Integrate IT Risk Into Enterprise Risk

Don’t fear IT risks, integrate them.

EXECUTIVE BRIEF

Analyst Perspective

Having siloed risks is risky business for any enterprise.

Valence Howden Principal Research Director, CIO Practice

Petar Hristov Research Director, Security, Privacy, Risk & Compliance

Ian Mulholland Research Director, Security, Risk & Compliance

Brittany Lutes Senior Research Analyst, CIO Practice

Ibrahim Abdel-Kader Research Analyst, CIO Practice

Every organization has a threshold for risk that should not be exceeded, whether that threshold is defined or not.

In the age of digital, information and technology will undoubtedly continue to expand beyond the confines of the IT department. As such, different areas of the organization cannot address these risks in silos. A siloed approach will produce different ways of identifying, assessing, responding to, and reporting on risk events. Integrated risk management is about embedding IT uncertainty to inform good decision making across the organization.

When risk is integrated into the organization's enterprise risk management program, it enables a single view of all risks and the potential impact of each risk event. More importantly, it provides a consistent view of the risk event in relation to uncertainty that might have once been seemingly unrelated to IT.

And all this can be achieved while remaining within the enterprise’s clearly defined risk appetite.

Executive Summary

Your Challenge

Most organizations fail to integrate IT risks into enterprise risks:

• IT risks, when considered, are identified and classified separately from the enterprise-wide perspective.
• IT is expected to own risks over which they have no authority or oversight.
• Poor behaviors, such as only considering IT risks when conducting compliance or project due diligence, have been normalized.

Common Obstacles

IT leaders have to overcome these obstacles when it comes to integrating risk:

• Making business leaders aware of, involved in, and able to respond to all enterprise risks.
• A lack of data or information being used to support a holistic risk management process.
• A low level of enterprise risk maturity.
• A lack of risk management capabilities.

Info-Tech’s Approach

By leveraging the Info-Tech Integrated Risk approach, your business can better address and embed risk by:

• Understanding gaps in the organization’s current approach to risk management practices.
• Establishing a standardized approach for how IT risks impact the enterprise as a whole.
• Driving a risk-aware organization toward innovation and considering alternative options for how to move forward.
• Helping integrate IT risks into the foundational risk practice.

Info-Tech Insight

Stop avoiding risk – integrate it. This provides a holistic view of uncertainty for the organization to drive innovative new approaches to optimize its ability to respond to risk.

What is integrated risk management?

• Integrated risk management is the process of ensuring all forms of risk information, including information and technology, are considered and included in the enterprise’s risk management strategy.
• It removes the siloed approach to classifying risks related to specific departments or areas of the organization, recognizing that each of those risks is a threat to the overarching enterprise.
• Aggregating the different threats or uncertainty that might exist within an organization allows for informed decisions to be made that align to strategic goals and continue to drive value back to the business.
• By holistically considering the different risks, the organization can make informed decisions on the best course of action that will reduce any negative impacts associated with the uncertainty and increase the overall value.

Enterprise Risk Management (ERM)

• IT
• Security
• Digital
• Vendor/Third Party
• Other

Enterprise risk management is the practice of identifying and addressing risks to your organization and using risk information to drive better decisions and better opportunities.

IT risk is enterprise risk

IT risks have a direct and often aggregated impact on enterprise risks and opportunities in the same way other business risks can. This relationship must be understood and addressed through integrated risk management to ensure a consistent approach to risk.

Your challenge

Embedding IT risks into the enterprise risk management program is challenging because:

• Most organizations classify risks based on the departments or areas of the business where the uncertainty is likely to happen.
• Unnecessary expectations are placed on the IT department to own risks over which they have no authority or oversight.
• Risks are often only identified when conducting due diligence for a project or ensuring compliance with regulations and standards.

Risk-mature organizations have a unique benefit in that they often have established an overarching governance framework and embedded risk awareness into the culture.

35% — Only 35% of organizations had embraced ERM in 2020. (Source: AICPA and NC State Poole College of Management)

12% — Only 12% of organizations are leveraging risk as a tool to their strategic advantage. (Source: AICPA and NC State Poole College of Management)

Common obstacles

These barriers make integrating IT risks difficult to address for many organizations:

• IT risks are not seen as enterprise risks.
• The organization’s culture toward risk is not defined.
• The organization’s appetite and threshold for risk are not defined.
• Each area of the organization has a different method of identifying, assessing, and responding to risk events.
• Access to reliable and informative data to support risk management is difficult to obtain.
• Leadership does not see the business value of integrating risk into a single management program.
• The organization’s attitudes and behaviors toward risk contradict the desired and defined risk culture.
• Skills, training, and resources to support risk management are lacking, let alone those to support integrated risk management.

Integrating risks has its challenges

62% — Accessing and disseminating information is the main challenge for 62% of organizations maturing their organizational risk management. (Source: OECD)

20-28% — Organizations with access to machine learning and analytics to address future risk events have 20 to 28% more satisfaction. (Source: Accenture)

Integrate Risk and Use It to Your Advantage

Accelerate and optimize your organization by leveraging meaningful risk data to make intelligent enterprise risk decisions.

Risk management is more than checking an audit box or demonstrating project due diligence.

