      • In the absence of customer scanning capability, vendors may offer attestation of vulnerability management and remediation.
      Table outlining who has control, between the 'Organization' and the 'Vendor', of different cloud capabilities in different cloud strategies.

      For more information, see Info-Tech Research Group’s Document Your Cloud Strategy blueprint.

      Cloud environment scanning

      Cloud scanning is becoming a more common necessity but still requires special consideration.

      An organization’s cloud environment is just an extension of its own environment. As such, cloud environments need to be scanned for vulnerabilities.

      Private Cloud
      If your organization owns a private cloud, these environments can be tested normally.
      Public Cloud
      Performing vulnerability testing against public, third-party cloud environments is an area experiencing rapid growth and general acceptance, although customer visibility will still be limited.

      In many cases, a customer must rely on the vendor’s assurance that vulnerabilities are being addressed in a sufficient manner.

      Security standards’ compliance requirements are driving the need for cloud suppliers to validate and assure that they are appropriately scanning for and remediating vulnerabilities.

      Infrastructure- or Platform-as-a-Service (IaaS or PaaS) Environments
      • There is a general trend for PaaS and IaaS vendors to allow testing if given due notice.
      • Your contract with the cloud vendor or the vendor’s terms and conditions will outline the permissibility of customer vulnerability scanning. In some cases, a cloud vendor will deny the ability to do vulnerability scanning if they already provide a solution as part of their service.
      • Always ensure that the vendor is aware of your vulnerability scanning activity so that false positives aren’t triggering their security measures as possible denial-of-service (DoS) attacks.
      Software-as-a-Service (SaaS) Environments
      • SaaS offers very limited visibility to the services behind the software that the customer sees. You therefore cannot test for patch levels or vulnerabilities.
      • SaaS customers must rely exclusively on the provider for the regular scanning and remediation of vulnerabilities in the back-end technologies supporting the SaaS application.
      • You can only test the connection points to SaaS environments. This involves trying to figure out what you can see, e.g. looking for encrypted traffic.

      Certain testing (e.g. DoS or load testing) will be very limited by your cloud vendor. Cloud vendors won’t open themselves to testing that would possibly impact their operations.

      Step 1.4

      Vulnerability detection

      Activities
      • 1.4.1 Develop a monitoring and review process of third-party vulnerability sources
      • 1.4.2 Incident management and vulnerability management

      This step will walk you through the following activities:

      Create an inventory of your vulnerability monitoring capability and third-party vulnerability information sources.

      Determine how incident management and vulnerability management interoperate.

      This step involves the following participants:

      • Security operations team
      • IT Security Manager
      • IT Director
      • CISO

      Outcomes of this step

      Catalog of vulnerability information data sources. Understanding of the intersection of incident management and vulnerability management.

      Identify vulnerability sources
      Step 1.1 Step 1.2 Step 1.3 Step 1.4

      Vulnerability detection

      Vulnerabilities can be identified through numerous mediums.

      Info-Tech has determined the following to be the four most common ways to identify vulnerabilities.

      Vulnerability Assessment and Scanning Tools
      • Computer programs that function to identify and assess security vulnerabilities and weaknesses within computers, computer systems, applications, or networks.
      • Using a known vulnerability database, the tool scans targeted hosts or systems to identify flaws and generate reports and recommendations based on the results.
      • There are four main types of tools under this category: network and operating system vulnerability scanners, application scanning and testing tools, web application scanners, and exploitation tools.
      Penetration Tests
      • The act of identifying vulnerabilities on computers, computer systems, applications, or networks followed by testing of the vulnerability to validate the findings.
      • Penetration tests are considered a service that is offered by third-parties in which a variety of products, tools, and methods are used to exploit systems and gain access to data.
      Open Source Monitoring
      • New vulnerabilities are detected daily with each vulnerability’s information being uploaded to an information-sharing platform to enable other organizations to be able to identify the same vulnerability on their systems.
      • Open source platforms are used to alert and distribute information on newly discovered vulnerabilities to security professionals.
      Security Incidents
      • Any time an incident response plan is called into action to mitigate an incident, there should be formal communication with the vulnerability management team.
      • Any IT incident an organization experiences should provide a feed for analysis into your vulnerability management program.

      Automate with a vulnerability scanning tool

      Vulnerabilities are too numerous for manual scanning and detection.
      • Vulnerability management is not only the awareness of the existence of vulnerabilities but that they are actively present in your environment.
      • A vulnerability scanner will usually report dozens, if not hundreds, of vulnerabilities on a regular and recurring basis. Typical IT environments have several dozen, if not hundreds, of servers. We haven’t even considered the amount of network equipment or the hundreds of user workstations in an environment.
      • This tool will give you information of the presence of a vulnerability in your environment and the host on which the vulnerability exists. This includes information on the version of software that contains a vulnerability and whether you are running that version. The tool will also report on the criticality of the vulnerability based on industry criticality ratings.
      • The tools are continually updated by the vendor with the latest definition updates for the latest vulnerabilities out there. This ensures you are always scanning for the greatest number of potential vulnerabilities.
      Automation requires oversight.
      1. Vulnerability scanners bring great automation to the task of scanning and detecting vulnerabilities in high numbers.
      2. Vulnerability scanners, however, do not have your level of intelligence. Any compensating controls, network segregation, or other risk mitigation features that you have in place will not be known by the tool.
      3. Determining the risk and urgency of a vulnerability within the context of your specific environment will still require internal review by you or your SecOps team.

      For guidance on tool selection

      Refer to section 4.3 Selecting and Implement a Scanning Tool in this blueprint.

      Vulnerability scanning tool considerations

      Select a vulnerability scanning tool with the features you need to be effective.
      • Vulnerability scanning tool selection can be an exciting and confusing process. You will need to consider what features you desire in a tool and whether you want the tool to go beyond just scanning and reporting.
      • In addition to vulnerability scanning, some tools will integrate with your IT service management (service desk ticketing system) tool and asset, configuration, and change management modules. This can facilitate the necessary workflow that the remediation process follows once a vulnerability is discovered.
      • A number of vulnerability scanning tool vendors have started offering remediation as part of their software features. This includes the automation and orchestration functionality and configuration and asset management to track its remediation activities.
      • A side benefit of the asset discovery feature in vulnerability scanning tools is that it can help enhance an organization’s asset inventory and license compliance, particularly in cases where end users are able to install software on their workstations.
      Stock photo of a smartphone scanning a barcode.

      For guidance on tool vendors

      Visit SoftwareReviews for information on vulnerability management tools and vendors.

      Vulnerability scanning tool best practices

      How often should scans be performed?

      One-off scans provide snapshots in time. Repeated scans over time provide tracking for how systems are changing and how well patches are being applied and software is being updated.

      The results of a scan (asset inventory, configuration data, and vulnerability data) are basic information needed to understand your security posture. This data needs to be as up to date as possible.

      ANALYST PERSPECTIVE: Organizations should look for continuous scanning

      Continuous scanning is the concept of providing continual scanning of your systems so any asset, configuration, or vulnerability information is up to date. Most vendors will advertise continuous scanning but you need to be skeptical of how this feature is met.

      Continuous Scanning Methods

      Continuous agent scanning

      Real-time scanning that is completed through agent-based scanning. Provides real-time understanding of system changes.

      On-demand scanning

      Cyclical scanning is the method where once you’re done scanning an area, you start it again. This is usually done because doing some scans on some areas of your network take time. How long the scan takes depends on the scan itself. How often you perform a scan depends on how long a scan takes. For example, if a scan takes a day, you perform a daily scan.

      Cloud-based scanning

      Cloud-scanning-as-a-Service can provide hands-free continuous monitoring of your systems. This is usually priced as a subscription model.

      Vulnerability scanning tool best practices

      Where to perform a scan.

      What should be scanned How to point a scanner
      The general idea is that you want to scan pretty much everything. Here are considerations for three environments:
      Mobile Devices

      You need to scan mobile devices for vulnerabilities, but the problem is these can be hard to scan and often come and go on your network. There are always going to be some devices that aren’t on the network when scanning occurs.

      Several ways to scan mobile devices:

      • Intercept the device when it remotes into your network using a VPN. You catch the device with a remote scan. This can only be done if a VPN is required.
      • An agent-based approach can be used for mobile devices. Locally installed software gives the information needed to evaluate the security posture of a device. Discernibly, concerns around device processing, memory, and network bandwidth come into play. Ease of installation becomes key for agents.
      Virtualization
      • In a virtual environment, you will have servers being dynamically spun up. Ensure your tool is able to scan these new servers automatically.
      • Often, vulnerability scanning tool providers will restrict scanning to preapproved scanners. Look for tools that are preapproved by the VM vendors.
      Cloud Environments
      • You can set your tool to scan a given cloud environment. The main concern here is who owns the cloud. If it is a private cloud, there is little concern.
      • If it is a third-party cloud (AWS, Azure, etc.) you need to confirm with the cloud service provider that scanning of your cloud environment can occur.
      • There is a trend to allow more scanning of cloud environments.
      • You need to tell the scanner an IP address, a group of IP addresses, an asset group, or a combination of those.
      • You can categorize by functional classifications – internet-facing servers, workstations, network devices, etc., or by organizational structure – Finance, HR, Legal, etc.
      • If you have a strong change management system, you can better hone when and where to perform a scan based on actual changes.
      • You can set the number of concurrent outbound TCP connections that are being made. For example, set the tool so it sends out to 10 ports at a time, rather than pinging at 64k ports on a machine, which would flood the NIC.
      • Side Note: Flooding a host with pings from a scanning tool can be done to find out DoS thresholds on a machine. There are no bandwidth concerns for a network DoS, however, because the packets are so small.

      Vulnerability scanning tool best practices

      Communication and measurement

      Pre-Scan Communication With Users

      • It is always important to inform owners and users of systems that a scan will be happening.
      • Although it is unlikely any performance issues will arise, it is important to notify end users of potential impact.
      • Local admins or system owners may have controls in place that stop vulnerability scans and you need to inform the owners so that they can safelist the scanner you will be using.
      Vulnerability Scanning Tool Tracking Metrics
      • Vulnerability score by operating system, application, or organization division.
        • This provides a look at the widely accepted severity of the vulnerability as it relates across the organization’s systems.
      • Most vulnerable applications and application version.
        • This provides insight into how outdated applications are creating risk exposure for an organization.
        • This will also provide metrics on the effectiveness of your patching program.
      • Number of assets scanned within the last number of days.
        • This provides visibility into how often your assets are being scanned and thus protected.
      • Number of unowned devices or unapproved applications.
        • This metric will track how many unowned devices or unapproved applications may be on your network. Unowned devices may be rogue devices or just consultant/contractor devices.

      Third-party vulnerability information sources

      IT security forums and mailing lists are another source of vulnerability information.

      Proactively identify new vulnerabilities as they are announced.

      By monitoring for vulnerabilities as they are announced through industry alerts and open-source mechanisms, it is possible to identify vulnerabilities beyond your scanning tool’s penetration tests.

      Common sources:
      • Vendor websites and mailing lists
        • Vendors are the trusted sources for vulnerability and patch information on their products, particularly with new industry vulnerability disclosure requirements. Vendors are the most familiar with their products, downloads are most likely malware free, and additional information is often included.
        • There are some issues: vendors won’t announce a vulnerability until a patch is created, which creates a potential unknown risk exposure; numerous vendor sites will have to be monitored continually.
      • Third-party websites
        • A non-vendor site providing information on vulnerabilities. They often will cover a specific technology or an industry section, becoming a potential “one-stop shop” for some. They will often provide vulnerability information that is augmented with different remediation recommendations faster than vendors.
        • However, it’s more likely that malicious code could be downloaded and it will often not be comprehensive information on patching.
      • Third-party mailing lists, newsgroups, live paid subscriptions, and live open-source feeds
        • These are alerting and notification services for the detection and dissemination of vulnerability information. They provide information on the latest and most critical vulnerabilities, e.g. US-CERT Cybersecurity Alerts.
      • Vulnerability databases
        • These usually consist of dedicated databases on vulnerabilities. They perform the hard work of identifying and aggregating vulnerability and patch information into a central repository for end-user consumption. The commentary features on these databases provide excellent insight for practitioners, e.g. National Vulnerability Database (NVD).
      Stock photo of a student checking a bulletin board.

      Third-party vulnerability information sources

      IT security forums and mailing lists are another source of vulnerability information.

      Third-party sources for vulnerabilities

      • Open Source Vulnerability Database (OSVDB)
        • An open-source database that is run independently of any vendors.
      • Common Vulnerabilities and Exposures (CVE)
        • Free, international dictionary of publicly known information security vulnerabilities and exposures.
      • National Vulnerability Database (NVD)
        • Through NIST, the NVD is the US government’s repository of vulnerabilities and includes product names, flaws, and any impact metrics.
        • The National Checklist Repository Program (NCRP), also provided by NIST, provides security checklists for configurations of operating systems and applications.
        • The Center for Internet Security, a separate entity unrelated to NIST, provides configuration benchmarks that are often referenced by the NCRP.
      • Open Web Application Security Project (OWASP)
        • OWASP is another free project helping to expose vulnerabilities within software.
      • US-CERT National Cyber Alert System (US-CERT Alerts)
        • Cybersecurity Alerts – Provide timely information about current security issues, vulnerabilities, and exploits.
        • Cybersecurity Tips – Provide advice about common security issues for the general public.
        • Cybersecurity Bulletins – Provide weekly summaries of new vulnerabilities. Patch information is provided when available.
      • US-CERT Vulnerability Notes Database (US-CERT Vulnerability Notes)
        • Database of searchable security vulnerabilities that were deemed not critical enough to be covered under US-CERT Alerts. Note that the NVD covers both US-CERT Alerts and US-CERT Notes.
      • Open Vulnerability Assessment Language (OVAL)
        • Coding language for security professionals to discuss vulnerability checking and configuration issues. Vulnerabilities are identified using tests that are disseminated in OVAL definitions (XML executables that can be used by end users).

      1.4.1 Develop a monitoring and review process for third-party vulnerability sources

      60 minutes

      Input: Third-party resources list

      Output: Process for review of third-party vulnerability sources

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, SecOps team members, ITOps team members, CISO

      1. Identify what third-party resources are useful and relevant.
      2. Shortlist your third-party sources.
      3. Identify what is the best way to receive information from a third party.
      4. Document the method to receive or check information from the third-party source.
      5. Identify who is responsible for maintaining third-party vulnerability information sources
      6. Capture this information in the Vulnerability Management SOP Template.
      Download the Vulnerability Management SOP Template Sample of the Third Party Vulnerability Monitoring tables from the Vulnerability Management SOP Template.

      Incidents and vulnerability management

      Incidents can also be a sources of vulnerabilities.

      When any incident occurs, for example:

      • A security incident, such as malware detected on a machine
      • An IT incident, such as an application becomes unresponsive
      • A crisis occurs, like a worker accident

      There can be underlying vulnerabilities that need to be processed.

      Three Types of IT Incidents exist:
      1. Information Security Incident
      2. IT Incident and/or Problem
      3. Crisis

      Note: You need to have developed your various incident response plans to develop information feeds to the vulnerability mitigation process.
      If you are missing an incident response plan, take a look at Info-Tech’s Related Resources.

      Info-Tech Related Resources:
      If you do not have a formalized information security incident management program, take a look at Info-Tech’s blueprint Develop and Implement a Security Incident Management Program.

      If you do not have a formalized problem management process, take a look at Info-Tech’s blueprint Incident and Problem Management.

      If you do not have a formalized IT incident management process, take a look at Info-Tech’s blueprint Develop and Implement a Security Incident Management Program.

      If you do not have formalized crisis management, take a look at Info-Tech’s blueprint Implement Crisis Management Best Practices.

      1.4.2 Incident management and vulnerability management

      60 minutes

      Input: Existing incident response processes, Existing crisis communications plans

      Output: Alignment of vulnerability management program with existing incident management processes

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, SecOps team members, ITOps team members, including tiers 1, 2, and 3, CISO, CIO

      1. Inventory what incident response plans the organization has. These include:
        1. Information Security Incident Response Plan
        2. IT Incident Plan
        3. Problem Management Plan
        4. Crisis Management Plan
      2. Identify what part of those plans contains the post-response recap or final analysis.
      3. Formalize a communication process between the incident response plan and the vulnerability mitigation process.

      Note: Most incident processes will cover some sort of root cause analysis and investigation of the incident. If a vulnerability of any kind is detected within this analysis it needs to be reported on and treated as a detected vulnerability, thus warranting the full vulnerability mitigation process.

      Download the Vulnerability Management SOP Template

      Implement Risk-Based Vulnerability Management

      Phase 2

      Triage & prioritize

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      Examine the elements that you will use to triage and analyze vulnerabilities, prioritizing using a risk-based approach, and prepare for remediation options.

      This phase involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Step 2.1

      Triage vulnerabilities

      Activities
      • 2.1.1 Evaluate your identified vulnerabilities

      This step will walk you through the following activities:

      Review your vulnerability information sources and determine a methodology that will be used to consistently evaluate vulnerabilities as your scanning tool alerts you to them.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      A consistent, documented process for the evaluation of vulnerabilities in your environment.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Triaging vulnerabilities

      Use Info-Tech’s methodology to allocate urgencies to your vulnerabilities to assign the appropriate resources to each one.

      When evaluating numerous vulnerabilities, use the following three factors to help determine the urgency of vulnerabilities:

      • The intrinsic qualities of the vulnerability
      • The business criticality of the affected asset
      • The sensitivity of the data stored on the affected asset

      Intrinsic qualities of the vulnerability — Vulnerabilities need to be examined for the inherent risk they pose specifically to the organization, which includes if an exploit has been identified or if the industry views this as a serious and likely threat.

      Business criticality of the affected asset — Assets with vulnerabilities need to be assessed for their criticality to the business. Vulnerabilities on systems that are critical to business operations or customer interactions are usually top of mind.

      Sensitivity of the data of the affected asset — Beyond just the criticality of the business, there must be consideration of the sensitivity of the data that may be compromised or modified as a result of any vulnerabilities.

      Info-Tech Insight

      This methodology allows you to determine urgency of vulnerabilities, but your remediation approach needs to be risk-based, within the context of your organization.

      Triage your vulnerabilities, filter out the noise

      Triaging enables your vulnerability management program to focus on what it should focus on.

      Use the Info-Tech Vulnerability Mitigation Process Template to define how to triage vulnerabilities as they first appear.

      Triaging is an important step in vulnerability management, whether you are facing ten to tens of thousands of vulnerability notifications.
      Many scanning tools already provide the capability to compare known vulnerabilities against existing assets through integration with the asset inventory.

      There are two major use cases for this process:
      1. For organizations that have identified vulnerabilities but do not know their own systems well enough. This can be due to a lack of a formal asset inventory.
      2. For proactive organizations that are regularly staying up to date with industry announcements regarding vulnerabilities. Once an alert has been made publicly, this process can assist in confirming if the vulnerability is relevant to the organization.
      The Info-Tech methodology for initial triaging of vulnerabilities:
      Flowchart of the Info-Tech methodology for initial triaging of vulnerabilities, beginning with 'Vulnerability has been identified' and ending with either 'Vulnerability has been triaged' or 'No action needed'.

      Even if neither of these use cases apply to your organization, triaging still addresses the issues of false positives. Triaging provides a quick way to determine if vulnerabilities are relevant.

      After eliminating the noise, evaluate your vulnerabilities to determine urgency

      Consider the intrinsic risk to the organization.

      Is there an associated, verified exploit?
      • For a vulnerability to become a true threat to the organization, it must be exploited to cause damage. In today’s threat landscape, exploit kits are sold online that allow individuals with low technical knowledge to exploit a vulnerability.
      • Not all vulnerabilities have an associated exploit, but this does not mean that these vulnerabilities can be left alone. In many cases, it is just a matter of time before an exploit is created.
      • Another point to consider is that while exploits can exist theoretically, they may not be verified. Vulnerabilities always pose some level of risk, but if there are no known verified exploits, there is less risk attached.
      Is there a CVSS base score of 7.0 or higher?
      • Common Vulnerability Scoring System (CVSS) is an open-source industry scoring method to assess the potential severity of vulnerabilities.
      • CVSS takes into account: attack vector, complexity, privileges required, user interaction, scope, confidentiality impact, integrity impact, and availability impact.
      • Vulnerabilities that have a score of 4.0 or lower are classified as low vulnerabilities, while scores between 4.0 and 6.9 are put in the medium category. Scores of 7 or higher are in the high and critical categories. As we will review in the Risk Assessment section, you will want to immediately deal with high and critical vulnerabilities.
      Is there potential for significant lateral movement?
      • Even though a vulnerability may appear to be part of an inconsequential asset, it is important to consider whether it can be leveraged to gain access to other areas of the network or system by an attacker.
      • Another consideration should be whether the vulnerability can be exploited by remote or local access. Remote exploits pose a greater risk as this can mean that attackers can perform an exploit from any location. Local exploits carry less risk, although the risk of insider threats should be considered here as well.

      2.1.1 Evaluate your identified vulnerabilities

      60 minutes

      Input: Visio workflow of Info-Tech’s vulnerability management process

      Output: Adjusted workflow to reflect your current processes, Vulnerability Tracking Tool

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, SecOps team members, ITOps team members, including tiers 1, 2, and 3, CISO, CIO

      Using the criteria from the previous slide, Info-Tech has created a methodology to evaluate your vulnerabilities by examining their intrinsic qualities.

      The methodology categorizes the vulnerabilities into high, medium, and low risk importance categorizations, before assigning final urgency scores in the later steps.

      1. Review the evaluation process in the Vulnerability Management Workflow library.
      2. Determine if this process makes sense for the organization; otherwise, change the flow to include any other considerations of process flows.
      3. As this process is used to evaluate vulnerabilities, document vulnerabilities to an importance category. This can be done in the Vulnerability Tracking Tool or using a similar internal vulnerability tracking document, if one exists.

      Download the Vulnerability Management SOP Template

      Step 2.2

      Determine high-level business criticality

      Activities
      • 2.2.1 Determine high-level business criticality
      • 2.2.2 Determine your high-level data classifications

      This step will walk you through the following activities:

      Determining high-level business criticality and data classifications will help ensure that IT security is aligned with what is critical to the business. This will be very important when decisions are made around vulnerability risk and the urgency of remediation action.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO

      Outcomes of this step

      Understanding and consistency in how business criticality and business data is assessed by IT in the vulnerability management process.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Understanding business criticality is key to determining vulnerability urgency

      Prioritize operations that are truly critical to the operation of the business, and understand how they would be impacted by an exploited vulnerability.

      Use the questions below to help assess which operations are critical for the business to continue functioning.

      For example, email is often thought of as a business-critical operation when this is not always the case. It is important to the business, but as regular operations can continue for some time without it, it would not be considered extremely business critical.

      Questions to ask Description
      Is there a hard-dollar impact from downtime? This refers to when revenue or profits are directly impacted by a business disruption. For example, when an online ordering system is compromised and shut down, it impacts sales, and therefore, revenue.
      Is there an impact on goodwill/ customer trust? If downtime means delays in service delivery or otherwise impacts goodwill, there is an intangible impact on revenue that may make the associated systems mission critical.
      Is regulatory compliance a factor? Depending on the circumstances of the vulnerabilities, it can be a violation of regulatory compliance and would cause significant fines.
      Is there a health or safety risk? Some operations are critical to health and safety. For example, medical organizations have operations that are necessary to ensure that individuals’ health and safety are maintained. An exploited vulnerability that prevents these operations can directly impact the lives of these individuals.
      Don’t start from scratch – your disaster recovery plan (DRP) may have a business impact analysis (BIA) that can provide insight into which applications and operations are considered business critical.

      Analyst Perspective

      When assessing the criticality of business operations, most core business applications may be deemed business critical over the long term.

      Consider instead what the impact is over the first 24 or 48 hours of downtime.

      2.2.1 Determine high-level business criticality

      120 minutes; less time if a Disaster recovery plan business impact analysis exists

      Input: List of business operations, Insight into business operations impacts to the business

      Output: List of business operations and their criticality and impact to the business

      Materials: Vulnerability Management SOP Template

      Participants: Participants from the business, IT Security Manager, CISO, CIO

      1. List your core business operations at a high level.
      2. Use a High, Medium, or Low ranking to prioritize the business operations based on mission-critical criteria and the impact of the vulnerability.
      3. When using the process flow, consider if the vulnerability directly affects any of these business operations and move through the process flow based on the corresponding High, Medium, or Low ranking.
      Example prioritization of business operations for a manufacturing company: Questions to ask:
      1. Is there a hard-dollar impact from downtime?
      2. Is there impact on goodwill or customer trust?
      3. Is regulatory compliance a factor?
      4. Is there a health or safety risk?