Risk Drivers Audit & compliance Preserve value & avoid loss Previous risk impact driver Major transformation Strategic opportunities		Only 7% of organizations are in a “leading” or “aspirational” level of risk maturity. (OECD, 2021)	63% of organizations struggle when it comes to defining their appetite toward strategy related risks. (“Global Risk Management Survey,” Deloitte, 2021)	Late adopters of risk management were 70% more likely to use instinct over data or facts to inform an efficient process. (Clear Risk, 2020)	55% of organizations have little to no training on ERM to properly implement such practices. (AICPA, NC State Poole College of Management, 2021)
		1. Assess Enterprise Risk Maturity	3. Build a Risk Management Program Plan	4. Establish Risk Management Processes	5. Implement a Risk Management Program
		2. Determine Authority with Governance Unfortunately, less than 50% of those in risk focused roles are also in a governance role where they have the authority to provide risk oversight. (Governance Institute of Australia, 2020)
IT can improve the maturity of the organization’s risk governance and help identify risk owners who have authority and accountability. Governance and related decision making is optimized with integrated and aligned risk data.			ERM incorporates the different types of risk, including IT, security, digital, vendor, and other risk types. The program plan is meant to consider all the major risk types in a unified approach.		Implementation of an integrated risk management program requires ongoing access to risk data by those with decision making authority who can take action.

Integrated Risk Mapping — Downside Risk Focus

Integrated Risk Mapping — Downside and Upside Risk

Third-Party Risk Example

Insight Summary

Overarching insight

Stop fearing risk – integrate it. Integration leads to opportunities for organizations to embrace innovation and new digital technologies as well as reducing operational costs and simplifying reporting.

Govern risk strategically

Governance of risk management for information- and technology-related events is often misplaced. Just because it's classified as an IT risk does not mean it shouldn’t be owned by the board or business executive.

Assess risk maturity

Integrating risk requires a baseline of risk maturity at the enterprise level. IT can push integrating risks, but only if the enterprise is willing to adopt the attitudes and behaviors that will drive the integrated risk approach.

Manage risk

It is not a strategic decision to have different areas of the organization manage the risks perceived to be in their department. It’s the easy choice, but not the strategic one.

Implement risk management

Different areas of an enterprise apply risk management processes differently. Determining a single method for identification, assessment, response, and monitoring can ensure successful implementation of enterprise risk management.

Tactical insight

Good risk management will consider both the positives and negatives associated with a risk management program by recognizing both the upside and downside of risk event impact and likelihood.

Integrated risk benefits

Measure the value of integrating risk

• Reduce Operating Costs

  • Organizations can reduce their risk operating costs by 20 to 30% by adopting enterprise-wide digital risk initiatives (McKinsey & Company).

• Increase Cybersecurity Threat Preparedness

  • Increase the organization’s preparedness for cybersecurity threats. 79% of organizations that were impacted by email threats in 2020 were not prepared for the hit (Diligent)

• Increase Risk Management’s Impact to Drive Strategic Value

  • Currently, only 3% of organizations are extensively using risk management to drive their unique competitive advantage, compared to 35% of companies who do not use it at all (AICPA & NC State Poole College of Management).

• Reduce Lost Productivity for the Enterprise

  • Among small businesses, 76% are still not considering purchasing cyberinsurance in 2021, despite the fact that ransomware attacks alone cost Canadian businesses $5.1 billion in productivity in 2020 (Insurance Bureau of Canada, 2021).

“31% of CIO’s expected their role to expand and include risk management responsibilities.” (IDG “2021 State of the CIO,” 2021)

Make integrated risk management sustainable

Assessment

Assess your organization’s method of addressing risk management to determine if integrated risk is possible

Assessing the organization’s risk maturity

Mature or not, integrated risk management should be a consideration for all organizations The first step to integrating risk management within the enterprise is to understand the organization’s readiness to adopt practices that will enable it to successfully integrate information. In 2021, we saw enterprise risk management assessments become one of the most common trends, particularly as a method by which the organization can consolidate the potential impacts of uncertainties or threats (Lawton, 2021). A major driver for this initiative was the recognition that information and technology not only have enterprise-wide impacts on the organization’s risk management but that IT has a critical role in supporting processes that enable effective access to data/information. A maturity assessment has several benefits for an organization: It ensures there is alignment throughout the organization on why integrated risk is the right approach to take, it recognizes the organization’s current risk maturity, and it supports the organization in defining where it would like to go.

Maturity should inform your approach to risk management

The outcome of the risk maturity assessment should inform how risk management is approached within the organization.

For organizations with a low maturity, remaining superficial with risk will offer more benefits and align to the enterprise’s risk tolerance and appetite. This might mean no integrated risk is taking place.

However, organizations that have higher risk maturity should begin to integrate risk information. These organizations can identify the nuances that would affect the severity and impact of risk events.

Integrated Risk Maturity Assessment

The purpose of the Integrated Risk Maturity Assessment is to assess the organization's current maturity and readiness for integrated risk management (IRM).

Frequently and continually assessing your organization’s maturity toward integrated risk ensures the right risk management program can be adopted by your organization.

Integrated Risk Maturity Assessment A simple tool to understand if your organization is ready to embrace integrated risk management by measuring maturity across four key categories: Context & Strategic Direction, Risk Culture & Authority, Risk Management Process, and Risk Program Optimization

Use the results from this integrated risk maturity assessment to determine the type of risk management program that can and should be adopted by your organization.

Some organizations will need to remain siloed and focused on IT risk management only, while others will be able to integrate risk-related information to start enabling automatic controls that respond to this data.

Define the Role of Project Management in Agile and Product-Centric Delivery

Projects and products are not mutually exclusive.

Table of Contents

3 Analyst Perspective

4 Executive Summary

7 Step 1.1: Clarify How You Want to Talk About Projects and Products

13 Step 1.2: Align Project Management and Agility

16 Step 1.3: Specify the Different Activities for Project Management

20 Step 1.4: Identify Key Differences in Funding of Products Instead of Projects

25 Where Do I Go Next?

26 Bibliography

Analyst Perspective

Project management still has an important role to play!

When moving to more product-centric delivery practices, many assume that projects are no longer necessary. That isn’t necessarily the case!

Product delivery can mean different things to different organizations, and in many cases it can involve the need to maintain both projects and project delivery.