      Download the Vulnerability Management SOP Template

      Determine vulnerability urgency by its data classification

      Consider how to classify your data based on if the Confidentiality, Integrity, or Availability (CIA) is compromised.

      To properly classify your data, consider how the confidentiality, integrity, and availability of that data would be affected if it were to be exploited by a vulnerability. Review the table below for an explanation for each objective.
      Confidentiality

      Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

      Integrity

      Guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity.

      Availability

      Ensuring timely and reliable access to and use of information.

      Each piece of data should be ranked as High, medium, or low across confidentiality, integrity, and availability based on adverse effect. Arrow pointing right. Low — Limited adverse effect

      Moderate — Serious adverse effect

      High — Severe or catastrophic adverse effect

      If you wish to build a whole data classification methodology, refer to our Discover and Classify Your Data blueprint.

      How to determine data classification when CIA differs:

      The overall ranking of the data will be impacted by the highest objective’s ranking.

      For example, if confidentiality and availability are low, but integrity is high, the overall impact is high.

      This process was developed in part by Federal Information Processing Standards Publication 199.

      2.2.2 Determine your high-level data classifications

      120 minutes, less time if data classification already exists

      Input: Knowledge of data use and sensitivity

      Output: Adjusted workflow to reflect your current processes, Vulnerability Tracking Tool

      Materials: Whiteboard, Whiteboard markers, Vulnerability Management SOP Template

      Participants: IT Security Manager, CISO, CIO

      If your organization has formal data classification in place, it should be leveraged to determine the high, medium, and low rankings necessary for the process flows. However, if there is no formal data classification in place, the process below can be followed:

      1. List common assets or applications that are prone to vulnerabilities.
      2. Consider the data that is on these devices and provide a high (severe or catastrophic adverse effect), medium (serious adverse effect), or low (limited adverse effect) ranking based on confidentiality, availability, and integrity.
        1. Use the table on the previous slide to assist in providing the ranking.
        2. Remember that it is the highest ranking that dictates the overall ranking of the data.
      3. Document which data belongs in each of the categories to provide contextual evidence.

      Download the Vulnerability Management SOP Template

      This process should be part of your larger data classification program. If you need assistance in building this out, review the Info-Tech research, Discover and Classify Your Data.

      Step 2.3

      Consider current security posture

      Activities
      • 2.3.1 Document your defense-in-depth controls

      This step will walk you through the following activities:

      Your defense-in-depth controls are the existing layers of security technology that protects your environment. These are relevant when considering the urgency and risk of vulnerabilities in your environment, as they will mitigate some of the risk.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      Understanding and documentation of your current defense-in-depth controls.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Review your current security posture

      What you have today matters.
      • In most cases, your vulnerability scanning tool alone will not have the context of your security posture in the results of its scans. This can skew the true urgency of detected vulnerabilities in your environment.
      • What you have in place today is what comprises your organization’s overall security posture. This bears high relevance to the determination of the risk that a vulnerability poses to your environment.
      • Elements such as enterprise architecture and defense in depth mechanisms should be factored into determining the risk of a vulnerability and what kind of immediacy is warranted to address it.
      • Details of your current security posture will also contribute to the assessment and selection of remediation options.
      Stock image of toy soldiers split into two colours, facing eachother down.

      Enterprise architecture considerations

      What does your network look like?
      • Most organizations have a network topology that has been put in place with operational needs in mind. These includes specific vLANs or subnets, broadcast domains, or other methods of traffic segregation.
      • The firewall and network ACLs (access control lists) will manage traffic and the routes that data packets follow to traverse a network.
      • Organizations may physically separate data network types, for example, a network for IT services and one for operational technology (OT)(OT is often known as ICS (industrial control systems) or SCADA (supervisory control and data acquisition)) or other types of production technology.
      • The deployment of distribution and access switches across an enterprise can also be a factor, where a flatter network will have fewer network devices within the topology.
      • In a directory services environment such as Windows Active Directory, servers and applications can be segregated by domains and trust relationships, organizational units, and security groups.
      What’s the relevance to vulnerability management?

      For a vulnerability to be exploited, a malicious actor must find a way to access the vulnerable system to make use of the vulnerability in question.

      Any enterprise architecture characteristics that you have in place may lessen the probability of a successful vulnerability exploit.

      This may potentially “buy time” for SecOps to address and remediate the vulnerability.

      Defense-in-depth

      Defense-in-depth provides extra layers of protection to the organization.

      • Defense-in-depth refers to the coordination of security controls to add layers of security to the organization.
        • This means that even if attackers are able to get past one control or layer, they are hindered by additional security.
      • Defense-in-depth is distinct from the previous section on enterprise architecture as these are security controls put in place with the purpose of being lines of defense within your security posture.
      • This can be extremely useful in managing vulnerabilities; thus, it is important to establish the existing defense-in-depth controls. By establishing the base model for your defense-in-depth, it will allow you to leverage these controls to manage vulnerabilities.
      • Controls are typically distributed across endpoints, network infrastructure, servers, and physical security.

      Note: Defense-in-depth controls do not entirely mitigate vulnerability risk. They provide a way in which the vulnerability cannot be exploited, but it continues to exist on the application. This must be kept in mind as the controls or applications themselves change, as it can re-open the vulnerability and cause potential problems.

      Examples of defense-in-depth controls can consist of any of the following:
      • Antivirus software
      • Authentication security
      • Multi-factor authentication
      • Firewalls
      • Demilitarized zones (DMZ)
      • Sandboxing
      • Network zoning
      • Application whitelisting
      • Access control lists
      • Intrusion detection & prevention systems
      • Airgapping
      • User security awareness training

      2.3.1 Document your defense-in-depth controls

      2 hours, less time if a security services catalog exists

      Input: List of technologies within your environment, List of IT security controls that are in place

      Output: List of defense-in-depth controls

      Materials: Whiteboard/flip charts, Vulnerability Management SOP Template

      Participants: IT Security Manager, Infrastructure Manager, IT Director, CISO

      1. Document the existing defense-in-depth controls within your system.
      2. Review the initial list that has been provided and see if these are controls that currently exist.
      3. Indicate any other controls that are being used by the organization. This may already exist if you have a security services catalog.
      4. Indicate who the owners of the different controls are.
      5. Track the information in the Vulnerability Management SOP Template.

      Download the Vulnerability Management SOP Template

      Sample table of security controls within a Defense-in-depth model with column headers 'Defense-in-depth control', 'Description', 'Workflow', and 'Control Owner'.

      Step 2.4

      Risk assessment of vulnerabilities

      Activities
      • 2.4.1 Build a classification scheme to consistently assess impact
      • 2.4.2 Build a classification scheme to consistently assess likelihood

      This step will walk you through the following activities:

      Assessing risk will be the cornerstone of how you evaluate vulnerabilities and what priority you place on remediation. This is actual risk to the organization and not simply what the tool reports without the context of your defense-in-depth controls.

      This step involves the following participants:

      • IT Security Manager
      • IT Operations Management
      • CISO
      • CIO

      Outcomes of this step

      A risk matrix tailored to your organization, based on impact and likelihood. This will provide a consistent, unambiguous way to assess risk across the vulnerability types that is reported by your scanning tool.

      Triage & prioritize
      Step 2.1 Step 2.2 Step 2.3 Step 2.4

      Vulnerabilities and risk

      Vulnerabilities must be addressed to mitigate risk to the business.
      • Vulnerabilities are a concern because they are potential threats to the business. Vulnerabilities that are not addressed can turn from potential threats into actual threats; it is only a matter of time and opportunity.
      • Your organization will already be familiar with risk management, as every decision carries a business risk component. There may even be a senior manager assigned as corporate risk officer to manage organizational risk.
      • The organization likely has a risk tolerance level that defines the organization’s risk appetite. This may be measured in dollars, non-productivity time, or other units of inefficiency.
      • The risk of a vulnerability can be calculated using impact and likelihood. Impact is the effect that the vulnerability will have if it is exploited by a malicious actor. Likelihood is the degree to which a vulnerability exploit can possibly occur.
      Stock image of a cartoon character in a tie hanging on the needle of a 'RISK' meter as it sits at 'LOW'.

      Info-Tech Insight

      Risk to the organization is business language that everyone can understand. This is particularly true when the risk is to productivity or to the company’s bottom line.

      A risk-based approach to vulnerability management

      CVSS scores are just the starting point!

      Vulnerabilities are constant.
      • There will always be vulnerabilities in the environment, many of which won’t be reported as they are currently unknown.
      • Don’t focus on trying to resolve all vulnerabilities in your environment. You are neither resourced for it nor can the business tolerate the downtime needed to remediate every single vulnerability.
        • The constant follow of new vulnerabilities will quickly render your efforts useless and it will become a game of “whack-a-mole.”
      • Being able to prioritize which vulnerabilities require appropriate levels of response is crucial to ensuring that an organization stays ahead of the continual flow.
      • Your vulnerability scanning tool will report the severity of a vulnerability, often using an industry Common Vulnerability Scoring System (CVSS) system ranging from 0 to 10. It will then scan your environment for the presence of the vulnerability and report accordingly.
        • Your vulnerability scanning tool will not be aware of any mitigation components in your environment, such as compensating controls, network segregation, server/application hardening, or any other measures that can reduce the risk. That is why determining actual risk is a crucial step.

      Stock image of a whack-a-mole game.

      Info-Tech Insight

      Vulnerability scanning is a valuable function, but it does not tell the full picture. You must determine how urgent a vulnerability truly is, based on your specific environment.

      Prioritize remediation by levels of risk

      Address critical and high risk with high immediacy.

      • Addressing the critical and high-risk vulnerabilities with urgency will ensure that you are addressing a more manageable number of vulnerabilities.
      • An optimized vulnerability management process will address the medium and low risk vulnerabilities within the regular cycle.
      • This may be very similar to what you do today in an ad hoc fashion:
        • Zero-day vulnerabilities tend to warrant a stop in operations and are dealt with immediately (or as soon as a vendor has a fix).
        • The standard remediation process (patching/updating, change of configuration, etc.) happens within a regular controlled time cycle.
      • Formalizing this process will ensure that appropriate attention is given to vulnerabilities that warrant it and that the remaining vulnerabilities are dealt with as a regular, recurring activity.

      Mitigate the risk surface by reducing the time across the phases

      Chart titled 'Mitigate the risk surface by reducing the time across the phases' with the axes 'Risk Level' and 'Time' with lines created by individual risks. The highlighted line begins in 'Critical' and eventually drops to low. A note on the line reads 'Objective: Reduce risk surface by reducing time to address'. The area between the line and your organization's risk tolerance is labelled 'Risk Surface, to be addressed with high priority'. A bracket around Risk levels 'High' and 'Critical' reads 'Priority focus zone (risk surface)'. Risk lines within levels 'Low' and 'Medium' read 'Follow standard vulnerability management cycles'.

      Risk matrix

      Risk = Impact x Likelihood
      • Info-Tech’s Vulnerability Management Risk Assessment Tool provides a method of calculating the risk of a vulnerability. The risk rating is assigned using the impact of the risk and the likelihood or probability that the event may occur.
      • The tool puts the vulnerability into your organization’s context: How many people will be affected? What service types are vulnerable and how does that impact the business? Is there an anticipated update from the vendor of the system being affected?
      • Urgency of remediation should be based on the business consequences if the vulnerability were to be exploited, relative to the business’ risk tolerance.

      Info-Tech Insight

      Risk determination should be done within the context of your current environment and not simply based on what your vulnerability tool is reporting.

      A risk matrix is useful in calculating a risk rating for vulnerabilities. Risk matrix with axes 'Impact' and 'Time' and individual vulnerabilities mapped onto it via their risk rating. The example 'Organizational Risk Tolerance Threshold' line runs diagonally through the 'Medium' squares.

      2.4.1 Build a classification scheme to consistently assess impact

      60 minutes

      Input: Knowledge of IT environment, Knowledge of business impact for each IT component or service

      Output: Vulnerability Management Risk Assessment Tool formatted to your organization

      Materials: Vulnerability Management Risk Assessment Tool

      Participants: Functional Area Managers, IT Security Manager, CISO

      Risk always has a negative impact, but the size of the impact can vary considerably in terms of cost, number of people or sites affected, and the severity of the impact. Impact questions tend to be more objective and quantifiable than likelihood questions.

      1. Define a set of questions to measure risk impact or edit existing questions in the tool.
      2. For each question, assign a weight that should be placed on that factor.
      3. Define criteria for each question that would categorize the risk. The drop-down box content can be modified in the hidden Labels tab.

      Note that you are looking to baseline vulnerability types, rather than categorizing every single vulnerability your scanning tool reports. The volume of vulnerabilities will be high, but vulnerabilities can be categorized into types on a regular basis.

      Download the Vulnerability Management Risk Assessment Tool

      Screenshot of table from Info-Tech's Vulnerability Management Risk Assessment Tool for assessing Impact. Column headers are 'Weight', 'Question', 'OS vulnerability', 'Application vulnerability', 'Network vulnerability', and 'Vendor patch release'.

      2.4.2 Build a classification scheme to consistently assess likelihood

      60 minutes

      Input: Knowledge of IT environment, Knowledge of business impact for each IT component or service

      Output: Vulnerability Management Risk Assessment Tool formatted to your organization

      Materials: Vulnerability Management Risk Assessment Tool

      Participants: Functional Area Managers, IT Security Manager, CISO

      Risk always has a negative impact, but the size of the impact can vary considerably in terms of cost, number of people or sites affected, and the severity of the impact. Impact questions tend to be more objective and quantifiable than likelihood questions.

      1. Define a set of questions to measure risk impact or edit existing questions in the tool.
      2. For each question, assign a weight that should be placed on that factor.
      3. Define criteria for each question that would categorize the risk. The drop-down box content can be modified in the hidden Labels tab.

      Note that you are looking to baseline vulnerability types, rather than categorizing every single vulnerability that your scanning tool reports. The volume of vulnerabilities will be high, but vulnerabilities can be categorized into types on a regular basis.

      Download the Vulnerability Management Risk Assessment Tool

      Screenshot of table from Info-Tech's Vulnerability Management Risk Assessment Tool for assessing Likelihood. Column headers are 'Weight', 'Question', 'OS vulnerability', 'Application vulnerability', and 'Network vulnerability'.

      Prioritize based on risk

      Select the best remediation option to minimize risk.

      Through the combination of the identified risk and remediation steps in this phase, the prioritization for vulnerabilities will become clear. Vulnerabilities will be assigned a priority once their intrinsic qualities and threat potential to business function and data have been identified.

      • Remediation options will be identified for the higher urgency vulnerabilities.
      • Options will be assessed for whether they are appropriate.
      • They will be further tested to determine if they can be used adequately prior to full implementation.
      • Based on the assessments, the remediation will be implemented or another option will be considered.
      Prioritization
      1. Assignment of risk
      2. Identification of remediation options
      3. Assessment of options
      4. Implementation

      Remediation plays an incredibly important role in the entire program. It plays a large part in wider risk management when you must consider the risk of the vulnerability, the risk of the remediation option, and the risk associated with the overall process.

      Implement Risk-Based Vulnerability Management

      Phase 3

      Remediate vulnerabilities

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      • Identifying potential remediation options.
      • Developing criteria for each option with regards to when to use and when to avoid.
      • Establishing exception procedure for testing and remediation.
      • Documenting the implementation of remediations and verification.

      This phase involves the following participants:

      • CISO, or equivalent
      • Security Manager/Analyst
      • Network, Administrator, System, Database Manager
      • Other members of the vulnerability management team
      • Risk managers for the risk-related steps

      Determining how to remediate

      Patching is only one option.

      This phase will allow organizations to build out the specific processes for remediating vulnerabilities. The overall process will be the same but what will be critical is the identification of the correct material. This includes building the processes around:
      • Identifying and selecting the remediation option to be used.
      • Determining what to do when a patch or update is not available.
      • Scheduling and executing the remediation activity.
      • Continuous improvement.

      Each remediation option carries a different level of risk that the organization needs to consider and accept by building out this program.

      It is necessary to be prepared to do this in real time. Careful documentation is needed when dealing with vulnerabilities. Use the Vulnerability Tracking Tool to assist with documentation in real time. This is separate from using the process template but can assist in the documentation of vulnerabilities.

      Step 3.1

      Assessing remediation options

      Activities
      • 3.1.1 Develop risk and remediation action

      This step will walk you through the following activities:

      With the risk assessment from the previous activity, we can now examine remediation options and make a decision. This activity will guide us through that.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      List of remediation options and criteria on when to consider each.

      Remediate vulnerabilities
      Step 3.1 Step 3.2 Step 3.3

      Identify remediation options

      There are four options when it comes to vulnerability remediation.

      Patches and Updates

      Patches are software or pieces of code that are meant to close vulnerabilities or provide fixes to any bugs within existing software. These are typically provided by the vendor to ensure that any deployed software is properly protected after vulnerabilities have been detected.

      Configuration Changes

      Configuration changes involve administrators making significant changes to the system or network to remediate against the vulnerability. This can include disabling the vulnerable application or specific element and can even extend to removing the application altogether.

      Remediation

      Compensating Controls

      By leveraging security controls, such as your IDS/IPS, firewalls, or access control, organizations can have an added layer of protection against vulnerabilities beyond the typical patches and configuration changes. This can be used as a measure while waiting to implement another option (if one exists) to reduce the risk of the vulnerability in the short or long term.

      Risk Acceptance

      Whenever a vulnerability is not remediated, either indefinitely or for a short period of time, the organization is accepting the associated risk. Segregation of the vulnerable system can occur in this instance. This can occur in cases where a system or application cannot be updated without detrimental effect to the business.

      Patches and updates

      Patches are often the easiest and most common method of remediation.

      Patches are usually the most desirable remediation solution when it comes to vulnerability management. They are typically provided by the vendor of the vulnerable application or system and are meant to eliminate the existing vulnerability.

      When to use

      • When adequate testing can be performed on the patch to be implemented.
      • When there is a change window approaching for the affected systems.
      • When there is standardization across the IT assets to allow for easier installation of patches.

      When to avoid

      • When the patch cannot be adequately tested.
      • When a patch has been tested, but it caused an unfavorable consequence such as a system or application failure.
      • When there is no near change window in which to install the patches, which is often the case for critical systems.
      When to consider other remediation options
      • For critical systems, it can be difficult to implement a patch as they often require the system to be rebooted or go through some downtime. There must be consideration towards whether there is a change window approaching if a patch is to be implemented on a business-critical system.
        • If there is no opportunity to implement the patch, or no approaching change window, it is wise to leverage another remediation option.
      • When patches are not currently available from the vendor or they are in production, other remediation options are needed.
      • Other remediation options can be used in tandem with the patch. For example, if a patch is being deferred until the change window, it would be wise to use alternate remediation options to close the vulnerability.

      Compensating controls

      Compensating controls can decrease the risk of vulnerabilities that cannot be (immediately) remediated.

      • Compensating controls are measures put in place when direct remediation measures are impractical or non-existent.
      • Similar to the payment card industry’s PCI DSS 1.0 provision of compensating controls, these are meant to meet the intent or rigor of the original requirement; unlike PCI DSS, these measures are to mitigate risk rather than meet compliance.
      • The compensating control should be viewed as only a temporary measure for dealing with a vulnerability, although circumstances may dictate a degree of permanence in the application of the compensating control.
      • Examples where compensating controls may be needed are:
        • The software vendor is developing an update or patch to address a vulnerability.
        • Through your testing process, a patch will adversely affect the performance or operation of the target system and be detrimental to the business.
        • A critical application will only run on a legacy operating system, the latter of which is no longer supported by the vendor.
        • A legacy application is no longer being supported but is critical to your operations. A replacement, if one exists, will take time to implement.
      Examples of compensating controls
      • Segregating a vulnerable server or application on the network, physically or logically.
      • Hardening the operating system or application.
      • Restricting user logins to the system or application.
      • Implementing access controls on the network route to the system.
      • Instituting application whitelisting.

      Configuration changes

      Configuration changes involve making changes directly to the application or system in which there is a vulnerability. This can vary from disabling or removing the vulnerable element or, in the case of applications built in-house, changing the coding of the application itself. These are commonly used in network vulnerabilities such as open ports.

      When to use

      • A patch is not available.
      • The vulnerable element can be significantly changed, or even disabled, without significantly disrupting the business.
      • The application is built in-house, as the vulnerability must be closed internally.
      • There is adequate testing to ensure that the configuration change does not affect the business.
      • A configuration change in your network or system can affect numerous endpoints or systems, reducing endpoint patching or use of defense-in-depth controls.

      When to avoid

      • When a suitable patch is available.
      • When the vulnerability is on a business-critical element with no nearby change window or it cannot be disabled.
      • When there is no opportunity in which to perform testing to ensure that there are no unintended consequences.
      When to consider other remediation options
      • Configuration changes require careful documentation as changes are occurring to the system and applications. If there is a need to perform a back-out process and return to the original configuration, this can be extremely difficult without clear documentation of what occurred.
      • If business systems are too critical or important to the regular business function to perform any changes, it is necessary to consider other options.

      Info-Tech Insight

      Remember your existing processes: configuration changes may need to be approved and orchestrated through your organization’s configuration and change management processes.

      Case Study

      Remediation options do not have to be used separately. Use the Shellshock 2014 case as an example.

       
      INDUSTRY: All
      SOURCE: Public Domain
      Challenge

      Bashdoor, more commonly known as Shellshock, was announced on September 24, 2014.

      This bug involved the Bash shell, which normally executes user commands, but this vulnerability meant that malicious attackers could exploit it.

      This was rated a 10/10 by CVSS – the highest possible score.

      Within hours of the announcement, hackers began to exploit this vulnerability across many organizations.

      Solution

      Organizations had to react quickly and multiple remediation options were identified:

      • Configuration changes – Companies were recommended to use other shells instead of the Bash shell.
      • Defense-in-depth controls – Using HTTP server logs, it could be possible to identify if the vulnerability had been exploited.
      • Patches – Many vendors released patches to close this vulnerability including Debian, Ubuntu, and Red Hat.
      Results

      Companies began to protect themselves against these vulnerabilities.

      While many organizations installed patches as quickly as possible, some also wished to test the patch and leveraged defense-in-depth controls in the interim.

      However, even today, many still have the Shellshock vulnerability and exploits continue to occur.

      Accept the risk and do nothing

      By choosing not to remediate vulnerabilities, you must accept the associated risk. This should be your very last option.

      Every time that a vulnerability is not remediated, it continues to pose a risk to the organization. While it may seem that every vulnerability needs to be remediated, this is simply not possible due to limited resources. Further, it can take away resources from other security initiatives as opposed to low-priority vulnerabilities that are extremely unlikely to be exploited.

      Common criteria for vulnerabilities that are not remediated:
      • Affected systems are of extremely low criticality.
      • Affected systems are deemed too critical to take offline to perform adequate remediation.
      • Low urgency is assigned to those vulnerabilities.
      • Cost and time required for the remediation are too high.
      • No adequate solutions exist – the vendor has not released a patch, there are weak defense-in-depth controls, and it is not possible to perform a configuration change.

      Risk acceptance is not uncommon…

      • With an ever-increasing number of vulnerabilities, organizations are struggling to keep up and often, intentionally or unintentionally, accept the risk associated.
      • In the end, non-remediation means full acceptance of the risk and any consequences.

      Enterprise risk management
      Arrow pointing up.
      Risk acceptance of vulnerabilities

      While these are common criteria, they must be aligned to the enterprise risk management framework and approved by management.

      Don’t forget the variables that were assessed in Phase 2. This includes the risk from potential lateral movement or if there is an existing exploit.

      Risk considerations

      When determining if risk acceptance is appropriate, consider the cost of not mitigating vulnerabilities.

      Don’t accept the risk because it seems easy. Consider the financial impact of leaving vulnerabilities open.

      With risk acceptance, it is important to review the financial impact of a security incident resulting from that vulnerability. There is always the possibility of exploitation for vulnerabilities. A simple metric taken from NIST SP800-40 to use for this is:

      Cost not to mitigate = W * T * R

      Where (W) is the number of work stations, (T) is the time spent fixing systems or lost in productivity, and (R) is the hourly rate of the time spent.

      As an example provided by NIST SP800-40 Version 2.0, Creating a Patch and Vulnerability Management Program:

      “For an organization where there are 1,000 computers to be fixed, each taking an average of 8 hours of down time (4 hours for one worker to rebuild a system, plus 4 hours the computer owner is without a computer to do work) at a rate of $70/hour for wages and benefits:

      1,000 computers * 8 hours * $70/hour = $560,000”

      Info-Tech Insight

      Always consider the financial impact that can occur from an exploited vulnerability that was not remediated.