Projects are a necessary vehicle in many organizations to drive value delivery, and the activities performed by project managers still need to be done by someone. It is the form and who is involved that will change the most.

Ari Glaizel Practice Lead, Applications Delivery and Management Info-Tech Research Group

Executive Summary

Info-Tech Insight

There is no one-size-fits-all approach to product delivery. For many organizations product delivery requires detailed project management practices, while for others it requires much less. Taking an outcome-first approach when planning your product transformation is critical to make the right decision on the balance between project and product management.

Your evolution of delivery practice is not a binary switch

1. PROJECTS WITH WATERFALL The project manager is accountable for delivery of the project, and the project manager owns resources and scope.
2. PROJECTS WITH AGILE DELIVERY A transitional state where the product owner is accountable for feature delivery and the project manager accountable for the overall project.
3. PRODUCTS WITH AGILE PROJECT AND OPERATIONAL DELIVERY The product owner is accountable for the delivery of the project and products, and the project manager plays a role of facilitator and enabler.
4. PRODUCTS WITH AGILE DELIVERY Delivery of products can happen without necessarily having projects. However, projects could be instantiated to cover major initiatives.

Info-Tech Insight

• Organizations do not need to go to full product and Agile delivery to improve delivery practices! Every organization needs to make its own determination on how far it needs to go. You can do it in one step or take each step and evaluate how well you are delivering against your goals and objectives.
• Many organizations will go to Products With Agile Project and Operational Delivery, and some will go to Products With Agile Delivery.

Activities to undertake as you transition to product-centric delivery

1. PROJECTS WITH WATERFALL
   • Clarify how you want to talk about projects and products. The center of the conversation will start to change.
2. PROJECTS WITH AGILE DELIVERY
   • Align project management and agility. They are not mutually exclusive (but not necessarily always aligned).
3. PRODUCTS WITH AGILE PROJECT AND OPERATIONAL DELIVERY
   • Specify the different activities for project management. As you mature your product practices, project management becomes a facilitator and collaborator.
4. PRODUCTS WITH AGILE DELIVERY
   • Identify key differences in funding. Delivering products instead of projects requires a change in the focus of your funding.

Step 1.1

Clarify How You Want to Talk About Projects and Products

Activities

• 1.1.1 Define “product” and “project” in your context
• 1.1.2 Brainstorm potential changes in the role of projects as you become Agile and product-centric

This step involves the following participants:

• Product owners
• Product managers
• Development team leads
• Portfolio managers
• Business analysts

Outcomes of this step

• An understanding of how the role can change through the evolution from project to more product-centric practices

Definition of terms

Project “A temporary endeavor undertaken to create a unique product, service, or result. The temporary nature of projects indicates a beginning and an end to the project work or a phase of the project work. Projects can stand alone or be part of a program or portfolio.” (PMBOK, PMI)

Product “A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements.” (Deliver on Your Digital Product Vision, Info-Tech Research Group)

Info-Tech InsightLet these definitions be a guide, not necessarily to be taken verbatim. You need to define these terms in your context based on your particular needs and objectives. The only caveat is to be consistent with your usage of these terms in your organization.

1.1.1 Define “product” and “project” in your context

Output: Your enterprise/organizational definition of products and projects

Participants: Executives, Product/project managers, Applications teams

1. Discuss what “product” and “project” mean in your organization.
2. Create common, enterprise-wide definitions for “product” and “project.”

Agile and product management does not mean projects go away

Projects Within Products

Regardless of whether you recognize yourself as a “product-based” or “project-based” shop, the same basic principles should apply.

You go through a period or periods of project-like development to build or implement a version of an application or product.

You also have parallel services along with your project development that encompass the more product-based view. These may range from basic support and maintenance to full-fledged strategy teams or services like sales and marketing.

Info-Tech Note

As your product transformation continues, projects can become optional and needed only as part of your organization’s overall delivery processes

Identify the differences between a project-centric and a product-centric organization

Info-Tech Insight

Product delivery requires significant shifts in the way you complete development and implementation work and deliver value to your users. Make the changes that support improving end-user value and enterprise alignment.

1.1.2 Brainstorm potential changes in the role of projects as you become Agile and product-centric

5-10 minutes

Output: Increased appreciation of the relationship between project and product delivery

Participants: Executives, Product/project managers, Applications teams

• Discuss as a group:
  • What stands out in the evolution from project to product?
  • What concerns do you have with the change?
  • What will remain the same?
  • Which changes feel the most impactful?
  

Step 1.2

Align Project Management and Agility

Activities

• 1.2.1 Explore gaps in Agile/product-centric delivery of projects

This step involves the following participants:

• Executives
• Product/Project managers
• Applications teams

Outcomes of this step

• A clearer view of how agility can be introduced into projects.

Challenges with the project management role in Agile and product-centric organizations

Many project managers feel left out in the cold. That should not be the case!

In product-centric, Agile teams, many roles that a project manager previously performed are now taken care of to different degrees by the product owner, delivery team, and process manager.

The overall change alters the role of project management from one that orchestrates all activities to one that supports, monitors, and escalates.

Product Owner

• Defines the “what” and heavily involved in the “when” and the “why”
• Accountable for delivery of value

Delivery team members

• Define the “how”
• Accountable for building and delivering high-quality deliverables
• Can include roles like user experience, interaction design, business analysis, architecture

Process Manager

• Facilitates the other teams to ensure valuable delivery
• Can potentially, in a Scrum environment, play the scrum master role, which involves leading scrums, retrospectives, and sprint reviews and working to resolve team issues and impediments
• Evolves into more of a facilitator and communicator role

1.2.1 Explore gaps in Agile/ product-centric delivery of projects

5-10 minutes

Output: An assessment of what is in the way to effectively deliver on Agile and product-focused projects

Participants: Executives, Product/project managers, Applications teams

• Discuss as a group:
  • What project management activities do you see in Agile/product roles?
  • What gaps do you see?
  • How can project management help Agile/product teams be successful?