      3.1.1 Develop risk and remediation action

      90 minutes

      Input: List of remediation options

      Output: List of remediation options sorted into “when to use” and “when to avoid” lists

      Materials: Whiteboard/flip charts, Vulnerability Management SOP Template

      Participants: IT Security Manager, IT Infrastructure Manager, IT Operations Manager, Corporate Risk Officer, CISO

      It is important to define and document your organization-specific criteria for when a remediation option is appropriate and inappropriate.

      1. List each remediation option on a flip chart and create two headings: “When to use” and “When to avoid.”
      2. Each person will list “when to use” criteria on a green sticky note and “when to avoid” criteria on a red one for each option; these will be placed on the appropriate flip chart.
      3. Discuss as a group which criteria are appropriate and which should be removed.
      4. Move on to the next remediation option when completed.
        • Ensure to include when there are remediation options that will be connected. For example, the risk may be accepted until the next available change window, or a defense-in-depth control is used before a patch can be fully installed.
      5. Once the criteria has been established, document this in the Vulnerability Management SOP Template.
      When to use:
      • When adequate testing can be performed on the patch to be implemented.
      • When there is a change window approaching, especially for critical systems.
      • When there is standardization across the IT assets to allow for easier installation of patches.
      When to avoid:
      • When the patch cannot be adequately tested.
      • When a patch has been tested, but it has caused an unfavorable consequence such as a system or application failure.
      • When there is no near change window in which to install the patches.
      (Example from the Vulnerability Management SOP Template for Patches.)

      Download the Vulnerability Management SOP Template

      Step 3.2

      Scheduling and executing remediation

      Activities

      None for this section.

      This step will walk you through the following activities:

      Although there are no specific activities for this section, it will walk you through your existing processes configuration and change management to ensure that you are leveraging those activities in your vulnerability remediation actions.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      Gained understanding of how IT operations processes configuration and change management can be leveraged for the vulnerability remediation process. Don’t reinvent the wheel!

      Remediate vulnerabilities
      Step 3.1 Step 3.2 Step 3.3

      Implementing the remediation

      Vulnerability management converges with your IT operations functions.
      • Once a remediation strategy has been formulated, you can leverage your release and change management processes to orchestrate the testing, version tracking, scheduling, approval, and implementation activities.
      • Each of these processes should exist in your environment in some form. Leveraging these will engage the IT operations team to carry out their tasks in the remediation process.
      • There can be a partial or full handoff to these processes, however, the owner of the vulnerability management program is responsible for verifying the application of the remediation measure and that the overall risk has been reduced.
      • Although full blueprints exist that cover each of these processes in great detail, the following slides provide an overview of each of these IT operations processes and how they intersect with vulnerability management.
      Stock image of a person on a laptop overlaid by an icon with gears indicating settings.

      Release Management

      Control the quality of deployments and releases of software updates.

      • The release management process exists to ensure that new software releases (such as patches and updates) are properly tested and documented with version control prior to their implementation into the production environment.
      • The process should map out the logistics of the deployment process to ensure that it is consistent and controlled.
      • Testing is an important part of release management and the urgency of a vulnerability remediation operation can expedite this process to ensure minimal delays. Once testing has been completed successfully, the update is then “promoted” to production-ready status and submitted into the change management process.
      • Often a separate release team may not exist, however, release management still occurs.

      For guidance on implementing or improving your release management process, refer to Info-Tech’s Stabilize Release and Deployment Management blueprint or speak to one of our experts.

      Info-Tech Insight

      Many organizations don’t have a separate release team. Rather, whomever is doing the deployment will submit a change request and the testing details are vetted through the organization’s change management process.

      For guidance on the change management process review our Optimize Change Management blueprint.

      Change Management

      Leverage change control, interruption management, approval, and scheduling.
      • Change management likely exists in some shape or form in your organization. There is usually someone or a committee, such as a change advisory board (CAB), that gives approval for a change.
      • Leveraging the change management process will ensure that your vulnerability remediation has undergone the proper review and approval before implementation. There will usually be business sign-off as part of a change management approval process.
      • Communication will also be integrated in the change management process, so the change manager will ensure that appropriate, timely communications are sent to the proper key stakeholders.
      • The change management process will link to release management and configuration management processes if they exist.

      For further guidance on implementing or improving your change management process, refer to Info-Tech’s Optimize Change Management blueprint or speak to one of our experts.

      “With no controls in place, IT gets the blame for embarrassing outages. Too much control, and IT is seen as a roadblock to innovation.” (VP IT, Federal Credit Union)

      Post-implementation activities

      Vulnerability remediation isn’t a “set it and forget it” activity.
      • Once vulnerability remediation has occurred, it is imperative that the results are reported back to the vulnerability management program manager. This ensures that the loop is closed and the tracking of the remediation activity is done properly.
        • Organizations that are subject to audit by external entities will understand the importance of such documentation.
      • The results of post-implementation review from the change management process will be of great interest, particularly if there was any deviation from the planned activities.
      • Although change execution will usually undergo some form of testing during the maintenance window, there is always the possibility that something has broken as a result of the software update. Be quick to respond to these types of incidents!
        • One example of an issue that is near impossible to test during a maintenance window is one that manifests only when the system or software comes under load. This is what makes for busy Monday mornings after a weekend change window.
      A scan with your vulnerability management software after remediation can be a way to verify that the overall risk has been reduced, if remediation was done by way of patching/updates.

      Info-Tech Insight

      After every change completion, whether due to vulnerability remediation or not, it is a good idea to ensure that your infrastructure team increases its monitoring diligence and that your service desk is ready for any sudden influx of end-user calls.

      Step 3.3

      Continuous improvement

      Activities

      None for this section.

      This step will walk you through the following activities:

      Although this section has no activities, it will review the process by which you may continually improve vulnerability management.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • ITOps team members, including tiers 1, 2, and 3
      • CISO
      • CIO

      Outcomes of this step

      An understanding of the importance of ongoing improvements to the vulnerability management program.

      Remediate vulnerabilities
      Step 3.1 Step 3.2 Step 3.3

      Drive continuous improvement

      • Also known as “Continual Improvement” within the ITIL best practice framework.
      • Your vulnerability management program will not be perfect on first launch. In fact, due to the ever-changing nature of vulnerabilities and the technology designed to detect and combat vulnerabilities, the processes within your vulnerability management program will need to be tweaked from time to time.
      • Continuous improvement is a sustained, proactive approach to process improvement. The practice allows for all process participants to observe and suggest incremental improvements that can help improve the overall process.
      • In many cases, continuous improvement can be triggered by changes in the environment. This makes perfect sense for vulnerability management process improvement as a change in the environment will require vulnerability scanning to ensure that such changes have not introduced new vulnerabilities into the environment, increasing your risk surface.
      • One key method to tracking continuous improvement is through the effective use of metrics, covered in Section 4.1 of this blueprint.
      “The success rate for continual improvement efforts is less than 60 percent. A major – if not the biggest – factor affecting the deployment of long-term continual improvement initiatives today is the fundamental change taking place in the way companies manage and execute work.” (Industry analyst at a consulting firm, 2014)

      Continuous Improvement

      Continuously re-evaluate the vulnerability management process.

      As your systems and assets change, your vulnerability management program may need updates in two ways.

      When new assets and systems are introduced:

      • When new systems and assets are introduced, it is important for organizations to recognize how these can affect vulnerability management.
      • It will be necessary to identify the business criticality of the new assets and systems and the sensitivity of the data that can be found on them.
      • Without doing so, these will be considered rogue systems or assets – there is no clear process for assigning urgencies.
      • This will only cause problems as actions may be taken that are not aligned with the organization’s risk management framework.

      Effective systems and asset management are needed to track this. Review Info-Tech’s Implement Systems Management to Improve Availability and Visibility blueprint for more help.

      Document any changes to the vulnerability management program in the Vulnerability Management SOP Template.

      When defense-in-depth capabilities are modified:

      • As you build an effective security program, more controls will be added that can be used to protect the organization.
      • These should be documented and evaluated based on ability to mitigate against vulnerabilities.
      • The defense-in-depth model that was previously established should be updated to include the new capabilities that can be used.
      • Defense-in-depth models are continually evolving as the security landscape evolves, and organizations must be ready for this.

      To assist in building a defense-in-depth model, review Build an Information Security Strategy.

      Implement Risk-Based Vulnerability Management

      Phase 4

      Measure and formalize

      Phase 1

      1.1 What is vulnerability management?
      1.2 Define scope and roles
      1.3 Cloud considerations for vulnerability management
      1.4 Vulnerability detection

       

      Phase 2

      2.1 Triage vulnerabilities
      2.2 Determine high-level business criticality
      2.3 Consider current security posture
      2.4 Risk assessment of vulnerabilities

       

      Phase 3

      3.1 Assessing remediation options
      3.2 Scheduling and executing remediation
      3.3 Continuous improvement

       

      Phase 4

      4.1 Metrics, KPIs & CSFs
      4.2 Vulnerability management policy
      4.3 Select and implement a scanning tool
      4.4 Penetration testing

      This phase will walk you through the following activities:

      • You will determine what ought to be measured to track the success of your vulnerability management program.
      • If you lack a scanning tool this phase will help you determine tool selection.
      • Lastly, penetration testing is a good next step to consider once you have your vulnerability management program well underway.

      This phase involves the following participants:

      • IT Security Manager
      • SecOps team members
      • Procurement representatives
      • CISO
      • CIO

      Step 4.1

      Metrics, Key Performance Indicators (KPIs), and Critical Success Factors (CSFs)

      Activities
      • 4.1.1 Measure your program with metrics, KPIs, and CSFs

      This step will walk you through the following activities:

      After a review of the differences between raw metrics, key performance indicators (KPI), and critical success factors (CSF), compile a list of what metrics you will be tracking, why, and the business goals for each.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO
      • CIO

      Outcomes of this step

      Outline of metrics you can configure your vulnerability scanning tool to report on.

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      You can’t manage what you can’t measure

      Metrics provides visibility.

      • Management consultant Peter Drucker introduced the concept of metrics tied to key performance indicators (KPIs), and the concept holds true: without metrics, you lack the visibility to manage or improve a process.
      • Metrics aren’t just a collection of statistics, they have to be meaningful, they have to tell the story, and most importantly, they have to answer the “so what?” question. What is the significance of a metric – do they illustrate a trend or an anomaly? What actions should be carried out when a metric hits a certain threshold?
      • It would be prudent to track several metrics that can be combined to tell the full story. For example, tracking the number of critical vulnerabilities alone does not give a sense of the overall risk to the organization, nor does it offer any information on how quickly they have been remediated or what amount of effort was invested.
      Stock image of measuring tape.

      Metrics, KPIs, and CSFs

      Tracking the right information and making the information relevant.
      • There is often confusion between raw metrics, key performance indicators, and critical success factors.
      • Raw metrics are what is trackable from your systems and processes as a set of measurements without any context. Raw metrics in themselves are useful in telling the story of “what are we doing?”
      • KPIs are the specific metric or combination of metrics that help you track or gauge performance. KPIs tell the story of “how are we doing?” or “how well are we doing?”
      • CSFs are the specific KPIs that track the activities that are absolutely critical to accomplish for the business or business unit to be successful.
      The activity tracker on your wrist is a wealth of metrics, KPIs, and CSFs.

      If you wear an activity tracker, you are likely already familiar with the differences between metrics, key performance indicators, and critical success factors:

      • The raw metrics are your heart rate, step count, hours of sleep, caloric intake, etc.
      • KPIs are the individual goals that you have set: maintain a heart rate within the appropriate range for your age/activity level, achieve a step count goal per day, get x hours of sleep per night, consume a calorie range of y per day, etc.
      • CSFs are your overall goal: increase your cardiovascular capacity, lose weight, feel more energetic, etc.

      Your security systems can be similarly measured and tracked – transfer this skill!

      Tracking relevant information

      Tell the story in the numbers.

      Below are a number of suggested metrics to track, and why.

      Business Goal

      Critical Success Factor

      Key Performance Indicator

      Metric to track

      Minimize overall risk exposure Reduction of overall risk due to vulnerabilities Decrease in vulnerabilities Track the number of vulnerabilities year after year.
      Appropriate allocation of time and resources Proper prioritization of vulnerability mitigation activities Decrease of critical and high vulnerabilities Track the number of high-urgency vulnerabilities.
      Consistent timely remediation of threats to the business Minimize risk when vulnerabilities are detected Remediate vulnerabilities more quickly Mean time to detect: track the average time between the identification to remediation.
      Track effectiveness of scanning tool Minimize the ratio, indicating that the tool sees everything Ratio between known assets and what the scanner tracks Scanner coverage compared to known assets in the organization.
      Having effective tools to track and address Accuracy of the scanning tool Difference or ratio between reported vulnerabilities and verified ones Number of critical or high vulnerabilities verified, between the scanning tool’s criticality rating and actual criticality.
      Reduction of exceptions to ensure minimal exposure Visibility into persistent vulnerabilities and risk mitigation measures Number of exceptions granted Number of vulnerabilities in which little or no remediation action was taken.

      4.1.1 Measure your program with metrics, KPIs, and CSFs

      60 minutes

      Input: List of metrics current being measured by the vulnerability management tool

      Output: List of relevant metrics to track, and the KPIs, CSFs, and business goals related to the metric

      Materials: Whiteboard/flip charts, Vulnerability Management SOP Template

      Participants: IT Security Manager, IT operations management, CISO

      Metrics can offer a way to view how the organization is dealing with vulnerabilities and if there is improvement.

      1. Determine the high-level vulnerability management goals for the organization.
      2. Even with a formal process in place, the organization should be considering ways it can improve.
      3. Determine metrics that can help quantify those goals and how they can be measured.
      4. Metrics should always be easy to measure. If it’s a complex process to find the information required, it means that it is not a metric that should be used.
      5. Document your list of metrics in the Vulnerability Management SOP Template.

      Download the Vulnerability Management SOP Template

      Step 4.2

      Vulnerability Management Policy

      Activities
      • 4.2.1 Update the vulnerability management program policy

      This step will walk you through the following activities:

      If you have a vulnerability management policy, this activity may help augment it. Otherwise, if you don’t have one, this would be a great starting point.

      This step involves the following participants:

      • IT Security Manager
      • CISO
      • CIO
      • Human resources representative

      Outcomes of this step

      An inaugural policy covering vulnerability management

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      Vulnerability Management Program Policy

      Policies provide governance and enforcement of processes.
      • Policies offer formal guidance on the “rules” of a program, describing its purpose, scope, detailed program description, and consequences of non-compliance. Often they will have a employee sign-off acknowledging understanding.
      • In many organizations, policies are endorsed by senior executives, which gives the policy its “teeth” across the company. The human resources department will always have input due to the implications of the non-compliance aspect.
      • Policies are written to ensure an outcome of consistent expected behavior and are often written to protect the company from liability.
      • Policies should be easy to understand and unambiguous, reflect the current state, and be enforceable. Enforceability can come in the form of audit, technology, or any other means of determining compliance and enforcing behavior.
      Stock image of a judge's gavel.

      4.2.1 Update the vulnerability management policy

      60 minutes

      Input: Vulnerability Management SOP, HR guidance on policy creation and approval

      Output: Completed Vulnerability Management Policy

      Materials: Vulnerability Management SOP, Vulnerability Management Policy Template

      Participants: IT Security Manager, IT operations management, CISO, Human resources representative

      After having built your entire process in this project, formalize it into a vulnerability management policy. This will set the standards and expectations for vulnerability management in the organization, while the process will be around the specific actions that need to be taken around vulnerability management.

      This is separate and distinct from the Vulnerability Management SOP Template, which is a process and procedure document.
      1. Review Info-Tech’s Vulnerability Management Policy and customize it to your organization’s specifications.
      2. Use your Vulnerability Management SOP as a resource when specifying some of the details within the policy.
      Sample of Info-Tech's Vulnerability Management Policy Template

      Download the Vulnerability Management Policy Template

      Step 4.3

      Select and implement a scanning tool

      Activities
      • 4.3.1 Create an RFP for vulnerability scanning tools

      This step will walk you through the following activities:

      If you need to select a new vulnerability scanning tool, or replace your existing one, this activity will help set up a request for proposal (RFP).

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO

      Outcomes of this step

      The provisions needed for you to create and deploy an RFP for a vulnerability management tool.

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      Vulnerability management and penetration testing

      Similar in nature, yet provide different security functions.

      Vulnerability Scanning Tools

      Scanning tools focus on the network and operating systems. These tools look for items such as missing patches or open ports. They won’t detect specific application vulnerabilities.

      Exploitation Tools

      These tools will look to exploit a detected vulnerability to validate it.

      Penetration Tests

      A penetration test simulates the actions of an external or internal cyber attacker that aims to breach the information security of the organization. (Formal definition of penetration test)

      ‹————— What’s the difference again? —————›
      Vulnerability scanning tools are just one type of tool. When you add an exploitation tool to the mix, you move down the spectrum. Penetration tests will use scanning tools, exploitation tools, and people.

      What is the value of each?

      • For vulnerability scans, the person performing the scan provides the value – value comes from the organization itself.
      • For exploitation tools on their own, the value comes from the tool itself being used in a safe environment.
      • For penetration tests, the tester is providing the value. They are the value add.

      What’s the implication for me?

      Info-Tech Recommends:
      • A combination of vulnerability scanning and penetration testing. This will improve your security posture through systematic risk reduction and improve your security program through the testing of prevention, detection, and response capabilities with unique recommendations being generated.
      • Start with as much vulnerability scanning as possible to identify gaps to fix and then move onto a penetration test to do a more robust and validated assessment.
      • For penetration tests, start with a transparent box test first, then move to an opaque box. Ideally, this is done with different third parties.

      Vulnerability scanning software

      All organizations can benefit from having one.

      Scanning tools will benefit areas beyond just vulnerability management

      • Network security: It improves the accuracy and granularity of your network security technologies such as WAFs, NGFWs, IDPS, and SIEM.
      • Asset management: Vulnerability scanning can identify new or unknown assets and provide current status information on assets.
      • System management: Information from a vulnerability scan supports baselining activities and determination of high-value and high-risk assets.

      Vulnerability Detection Use Case

      Most organizations use scanners to identify and assess system vulnerabilities and prioritize efforts.

      Compliance Use Case

      Others will use scanners just for compliance, auditing, or larger GRC reasons.

      Asset Discovery Use Case

      Many organizations will use scanners to perform active host and application identification.

      Scanning Tool Market Trends

      Vulnerability scanning tools have expanded value from conventional checking for vulnerabilities to supporting configuration checking, asset discovery, inventory management, patch management, SSL certificate validation, and malware detection.

      Expect to see network and system vulnerability scanners develop larger vulnerability management functions and develop exploitation tool functionality. This will become a table stakes option enabling organizations to provide higher levels of validation of detected vulnerabilities. Some tools already possess these capabilities:

      • Core Impact is an exploitation tool with vulnerability scanning aspects.
      • Metasploit is an exploitation tool with some new vulnerability scanning aspects.
      • Nessus is mainly a vulnerability scanning tool but has some exploitation aspects.

      Device proliferation (BYOD, IoT, etc.) is increasing the need for stronger vulnerability management and scanners. This is driving the need for numerous device types and platform support and the development of baseline and configuration norms to support system management.

      Increased regulatory or compliance controls are also stipulating the need for vulnerability scanning, especially by a trusted third party.

      Organizations are outsourcing security functions or moving to cloud-based deployment options for any security technology they can. Expect to see massive growth of vulnerability scanning as a service.

      Vulnerability scanning market

      There are several technology types or functional differentiators that divide the market up.

      Vulnerability Exploitation Tools

      • These will actually test defences and better emulate real life than just scanning. These tools include packet manipulation tools (such as hping) and password cracking tools (such as John the Ripper or Cain and Abel).
      • These tools will provide much more granular information on your network, operations systems, and applications.
      • The main limitation of these tools is how to use them. If you do not have development or test environments that mimic your real production environments to run the exploit tools, these tools may not be appropriate. It may work if you can find some downtime on production systems, but only in very specific and careful instances.
      • Lower maturity security programs usually just do network and application vulnerability scanning. Higher maturity programs will also use penetration testing, application testing, and vulnerability exploitation tools.
      • Network vulnerability scanning tools should always be used. Once you identify any servers or ports running web applications, then you run a web application vulnerability scanner.
      • Exploitation tools and application testing tools are used in more specific use cases that are often related to more-demanding security programs.

      Scanning Tool Market Trends

      • These are considered baseline tools and are near commoditization.
      • Vulnerability scanning tools are not granular enough to detect application-level vulnerabilities (thus the need for application scanners and testing tools) and they don’t validate the exploitability of the vulnerability (thus the need for exploit tools).

      Web Application Scanning Tools

      These tools perform dynamic application security testing (DAST) and static application security testing (SAST).

      Application Scanning and Testing Tools

      • These perform a detailed scan against an application to detect any problematic or malicious code and try to break the application using known vulnerabilities.
      • These tools will identify if something is vulnerable to an exploit but won’t actually run the exploit.
      • These tools are evaluated based on their ability to detect application-specific issues and validate them.

      Vulnerability scanning tool features

      Evaluate vulnerability scanning tools on specific features or functions that are the best differentiators.

      Differentiator

      Description

      Deployment Options Do you want a traditional on-premises, cloud-based, or managed service?
      Vulnerability Database Coverage Scanners use a library of known vulnerabilities to test for. Evaluate based on the amount of exploits/vulnerabilities the tool can scan for.
      Scanning Method Evaluate if you want agent-based, authenticated active, unauthenticated active, passive, or some combination of those scanning methods.
      Integration What is the breadth of other security and non-security technologies the tool can integrate with?
      Remediation How detailed are the recommended remediation actions? The more granular, the better.
       

      Differentiator

      Description

      Prioritization Does the tool evaluate vulnerabilities based on commonly accepted methods or through a custom-designed prioritization methodology?
      Platform Support What is the breadth of environment, application, and device support in the tool? Consider your need for virtual support, cloud support, device support, and application-specific support. Also consider how often new scanning modules are supported (e.g. how quickly Windows 10 was supported).
      Pricing As with many security controls that have been around for a long time and are commonly used, pricing becomes a main consideration, especially when there are so many open-source options available.

      Common areas people mistake as tool differentiators:

      • Accuracy – Scanning tools are evaluated more on efficiency than effectiveness. Evaluate on the ability to detect, remediate, and manage vulnerabilities rather than real vulnerability detection and the number of false positives. To reduce false positives, you need to use exploitation tools.
      • Performance – Scanning tools have such a small footprint in an environment and the actual scanning itself is such a small impact that evaluation on performance doesn’t matter.

      For more information on vulnerability scanning tools and how they rate, review the Vulnerability Management category on SoftwareReviews.

      Vulnerability scanning deployment options

      Understand the different deployment options to identify which is best for your security program.

      Option

      Description

      Pros

      Cons

      Use Cases

      On-Premises Either an on-premises appliance or an on-premises virtualized machine that performs external and internal scanning.
      • Small resource need, so limited network impact.
      • Strong internal scanning.
      • Easier integration with other technologies.
      • Network footprint and resource usage.
      • Maintenance and support costs.
      • Most common deployment option.
      • Appropriate if you have cloud concerns or strong internal network scanning, or if you require strong integration with other systems.
      Cloud Either hosted on a public cloud infrastructure or hosted by a third party and offered “as a service.”
      • Small network footprint.
      • On-demand scanning as needed.
      • Optimal external scanning capabilities.
      • Can only do edge-related scanning unless authenticated or agent based.
      • No internal network scanning with passive or unauthenticated active scanning methods.
      • Very limited network resources.
      • Compliance obligations that dictate external vulnerability scanning.
      Managed A third party is contracted to manage and maintain your vulnerability scanner so you can dedicate resources elsewhere.
      • Expert management of environment scanning, optimizing tool usage.
      • Most scanning work time is report customization and tuning and remediation efforts; thus, managed doesn’t provide sizable resource alleviation.
      • Third party has and owns the vulnerability information.
      • Limited staff resources or expertise to maintain and manage scanner.

      Vulnerability scanning methods

      Understand the different scanning methods to identify which tool best supports your needs.