Step 1.3

Specify the Different Activities for Project Management

Activities

• 1.3.1 Articulate the changes in a project manager’s role

This step involves the following participants:

• Executives
• Product/Project managers
• Applications teams

Outcomes of this step

• An understanding of the role of project management in an Agile and product context

Kicking off the project

Product-centric delivery still requires key activities to successfully deliver value. Where project managers get their information from does change.

Project Charter Project managers should still define a charter and capture the vision and scope. The vision and high-level scope is primarily defined by the product owner. Key Stakeholders and Communication Clearly defining stakeholders and communication needs is still important. However, they are defined based on significant input and cues by the product owner. Standardizing on Tools and Processes To ensure consistency across projects, project managers will want to align tools to how the team manages their backlog and workflow. This will smooth communication about status with stakeholders.

Info-Tech Insight

1. Product management plays a similar role to the one that was traditionally filled by the project sponsor except for a personal accountability to the product beyond the life of the project.
2. When fully transitioned to product-centric delivery, these activities could be replaced by a product canvas. See Deliver on Your Digital Product Vision for more information.

During the project: Three key activities

The role of project management evolves from a position of ownership to a position of communication, collaboration, and coordination.

Support Communicate Agile/product team needs to leadership Liaise and co-ordinate for non-Agile/product-focused parts of the organization Coach members of the team Monitoring Regular status updates to PMO still required Metrics aligned with Agile/product practices Leverage similar tooling and approaches to what is done locally on Agile/product teams (if possible) Escalation Still a key escalation point for roadblocks that go outside the product teams Collaborate closely with Agile/product team leadership and scrum masters (if applicable)

1.3.1: Articulate the changes in a project manager’s role

5-10 minutes

Output: Current understanding of the role of project management in Agile/product delivery

Participants: Executives, Product/project managers, Applications teams

Why is this important?

Project managers still have a role to play in Agile projects and products. Agreeing to what they should be doing is critical to successfully moving to a product-centric approach to delivery.

• Review how Info-Tech views the role of project management at project initiation and during the project.
• Review the state of your Agile and product transformation, paying special attention to who performs which roles.
• Discuss as a group:
  • What are the current activities of project managers in your organization?
  • Based on how you see delivery practices evolving, what do you see as the new role of project managers when it comes to Agile-centric and product-centric delivery.

Step 1.4

Identify Key Differences in Funding of Products Instead of Projects

Activities

• 1.4.1 Discuss traditional versus product-centric funding methods

This step involves the following participants:

• Executives
• Product owners
• Product managers
• Project managers
• Delivery managers

Outcomes of this step

• Identified differences in funding of products instead of projects

Planning and budgeting for products and families

Reward for delivering outcomes, not features

Autonomy Fund what delivers value Fund long-lived delivery of value through products (not projects). Give autonomy to the team to decide exactly what to build.

Flexibility Allocate iteratively Allocate to a pool based on higher-level business case. Provide funds in smaller amounts to different product teams and initiatives based on need.

Accountability Measure and adjust Product teams define metrics that contribute to given outcomes. Track progress and allocate more (or less) funds as appropriate.

Info-Tech Insight Changes to funding require changes to product and Agile practices to ensure product ownership and accountability.

(Adapted from Bain & Company)

Budgeting approaches must evolve as you mature your product operating environment

Info-Tech Insight

As you evolve your approach to product delivery, you will be decoupling the expected benefits, forecast, and budget. Managing them independently will improve your ability adapt to change and drive the right outcomes!

1.4.1 Discuss traditional versus product-centric funding methods

Output: Understanding of funding principles and challenges

Participants: Executives, Product owners, Product managers, Project managers, Delivery managers

1. Discuss how projects are currently funded.
2. Review how the Agile/product funding models differ from how you currently operate.
3. What changes do you need to consider to support a product delivery model?
4. For each change, identify the key stakeholders and list at least one action to take.

Case Study

Global Digital Financial Services Company This financial services company looked to drive better results by adopting more product-centric practices. Its projects exhibited: High complexity/strong dependencies between components High implementation effort High clarification/reconciliation (more than two departments involved) Multiple methodologies (Agile/Waterfall/Hybrid) The team recognized they could not get rid of projects entirely, but getting to a level where there was a coordinated delivery between projects and products being implemented is important. Results Moving several initiatives to more product-centric practices allowed for: Delivery within current assigned capacity Limited need for coordination across departments Lower complexity A unified Agile approach to delivery Through balancing the needs of projects and products, there were three key insights about the project management’s role: The role of project management changes depending on the context of the work. There is no one-size-fits-all definition. Project management played a much bigger role when work spanned multiple products and business units. Project management was used as a key coordinator when delivery became complicated and multilayered.

Where Do I Go Next?

Bibliography

Cobb, Chuck. “Are there Project Managers in Agile?” High Impact Project Management, n.d. Web.

Cohn, Mike. “What Is a Product?” Mountain Goat Software, 6 Sept. 2016. Web.

Cobb, Chuck. “Agile Project Manager Job Description.” High Impact Project Management, n.d. Web.

“How do you define a product?” Scrum.org, 4 April 2017. Web.

Johnson, Darren, et al. “How to Plan and Budget for Agile at Scale.” Bain & Company, 8 Oct. 2019. Web.

“Product Definition.” SlideShare, uploaded by Mark Curphey, 25 Feb. 2007. Web.

Project Management Institute. A Guide to the Project Management Body of Knowledge (PMBOK Guide). 7th ed., Project Management Institute, 2021.