      Method

      Description

      Pros

      Cons

      Use Cases

      Agent-Based Scanning Locally installed software gives the information needed to evaluate the security posture of a device.
      • Provides information that can’t be discovered remotely such as installed applications that aren’t running at a given time.
      • Device processing, memory, and network bandwidth impact.
      • Asset without an agent is not scanned.
      • Need for continuous scanning.
      • Organization has strong asset management
      Authenticated Active Scanning Tool uses authenticated credentials to log in to a device or application to perform scanning.
      • Provides information that can’t be discovered remotely such as installed applications that aren’t running at a given time.
      • Best accuracy for vulnerability detection across a network.
      • Aggregation and centralization of authenticated credentials creates a major risk.
      • All use cases.
      Unauthenticated Active Scanning Scanning of devices without any authentication.
      • Emulates realistic scan by an attacker.
      • Provides limited scope of scanning.
      • Some compliance use cases.
      • Perform after either agent or authenticated scanning.
      Passive Scanning Scanning of network traffic.
      • Lowest resource impact.
      • Not enough information can be provided for true prioritization and remediation.
      • Augmenting scanning technique to agent or authenticated scanning.

      IP Management and IPv6

      IP management and the ability to manage IPv6 is a new area for scanning tool evaluation.

      Scanning on IPv4

      Scanning tools create databases of systems and devices with IP addresses.
      Info-Tech Recommends:

      • It is easier to do discovery by directing the scanner at a set IP address or range of IP addresses; thus, it’s useful to organize your database by IPs.
      • Do discovery by phases: Start with internet-facing systems. Your perimeter usually is well-defined by IP addresses and system owners and is most open to attack.
      • Stipulate a list of your known IP addresses through the DHCP registration and perform a scan on that.
      • Depending on your IP address space, another option is to scan your entire IP address space.

      Current Problem With IP Addresses

      IP addresses are becoming no longer manageable or even owned by organizations. They are often provided by ISPs or other third parties.

      Even if it is your range, chances are you don't do static IP ranges today.

      Info-Tech Recommends:

      • Agent-based scanning or MAC address-based scanning
      • Use your DHCP for scanning

      Scanning on IPv6

      First, you need to know if your organization is moving to IPv6. IPv6 is not strategically routed yet for most organizations.

      If you are moving to IPv6, Info-Tech recommends the following:

      • Because you cannot point a scanner at an IPv6 IP range, any scanning tool needs to have a strategy around how to handle IPv6 and properly scan based on IP ranges.
      • You need to know IPv4 to IPv6 translations.
      • Evaluate vulnerability scanning tools on whether any IPv6 features are on par with IPv4 features.

      If you are already on IPv6, Info-Tech recommends the following:

      • If you are on an IPv6 native network, it is nearly impossible to scan the network. You have to always scan your known addresses from your DHCP.

      4.3.1 Create an RFP for vulnerability scanning tools

      2 hours

      Input: List of key feature requirements for the new tool, List of intersect points with current software, Network topology and layout of servers and applications

      Output: Completed RFP document that can be distributed to vendor proponents

      Materials: Whiteboard/flip charts, Vulnerability Scanning Tool RFP Template

      Participants: IT Security Manager, IT operations managers, CISO, Procurement department representative

      Use a request for proposal (RFP) template to convey your desired scanning tool requirements to vendors and outline the proposal and procurement steps set by your organization.

      1. Determine what kind of requirements will be needed for your scanning tool RFP, based on people, process, and technology requirements.
      2. Consider items such as the desired capabilities and the scope of the scanning.
      3. Conduct interviews with relevant stakeholders to determine the exact requirements needed.
      4. Use Info-Tech’s Vulnerability Scanning Tool RFP Template. It lists many requirements but can be customized to your organization’s specific needs.

      Download the Vulnerability Scanning Tool RFP Template

      4.3.1 Create an RFP for vulnerability scanning tools (continued)

      Things to Consider:
      • Ensure there is adequate resource dedication to support and maintenance for vulnerability scanning.
      • Consider if you will benefit from an RFP. If there is a more appropriate option for your need and your organization, consider that instead.
      • If you don’t know the product you want, then perform an RFI.
      • In the RFP, you need to express your driving needs for the tool so the vendor can best understand your use case.
      • Identify who should participate in the RFP creation and evaluation. Make sure they have time available and it does not conflict with other items.
      • Determine if you want to send it to a select few or if you want to send it to a lot of vendors.
      • Determine a response date so you can know who is soliciting your business.
      • You need to have a process to handle questions from vendors.
      Info-Tech RFP Table of Contents:
      1. Statement of Work
      2. General Information
      3. Proposal Preparation Instructions
      4. Scope of Work, Specifications, and Requirements
      5. Vendor Qualifications and References
      6. Budget and Estimated Pricing
      7. Vendor Certification

      Download the Vulnerability Scanning Tool RFP Template

      Step 4.4

      Penetration testing

      Activities
      • 4.1.1 Create an RFP for penetration tests

      This step will walk you through the following activities:

      We will review penetration testing, its distinction from vulnerability management, and why you may want to engage a penetration testing service.

      We provide a request for proposal (RFP) template that we can review if this is an area of interest.

      This step involves the following participants:

      • IT Security Manager
      • SecOps team members
      • CISO
      • CIO

      Outcomes of this step

      An understanding of penetration testing, and guidance on how to get started if there is interest to do so.

      Measure and formalize
      Step 4.1 Step 4.2 Step 4.3 Step 4.4

      Penetration testing

      Penetration tests are critical parts of any strong security program.

      Penetration testing will emulate the methods an attacker would use in the real world to circumvent your security controls and gain access to systems and data.

      Penetration testing is much more than just running a scanner or other automated tools and then generating a report. Penetration testing performs critical exploit validation to create certainty around your vulnerability.

      The primary objective of a penetration test is to identify and validate security weaknesses in an organization’s security systems.

      Reasons to Test:

      • Assess current security control effectiveness
      • Develop an action plan of items
      • Build a business case for a better security program
      • Increased security budget through vulnerability validation
      • Third-party, unbiased validation
      • Adhere to compliance or regulatory requirements
      • Raise security awareness
      • Demonstrate how an attacker can escalate privileges
      • Effective way to test incident response

      Regulatory Considerations:

      • There is a lot of regulatory wording saying that organizations can’t get a system that is managed, integrated, and supported by one vendor and then have it tested by the same vendor.
      • There is the need for separate third-party testing.
      • Penetration testing is required for PCI, cloud providers, and federal entities.

      How and where is the value being generated?

      Penetration testing is a service provided by trained and tested professionals with years of experience. The person behind the test is the most important part of the test. The person is able to emulate a real-life attacker better than any computer. It is just a vulnerability scan if you use tools or executables alone.

      “A penetration test is an audit with validation.” (Joel Shapiro, Vice President Sales, Digital Boundary Group)

      Start by considering the spectrum of penetration tests

      Network Penetration Tests

      Conventional testing of network defences.

      Testing vectors include:

      • Perimeter infrastructure
      • Wireless, WEP/WPA cracking
      • Cloud penetration testing
      • Telephony systems or VoIP
      Types of tests:
      • Denial-of-service testing
      • Out-of-band attacks
      • War dialing
      • Wireless network testing/war driving
      • Spoofing
      • Trojan attacks
      • Brute force attacks
      • Watering hole attacks
      • Honeypots
      • Cloud-penetration testing
      Application Penetration Tests

      Core business functions are now being provided through web applications, either to external customers or to internal end users.

      Types: Web apps, non-web apps, mobile apps

      Application penetration and security testing encompasses:

      • Code review – analyzing the application code for sensitive information of vulnerabilities in the code.
      • Authorization testing – testing systems responsible for user session management to see if unauthorized access can be permitted.
      • Authentication process for user testing.
      • Functionality testing – test the application functionality itself.
      • Website pen testing – active analysis of weaknesses or vulnerabilities.
      • Encryption testing – testing things like randomness or key strength.
      • User-session integrity testing.
      Human-Centric Testing
      • Penetration testing is developing a people aspect as opposed to just being technology focused.
      • End users and their susceptibility to social engineering attacks (spear phishing, phone calls, physical site testing, etc.) is now a common area to test.
      • Social engineering penetration testing is not only about identifying your human vulnerabilities, but also about proactively training your end users. As well as discovering and fixing potential vulnerabilities, social engineering penetration testing will help to raise security awareness within an organization.

      Info-Tech Insight

      Your pen test should use multiple methods. Demonstrating weakness in one area is good but easy to identify. When you blend techniques, you get better success at breaching and it becomes more life-like. Think about prevention, detection, and response testing to provide full insight into your security defenses.

      Penetration testing types

      Evaluate four variables to determine which type of penetration test is most appropriate for your organization.

      Evaluate these dimensions to determine relevant penetration testing.

      Network, Application, or Human

      Evaluate your need to perform different types of penetration testing.

      Some level of network and application testing is most likely appropriate.

      The more common decision point is to consider to what degree your organization requires human-centric penetration testing.

      External or Internal

      External: Attacking an organization’s perimeter and internet-facing systems. For these, you generally provide some level of information to the tester. The test will begin with publicly available information gathering followed by some kind of network scanning or probing against externally visible servers or devices (DNS server, email server, web server, firewall, etc.)

      Internal: Carried out within the organization’s network. This emulates an attack originating from an internal point (disgruntled employee, authorized user, etc.). The idea is to see what could happen if the perimeter is breached.

      Transparent, Semi-Transparent, or Opaque Box

      Opaque Box: The penetration tester is not provided any information. This emulates a real-life attack. Test team uses publicly available information (corporate website, DNS, USENET, etc.) to start the test. These tests are more time consuming and expensive. They often result in exploitation of the easiest vulnerability.
      Use cases: emulating a real-life attack; testing detection and response capabilities; limited network segmentation.

      Transparent Box: Tester is provided full disclosure of information. The tester will have access to everything they need: building floor plans, data flow designs, network topology, etc. This represents what a credentialed and knowledgeable insider would do.
      Use cases: full assessment of security controls; testing of attacker traversal capabilities.

      Aggressiveness of the Test

      Not Aggressive: Very slow and careful penetration testing. Usually spread out in terms of packets being sent and number of calls to individuals. It attempts to not set off any alarm bells.

      Aggressive: A full DoS attack or something similar. These would be DoS attacks that take down systems or full SQL injection attacks all at once versus small injections over time. Testing options cover anything including physical tests, network tests, social engineering, and data extraction and exfiltration. This is more costly and time consuming.

      Assessing Aggressiveness: How aggressive the test should be is based on the threats you are concerned with. Assess who you are concerned with: random individuals on the internet, state-sponsored attacks, criminals, hacktivists, etc. Who you are concerned with will determine the appropriate aggressiveness of the test.

      Penetration testing scope

      Establish the scope of your penetration test before engaging vendors.

      Determining the scope of what is being tested is the most important part of a penetration test. Organizations need to be as specific as possible so the vendor can actually respond or ask questions.

      Organizations need to define boundaries, objectives, and key success factors.

      For scope:
      • If you go too narrow, the realism of the test suffers.
      • If you go too broad, it is more costly and there’s a possible increase in false positives.
      • Balance scope vs. budget.
      Boundaries to scope before a test:
      • IP addresses
      • URLs
      • Applications
      • Who is in scope for social engineering
      • Physical access from roof to dumpsters defined
      • Scope prioritized for high-value assets
      Objectives and key success factors to scope:
      • When is the test complete? Is it at the point of validated exploitation?
      • Are you looking for as many holes as possible, or are you looking for how many ways each hole can be exploited?

      What would be out of scope?

      • Are there systems, IP addresses, or other things you want out of scope? These are things you don’t explicitly want any penetration tester to touch.
      • Are there third-party connections to your environment that you don’t want to be tested? These are instances such as cloud providers, supply chain connections, and various services.
      • Are there things that would be awkward to test? For example, determine if you include high-level people in a social engineering test. Do you conduct social engineering for the CEO? If you get their credentials, it could be an awkward moment.

      Ways to break up a penetration test:

      • Location – This is the most common way to break up a penetration test.
      • Division – Self-contained business units are often done as separate tests so you can see how each unit does.
      • IT systems – For example, you put certain security controls in a firewall and want to test its effectiveness.
      • Applications – For example, you are launching a new website or a new portal and you want to test it.

      Penetration testing appropriateness

      Determine your penetration testing appropriateness.