Schuurman, Robbin. “Scrum Master vs Project Manager – An Overview of the Differences.” Scrum.org, 11 Feb 2020. Web.

Schuurman, Robbin. “Product Owner vs Project Manager.” Scrum.org, 12 March 2020. Web.

Vlaanderen, Kevin. “Towards Agile Product and Portfolio Management.” Academia.edu, 2010. Web.

“What is a Developer in Scrum?” Scrum.org, n.d. Web.

“What is a Scrum Master?” Scrum.org, n.d. Web.

“What is a Product Owner?” Scrum.org, n.d. Web.

Create a Buyer Persona and Journey

Make it easier to market, sell, and achieve product-market fit with deeper buyer understanding.

EXECUTIVE BRIEF

Executive Summary

Your Challenge

B2B marketers without documented personas and journeys often experience the following:

• Contacts fail to convert to leads because messaging fails to resonate with buyers.
• Products fail to reach targets given shallow understanding of buyer needs.
• Sellers’ emails go unopened, and attempts at discovery fail due to no understanding of buyer challenges, pain points, and needs.

Without a deeper understanding of buyer needs and how they buy, B2B marketers will waste time and precious resources targeting the incorrect personas.

Common Obstacles

Despite being critical elements, organizations struggle to build personas due to:

• A lack of alignment and collaboration among marketing, product, and sales.
• An internal focus; or a lack of true customer centricity.
• A lack of tools and techniques for building personas and buyer journeys.

In today’s Agile development environment, combined with the pressure to generate revenues quickly, high tech marketers often skip the steps necessary to go deeper to build buyer understanding.

SoftwareReviews’ Approach

With a common framework and target output, clients will:

• Align marketing, sales, and product, and collaborate together to share current knowledge on buyer personas and journeys.
• Target 12-15 customers and prospects to interview and validate insights. Share that with customer-facing staff.
• Activate the insights for more customer-centric lead generation, product development, and selling.

Clients who activate findings from buyer personas and journeys will see a 50% results improvement.

SoftwareReviews Insight:
Buyer personas and buyer journeys are essential ingredients in go-to-market success, as they inform for product, marketing, sales, and customer success who we are targeting and how to engage with them successfully.

Buyer personas and journeys: A go-to-market critical success factor

Marketers – large and small – will fail to optimize product-market fit, lead generation, and sales effectiveness without well-defined buyer personas and a buyer journey.

Critical Success Factors of a Successful G2M Strategy:

• Opportunity size and business case
• Buyer personas and journey
• Competitively differentiated product hypothesis
• Buyer-validated commercial concept
• Sales revenue plan and program cost budget
• Consolidated communications to steering committee

Jeff Golterman, Managing Director, SoftwareReviews Advisory

“44% of B2B marketers have already discovered the power of Personas.”
– Hasse Jansen, Boardview.io!, 2016

Documenting buyer personas enables success beyond marketing

Documenting buyer personas has several essential benefits to marketing, sales, and product teams:

• Achieve a better understanding of your target buyer – by building a detailed buyer persona for each type of buyer and keeping it fresh, you take a giant step toward becoming a customer-centric organization.
• Team alignment on a common definition – will happen when you build buyer personas collaboratively and among those teams that touch the customer.
• Improved lead generation – increases dramatically when messaging and marketing assets across your lead generation engine better resonate with buyers because you have taken the time to understand them deeply.
• More effective selling – is possible when sellers apply persona development output to their interactions with prospects and customers.
• Better product-market fit – increases when product teams more deeply understand for whom they are designing products. Documenting buyer challenges, pain points, and unmet needs gives product teams what they need to optimize product adoption.

“It’s easier buying gifts for your best friend or partner than it is for a stranger, right? You know their likes and dislikes, you know the kind of gifts they’ll have use for, or the kinds of gifts they’ll get a kick out of. Customer personas work the same way, by knowing what your customer wants and needs, you can present them with content targeted specifically to their wants and needs.”
– Emma Bilardi, Product Marketing Alliance, 2020

Buyer understanding activates just about everything

Without the deep buyer insights that persona and journey capture enables, marketers are suboptimized.

Buyer Persona and Journey

• Product design
• Customer targeting
• Personalization
• Messaging
• Content marketing
• Lead gen & scoring
• Sales Effectiveness
• Customer retention

“Marketing eutopia is striking the all-critical sweet spot that adds real value and makes customers feel recognized and appreciated, while not going so far as to appear ‘big brother’. To do this, you need a deep understanding of your audience coming from a range of different data sets and the capability to extract meaning.”
– Plexure, 2020

Does your organization need buyer persona and journey updating?

“Yes,” if experiencing one or more key challenges:

• Sales time is wasted on unqualified leads
• Website abandon rates are high
• Lead gen engine click-through rates are low
• Ideal customer profile is ill defined
• Marketing asset downloads are low
• Seller discovery with prospects is ineffective
• Sales win/loss rates drop due to poor product-market fit
• Higher than desired customer churn

SoftwareReviews Advisory Insight:
Marketers developing buyer personas and journeys that lack agreement among Marketing, Sales, and Product of personas to target will squander precious time and resources throughout the customer targeting and acquisition process.

Outcomes and benefits

Building your buyer persona and journey using our methodology will enable:

• Greater stakeholder alignment – when marketing, product, and sales agree on personas, less time is wasted on targeting alternate personas.
• Improved product-market fit – when buyers see both pain-relieving features and value-based pricing, “because you asked vs. guessed,” win rates increase.
• Greater open and click-through rates – because you understood buyer pain points and motivations for solution seeking, you’ll see higher visits and engagement with your lead gen engine, and because you asked “what asset types do you find most helpful” your CTAs become ”lead-gen magnets” because you’ve offered the right asset types in your content marketing strategy.
• More qualified leads – because you defined a more accurate ideal customer profile (ICP) and your lead scoring algorithm has improved, sellers see more qualified leads.
• Increased sales cycle velocity – since you learned from personas their content and engagement preferences and what collateral types they need during the down-funnel sales discussions, sales calls are more productive and sales cycles shrink.