      Usual instances to conduct a penetration test:
      • Setting up a new physical office. Penetration testing will not only test security capabilities but also resource availability and map out network flows.
      • New infrastructure hardware implemented. All new infrastructure needs to be tested.
      • Changes or upgrades to existing infrastructure. Need for testing varies depending on the size of the change.
      • New application deployment. Need to test before being pushed to production environments.
      • Changes or upgrades to existing applications. When fundamental functional changes occur, perform testing:
        • Before upgrades or patching
        • After upgrades or patching
      • Periodic testing. It is a best practice to periodically test your security control effectiveness. Consider at least an annual test.

      Specific timing considerations: Testing should be completed during non-production times of day. Testing should be completed after a backup has been performed.

      Assess your threats to determine your appropriate test type:

      Penetration testing is about what threats you are concerned about. Understand your risk profile, risk tolerance level, and specific threats to see how relevant penetration tests are.

      • Are external attackers concerning to you? Are you distressed about how an attacker can use brute force to enter your network? If so, focus on ingress points, such as FWs, routers, and DMZ.
      • Is social engineering a concern for you (i.e. phone-based or email-based)? Then you are concerned about a credentialed hacker.
      • Is it an insider threat, a disgruntled employee, etc.? This also includes an internal system that is under command and control (C&C).

      ANALYST PERSPECTIVE: Do a test only after you take a first pass.
      If you have not done some level of vulnerability assessment on your own (performing a scan, checking third-party sources, etc.) don’t waste your money on a penetration test. Only perform a penetration test after you have done a first pass and identified and remediated all the low-hanging fruit.

      4.4.1 Create an RFP for penetration tests

      2 hours

      Input: List of criteria and scope for the penetration test, Systems and application information if white box

      Output: Completed RFP document that can be distributed to vendor proponents

      Materials: Whiteboard/flip charts, Penetration Test RFP Template

      Participants: IT Security Manager, IT operations managers, CISO, Procurement department representative

      Use an RFP template to convey your desired penetration test requirements to vendors and outline the proposal and procurement steps set by your organization.

      1. Determine what kind of requirements will be needed for your penetration test RFP based on people, process, and technology requirements.
        • Consider items such as your technology environment and the scope of the penetration tests.
      2. Conduct an interview with relevant stakeholders to determine the exact requirements needed.
      3. Use Info-Tech’s Penetration Test RFP Template, which lists many requirements but can be customized to your organization’s specific needs.

      Download the Penetration Test RFP Template

      4.4.1 Create an RFP for penetration tests (continued)

      Steps of a penetration test:
      1. Determine scope
      2. Gather targeted intelligence
      3. Review exploit attempts, such as access and escalation
      4. Test the collection of sensitive data
      5. Run reporting
      Info-Tech RFP Table of Contents:
      1. Statement of Work
      2. General Information
      3. Proposal Preparation Instructions
      4. Scope of Work, Specifications, and Requirements
      5. Vendor Qualifications and References
      6. Budget and Estimated Pricing
      7. Vendor Certification

      Download the Penetration Test RFP Template

      Penetration testing considerations – service providers

      Consider what type of penetration testing service provider is best for your organization

      Professional Service Providers

      Professional Services Firms. These firms will often provide a myriad of professional services across auditing, financial, and consulting services. If they offer security-related consulting services, they will most likely offer some level of penetration testing.

      Security Service Firms. These are dedicated security consulting or advisory firms that will offer a wide spectrum of security-related services. Penetration testing may be one aspect of larger security assessments and strategy development services.

      Dedicated Penetration Testing Firms. These are service providers that will often offer the full gamut of penetration testing services.

      Integrators

      Managed Security Service Providers. These providers will offer penetration testing. For example, Dell SecureWorks offers numerous services including penetration testing. For organizations like this, you need to be skeptical of ulterior motives. For example, expect recommendations around outsourcing from Dell SecureWorks.

      Regional or Small Integrators. These are service providers that provide security services of some kind. For example, they would help in the implementation of a firewall and offer penetration testing services as well.

      Info-Tech Recommends:

      • Always be conscientious of who is conducting the testing and what else they offer. Even if you get another party to test rather than your technology provider, they will try to obtain you as a client. Remember that for larger technology vendors, security testing is a small revenue stream for them and it’s a way to find technology clients. They may offer penetration testing for free to obtain other business.
      • Most of the penetration testers were systems administrators (for network testing) or application developers (for application testing) at some point before becoming penetration testers. Remember this when evaluating providers and evaluating remediation recommendations.
      • Evaluate what kind of open-source tools, commercial tools, and proprietary tools are being used. In general, you don’t want to rely on an open-source scanner. For open source, they will have more outdated vulnerability databases, system identification can also be limited compared to commercial, and reporting is often lacking.
      • Above all else, ensure your testers are legally capable, experienced, and abide by non-disclosure agreements.

      Penetration testing best practices – communications

      Communication With Service Provider

      • During testing there should be designated points of contact between the service provider and the client.
      • There needs to be secure channels for communication of information between the tester and the client both during the test and for any results.
      • Results should always be explained to the client by the tester, regardless of the content or audience.
      • There should be a formal debrief with the results report.
      Immediate reporting of issues
      • Before any testing commences, immediate reporting conditions need to be defined. These are instances when you would want immediate notification of something occurring.
      • Stipulate certain systems or data types that if broken into or compromised, you would want to be notified right away.
      • Example:
        • If you are conducting social engineering, require notification for all account credentials that are compromised. Once credentials are compromised, it destroys all accountability for those credentials and the actions associated with those credentials by any user.
        • Require immediate reporting of specific high-critical systems that are compromised or if access is even found.
        • Require immediate reporting when regulated data is discovered or compromised in any way.

      Communication With Internal Staff

      Do you tell your internal staff that this is happening?

      This is sometimes called a “double blind test” when you don’t let your IT team know of the test occurring.

      Pros to notifying:
      • This tests the organization’s security monitoring, incident detection, and response capabilities.
      • Letting the team know they are going to see some activity will make sure they don’t get too worried about it.
      • There may be systems you can’t jeopardize but still need to test so notification beforehand is essential (e.g. you wouldn’t allow ERP testing with notification).
      Cons:
      • It does not give you a real-life example of how you respond if something happens.
      • Potential element of disrespect to IT people.

      Penetration testing best practices – results and remediation

      What to expect from penetration test results report:

      A final results report will state all findings including what was done by the testers, what vulnerabilities or exploitations were detected, how they were compromised, the related risk, and related remediation recommendations.

      Expect four major sections:
      • Introduction. An overview of the penetration test methodology including rating methodology of vulnerabilities.
      • Executive Summary. A management-level description of the test, often including a summary of any recommendations.
      • Technical Review. An overview of each item that was looked at and touched. This area breaks down what was done, how it was done, what was found, and any related remediation recommendations. Expect graphs and visuals in this section.
      • Detailed Findings. An in-depth breakdown of all testing methods used and results. Each vulnerability will be explained regarding how it was detected, what the risk is, and what the remediation recommendation is.
      Two areas that will vary by service provider:

      Prioritization

      • Most providers will boast their unique prioritization methodology.
      • A high, medium, and low rating scale based on some combination of variables (e.g. ease of exploitation, breadth of hole, information accessed resulting in further exploitation).
      • The prioritization won’t take into account asset value or criticality.
      • Keep in mind the penetration test is not an input into ultimate vulnerability prioritization, but it can help determine your urgency.

      Remediation

      • Remediation recommendations will vary across providers.
      • Generally, fairly generic recommendations are provided (e.g. remove your old telnet and input up-to-date SSH).
      • Most of the time, it is along the lines of “we found a hole; close the hole.”

      Summary of Accomplishment

      Problem Solved

      At the conclusion of this blueprint, you will have created a full vulnerability management program that will allow you to take a risk-based approach to vulnerability remediation.

      Assessing a vulnerability’s risk will enable you to properly determine the true urgency of a vulnerability within the context of your organization; this ensures you are not just blindly following what the tool is reporting.

      The risk-based approach will allow you to prioritize your discovered vulnerabilities and take immediate action on critical and high vulnerabilities while allowing your standard remediation cycle to address the medium to low vulnerabilities.

      With your program defined and developed, you now need to configure your vulnerability scanning tool or acquire one if you don’t already have a tool in place.

      Lastly, while vulnerability management will help address your systems and applications, how do you know if you are secure from external malicious actors? Penetration testing will offer visibility, allowing you to plug those holes and attain an environment with a smaller risk surface.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Photo of Jimmy Tom.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

      Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      Sample of the Implement Vulnerability Management storyboard.
      Review of the Implement Vulnerability Management storyboard
      Sample of the Vulnerability Mitigation SOP template.
      Build your vulnerability management SOP

      Contributors

      Contributors from 2016 version of this project:

      • Morey Haber, Vice President of Technology, BeyondTrust
      • Richard Barretto, Manager, Information Privacy and Security, Cimpress
      • Joel Shapiro, Vice President Sales, Digital Boundary Group

      Contributors from current version of this project:

      • 2 anonymous contributors from the manufacturing sector
      • 1 anonymous contributor from a US government agency
      • 2 anonymous contributors from the financial sector
      • 1 anonymous contributor from the medical technology industry
      • 2 anonymous contributors from higher education
      • 1 anonymous contributor from a Canadian government agency
      • 7 anonymous others; information gathered from advisory calls

      Bibliography

      Arya. “COVID-19 Impact: Vulnerability Management Solution Market | Strategic Industry Evolutionary Analysis Focus on Leading Key Players and Revenue Growth Analysis by Forecast To 2028 – FireMon, Digital Shadows, AlienVault.” Bulletin Line, 6 Aug. 2020. Accessed 6 Aug. 2020.

      Campagna, Rich. “The Lean, Mean Vulnerability Management Machine.” Security Boulevard, 31 Mar. 2020. Accessed 15 Aug. 2020.

      Constantin, Lucian. “What are vulnerability scanners and how do they work?” CSO Online, 10 Apr. 2020. Accessed 1 Sept. 2020.

      “CVE security vulnerabilities published in 2019.” CVE Details. Accessed 22 Sept. 2020.

      Garden, Paul, et al. “2019 Year End Report – Vulnerability QuickView.” Risk Based Security, 2020. Accessed 22 Sept. 2020.

      Keary, Eoin. “2019 Vulnerability Statistics Report.” Edgescan, Feb. 2019. Accessed 22 Sept. 2020.

      Lefkowitz, Josh. ““Risk-Based Vulnerability Management is a Must for Security & Compliance.” SecurityWeek, 1 July 2019. Accessed 1 Nov. 2020.

      Mell, Peter, Tiffany Bergeron, and David Henning. “Creating a Patch and Vulnerability Management Program.” Creating a Patch and Vulnerability Management Program. NIST, Nov. 2005. Web.

      “National Vulnerability Database.” NIST. Accessed 18 Oct. 2020.

      “OpenVAS – Open Vulnerability Assessment Scanner.” OpenVAS. Accessed 14 Sept. 2020.

      “OVAL.” OVAL. Accessed 21 Oct. 2020.

      Paganini, Pierluigi. “Exploiting and Verifying Shellshock: CVE-2014-6271.” INFOSEC, 27 Sept. 2014. Web.

      Pritha. “Top 10 Metrics for your Vulnerability Management Program.” CISO Platform, 28 Nov. 2019. Accessed 25 Oct. 2020.

      “Risk-Based Vulnerability Management: Understanding Vulnerability Risk With Threat Context And Business Impact.” Tenable. Accessed 21 Oct. 2020.

      Stone, Mark. “Shellshock In-Depth: Why This Old Vulnerability Won’t Go Away.” SecurityIntelligence, 6 Aug. 2020. Web.

      “The Role of Threat Intelligence in Vulnerability Management.” NOPSEC, 18 Sept. 2014. Accessed 18 Aug. 2020.

      “Top 15 Paid and Free Vulnerability Scanner Tools in 2020.” DNSstuff, 6 Jan. 2020. Accessed 15 Sept. 2020.

      Truta, Filip. “60% of Breaches in 2019 Involved Unpatched Vulnerabilities.” Security Boulevard, 31 Oct. 2019. Accessed 2 Nov. 2020.

      “Vulnerability Management Program.” Core Security. Accessed 15 Sept. 2020.

      “What is Risk-Based Vulnerability Management?” Balbix. Accessed 15 Sept. 2020.

      White, Monica. “The Cost Savings of Effective Vulnerability Management (Part 1).” Kenna Security, 23 April 2020. Accessed 20 Sept. 2020.

      Wilczek, Marc. “Average Cost of a Data Breach in 2020: $3.86M.” Dark Reading, 24 Aug. 2020. Accessed 5 Nov 2020.