Our methodology for buyer persona and journey creation

Our approach provides interview guides and templates to help rebuild buyer persona

Our methodology will enable you to align your team on why it’s important to capture the most important attributes of buyer persona including:

• Functional – helps you find and locate your target personas
• Emotive – deepens team understanding of buyer initiatives, motivations for seeking alternatives, challenges they face, pain points for your offerings to address, and terminology that describes the “space”
• Solution – enables greater product market fit
• Behavioral – clarifies how to communicate with personas and understand their content preferences

Buyer journeys are constantly shifting

If you didn’t remap buyer journeys in 2021, you may be losing to competitors that did. Leaders remap buyer journey frequently.

• The multi-channel buyer journey is constantly changing. Today’s B2B buyer uses industry research sites, vendor content marketing assets, software reviews sites, contacts with vendor salespeople, events participation, peer networking, consultants, emails, social media sites, and electronic media to research purchasing decisions.
• COVID-19 has dramatically decreased face-to-face interaction. We estimate a B2B buyer spent 20-25% more time online in 2021 than pre-COVID-19 researching software buying decisions. This has diminished the importance of face-to-face selling and given dramatic rise to digital selling and outbound marketing.
• Content marketing has exploded, but without mapping the buyer journey and knowing where – by channel –and when – by buyer journey step – to offer content marketing assets, we will fail to convert prospects into buyers.

“~2/3 of [B2B] buyers prefer remote human interactions or digital self-service.” And during Aug. ‘20 to Feb. ‘21, use of digital self-service to interact with sales reps leapt by more than 10% for both researching and evaluating new suppliers.”
– Liz Harrison, Dennis Spillecke, Jennifer Stanley, and Jenny Tsai McKinsey & Company, 2021

SoftwareReviews Advisory Insight:
Marketers are advised to update their buyer journey annually and with greater frequency when the human vs. digital mix is affected due to events such as COVID-19 and as emerging media such as AR shifts asset-type usage and engagement options.

Our approach helps you define the buyer journey

Because marketing leaders need to reach buyers through the right channel with the right message at the right time during their decision cycle, you’ll benefit by using questionnaires that enable you to build the below easily and quickly.

You’ll be more successful by following our overall guidance

Overarching insight

Buyer personas and buyer journeys are essential ingredients in go-to-market success, as they inform for product, marketing, sales, and customer success who we are targeting and how to engage with them successfully.

Align Your Team

Marketers developing buyer personas and journeys that lack agreement among Marketing, Sales, and Product of personas to target will squander precious time and resources throughout the customer targeting and acquisition process.

Jump-Start Persona Development

Marketing leaders leverage the buyer persona knowledge not only from in-house experts in areas such as sales and executives but from analysts that speak with their buyers each and every day.

Buyer Interviews Are a Must

While leaders will get a fast start by interviewing sellers, executives, and analysts, you will fail to craft the right messages, build the right marketing assets, and design the best buyer journey if you skip buyer interviews.

Watch for Disruption

Leaders will update their buyer journey annually and with greater frequency when the human vs. digital mix is effected due to events such as COVID-19 and as emerging media such as AR and VR shifts the way buyers engage.

Advanced Buyer Journey Discovery

Digital marketers that ramp up lead gen engine capabilities to capture “wins” and measure engagement back through the lead gen and nurturing engines will build a more data-driven view of the buyer journey. Target to build this advanced capability in your initial design.

Tools and templates to speed your success

This blueprint is accompanied by supporting deliverables to help you gather team insights, interview customers and prospects, and summarize results for ease in communications.

To support your buyer persona and journey creation, we’ve created the enclosed tools

Buyer Persona Creation Template

A PowerPoint template to aid the capture and summarizing of your team’s insights on the buyer persona.

Buyer Persona and Journey Interview Guide and Data Capture Tool

For interviewing customers and prospects, this tool is designed to help you interview personas and summarize results for up to 15 interviewees.

Buyer Persona and Journey Summary Template

A PowerPoint template into which you can drop your buyer persona and journey interviewees list and summary findings.

SoftwareReviews offers two levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

The "do-it-yourself" step-by-step instructions begin with Phase 1.

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

A Guided Implementation is a series of analysts inquiries with you and your team.

Diagnostics and consistent frameworks are used throughout each option.

Guided Implementation

A Guided Implementation (GI) is series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization.

For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst.

Your engagement managers will work with you to schedule analyst calls.

What does our GI on buyer persona and journey mapping look like?

Drive an Aligned Initial Draft of Buyer Persona

• Call #1: Collaborate on vision for buyer persona and the buyer journey. Review templates and sample outputs. Identify your team.
• Call #2: Review work in progress on capturing working team knowledge of buyer persona elements.
• Call #3: (Optional) Review Info-Tech’s research-sourced persona insights.
• Call #4: Validate the persona WIP with Info-Tech analysts. Review buyer interview approach and target list.

Interview Buyers and Validate Persona and Journey

• Call #5: Revise/review interview guide and final interviewee list; schedule interviews.
• Call #6: Review interim interview finds; adjust interview guide.
• Call #7: Use interview findings to validate/update persona and build journey map.
• Call #8: Add supporting analysts to final stakeholder review.

Prepare Communications and Educate Stakeholders

• Call #9: Review output templates completed with final persona and journey findings.
• Call #10: Add supporting analysts to stakeholder education meetings for support and help with addressing questions/issues.

Workshop overview

Contact your account representative for more information. workshops@infotech.com 1-888-670-8889

Phase 1
Drive an Aligned Initial Draft of Buyer Persona

This Phase walks you through the following activities:

• Develop an understanding of what comprises a buyer persona and journey, including their importance to overall go-to-market strategy and execution.
• Sample outputs.

This Phase involves the following stakeholders:

• Program leadership
• Product Marketing
• Product Management
• Representative(s) from Sales
• Executive Leadership

1.1 Establish the team and align on shared vision

Input

• Typically a joint recognition that buyer personas have not been fully documented.
• Identify working team members/participants (see below), and an executive sponsor.

Output

• Communication of team members involved and the make-up of steering committee and working team
• Alignment of team members on a shared vision of “Why Build Buyer Personas and Journey” and what key attributes define both.

Materials

• N/A

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• CMO/Sponsoring Executive Working Team – typically representatives in Product Marketing, Product Management, and Sales
• SoftwareReviews marketing analyst

60 minutes

1. Schedule inquiry with working team members and walk the team through the Buyer Persona and Journey Executive Brief PowerPoint presentation.
2. Optional: Have the (SoftwareReviews Advisory) SRA analyst walk the team through the Buyer Persona and Journey Executive Brief PowerPoint presentation as part of your session.

Review the Create a Buyer Persona Executive Brief (Slides 3-14)

1.2 Document team knowledge of buyer persona

Input

• Working team member knowledge

Output

• Initial draft of your buyer persona

Materials

• Buyer Persona Creation Template

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• CMO/Sponsoring Executive (optional)
• Working Team – typically representatives in Product Marketing, Product Management, and Sales

2-3 sessions of 60 minutes each

1. Schedule meeting with working team members and, using the Buyer Persona Template, lead the team in a discussion that documents current team knowledge of the target buyer persona.
2. Lead the team to prioritize an initial, single, most important persona and to collaborate to complete the template (and later, the buyer journey). Once the team learns the process for working on the initial persona, the development of additional personas will become more efficient.
3. Place the PowerPoint template in a shared drive for team collaboration. Expect to schedule several 60-minute meets. Quicken collaboration by encouraging team to “do their homework” by sharing persona knowledge within the shared drive version of the template. Your goal is to get to an initial agreed upon version that can be shared for additional validation with industry analyst(s) in the next step.

Download the Buyer Persona Creation Template

1.3 Validate with industry analysts

Input

• Identify gaps in persona from previous steps

Output

• Further validated buyer persona

Materials

• Bring your Buyer Persona Creation Template to the meeting to share with analysts

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• CMO/Sponsoring Executive (Optional)
• Working Team – typically representatives in Product Marketing, Product Management, and Sales
• Info-Tech analyst covering your product category and SoftwareReviews marketing analyst

30 minutes

1. Schedule meeting with working team members and discuss which persona areas require further validation from an Info-Tech analyst who has worked closely with those buyers within your persona.

60 minutes

2. Schedule an inquiry with the appropriate Info-Tech analyst and SoftwareReviews Advisory analyst to share current findings and see:
   1. Info-Tech analyst provide content feedback given what they know about your target persona and product category.
   2. SoftwareReviews Advisory analyst provide feedback on persona approach and to coach any gaps or important omissions.
3. Tabulate results and update your persona summary. At this point you will likely require additional validation through interviews with customers and prospects.

1.4 Identify interviewees and prepare for interviews

Input

• Identify segments within which you require persona knowledge
• Understand your persona insight gaps

Output

• List of interviewees

Materials

• Interviewee recording template on following slide
• Interview guide questions found within the Buyer Persona and Journey Interview Guide and data Capture Tool

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• Working Team – typically representatives in Product Marketing, Product Management, and Sales

1-2 weeks

1. Identify the types of customers and prospects that will best represent your target persona. Choose interviewees that when interviewed will inform key differences among key segments (geographies, company size, mix of customers and prospects, etc.).
2. Recruit interviewees and schedule interviews for 45 minutes.
3. Keep track of Interviewees using the slide following this one.
4. In preparation for interviews, review the Buyer Persona and Journey Interview Guide and Data Capture Tool. Review the two sets of questions:
   1. Buyer Persona-Related – use to validate areas where you still have gaps in your persona, OR if you are starting with a blank persona and wish to build your personas entirely based on customer and prospect interviews.
   2. Buyer-Journey Related, which we will focus on in the next phase.

Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

Phase 2
Interview Buyers and Validate Persona and Journey

This Phase walks you through the following activities:

• Developing final interview guide.
• Interviewing buyers and customers.
• Adjusting approach.
• Validating buyer persona.
• Crafting buyer journey
• Gaining analyst feedback.

This Phase involves the following stakeholders:

• Program leadership
• Product Marketing
• Representative(s) from Sales

2.1 Hold interviews

Input

• List of interviewees
• Final list of questions

Output

• Buyer perspectives on their personas and buyer journeys

Materials

• Buyer Persona and Journey Interview Guide and data Capture Tool

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• Working Team – typically representatives in Product Marketing, Product Management, and Sales

1-2 weeks

1. Hold interviews and adjust your interviewing approach as you go along. Uncover where you are not getting the right answers, check with working team and analysts, and adjust.

Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

2.2 Use interview findings to validate what’s needed for activation

Input

• List of interviewees
• Final list of questions

Output

• Buyer perspectives on their personas and buyer journeys
• Stakeholder feedback that actionable insights are resulting from interviews

Materials

• Buyer Persona Creation Template
• Buyer Persona and Journey Interview Guide and Data Capture Tool

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• Working Team – typically representatives in Product Marketing, Product Management, and Sales
• SoftwareReviews marketing analyst

2 hours

1. Convene your team, with marketing analysts, and test early findings: It’s wise to test initial interview results to check that you are getting the right insights to understand and validate key challenges, pain points, needs, and other vital areas pertaining to the buyer persona. Are the answers you are getting enabling you to complete the Summary slides for later communications and training for Sales?
2. Check when doing buyer journey interviews that you are getting actionable answers that drive messaging, what asset types are needed, what the marketing channel mix is, and other vital insights to activate the results. Are the answers you are getting adequate to give guidance to campaigners, content marketers, and sales enablement?
3. See the following slides for detailed questions that need to be answered satisfactorily by your team members that need to “activate” the results.

Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

2.2.1 Are you getting what you need from interviews to inform the buyer persona?

Test that you are on the right track:

1. Are you getting the functional answers so you can guide sellers to the right roles? Can you guide marketers/campaigners to the right “Ideal Customer Profile” for lead scoring?
2. Are you capturing the right emotive areas that will support message crafting? Solutioning? SEM/SEO?
3. Are you capturing insights into “how they decide” so sellers are well informed on the decision-making dynamics?
4. Are you getting a strong understanding of content, interaction preferences, and news and information sources so sellers can outreach more effectively, you can pinpoint media spend, and content marketing can create the right assets?

2.2.2 Are you getting what you need from interviews to support the buyer journey?

Our approach helps you define the buyer journey

Because marketing leaders need to reach buyers through the right channel with the right message at the right time during their decision cycle, you’ll benefit by using questionnaires that enable you to build the below easily and quickly.

2.3 Continue interviews

Input

• Final adjustments to list of interview questions

Output

• Final buyer perspectives on their personas and buyer journeys

Materials

• Buyer Persona Creation Template
• Buyer Persona and Journey Interview Guide and data Capture Tool

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• Working Team – typically representatives in Product Marketing, Product Management, and Sales

1-2 weeks

1. Continue customer and prospect interviews.
2. Ensure you are gaining the segment perspectives needed.
3. Complete the “Summary” columns within the Buyer Persona and Journey Interview Guide and Data Capture Tool.

Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

Phase 3
Prepare Communications and Educate Stakeholders

This Phase walks you through the following activities:

• Creating outputs for key stakeholders
• Communicating final findings and supporting marketing, sales, and product activation.

This Phase involves the following stakeholders:

• Program leadership
• Product Marketing
• Product Management
• Sales
• Field Marketing/Campaign Management
• Executive Leadership

3.1 Summarize interview results and convene full working team and steering committee for final review

Input

• Buyer persona and journey interviews detail

Output

• Buyer perspectives on their personas and buyer journeys

Materials

• Buyer Persona and Journey Interview Guide and Data Capture Tool
• Buyer Persona and Journey Summary Template

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• CMO/Sponsoring Executive (Optional)
• Working Team – typically representatives in Product Marketing, Product Management, and Sales
• SoftwareReviews marketing analyst

1-2 hours

1. Summarize interview results within the Buyer Persona and Journey Summary Template.

Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

Download the Buyer Persona and Journey Summary Template

3.2 Convene executive steering committee and working team to review results

Input

• Buyer persona and journey interviews summary

Output

• Buyer perspectives on their personas and buyer journeys

Materials

• Buyer Persona and Journey Summary Template

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• Working Team – typically representatives in Product Marketing, Product Management, and Sales

1-2 hours

1. Present final persona and journey results to the steering committee/executives and to working group using the summary slides interview results within the Buyer Persona and Journey Summary Template to finalize results.

Download the Buyer Persona and Journey Summary Template

3.3 Convene stakeholder meetings to activate results

Input

• Buyer persona and journey interviews summary

Output

Activation of key learnings to drive:

• Better product –market fit
• Lead gen
• Sales effectiveness
• Awareness

Materials

• Buyer Persona and Journey Summary Template

Participants

• Initiative Manager – individual leading the buyer persona and journey initiative
• Working Team – typically representatives in Product Marketing, Product Management, and Sales
• Stakeholder team members (see left)

4-5 hours

Present final persona and journey results to each stakeholder team. Key presentations include:

1. Product team to validate product market fit.
2. Content marketing to provide messaging direction for the creation of awareness and lead gen assets.
3. Campaigners/Field Marketing for campaign-related messaging and to identify asset types required to be designed and delivered to support the buyer journey.
4. Social media strategists for social post copy, and PR for other awareness-building copy.
5. Sales enablement/training to enable updating of sales collateral, proposals, and sales training materials. Sellers to help with their targeting, prospecting, and crafting of outbound messaging and talk tracks.

Download the Buyer Persona and Journey Summary Template

Summary of Accomplishment

Problem Solved

With the help of this blueprint, you have deepened your and your colleagues’ buyer understanding at both the persona “who they are” level and the buyer journey “how do they buy” level. You are among the minority of marketing leaders that have fully documented a buyer persona and journey – congratulations!

The benefits of having led your team through the process are significant and include the following:

• Better alignment of customer/buyer-facing teams such as in product, marketing, sales, and customer success.
• Messaging that can be used by marketing, sales, and social teams that will resonate with buyer initiatives, pain points, sought-after “pain relief,” and value.
• Places in the digital and physical universe where your prospects “hang out” so you can optimize your media spend.
• More effective use of marketing assets and sales collateral that align with the way your prospect needs to consume information throughout their buyer journey to make a decision in your solution area.

And by capturing and documenting your buyer persona and journey even for a single buyer type, you have started to build the “institutional strength” to apply the process to other roles in the decision-making process or for when you go after new and different buyer types for new products. And finally, by bringing your team along with you in this process, you have also led your team in becoming a more customer-focused organization – a strategic shift that all organizations should pursue.

If you would like additional support, contact us and we’ll make sure you get the professional expertise you need.

Contact your account representative for more information.

info@softwarereviews.com

1-888-670-8889

Related Software Reviews Research

Optimize Lead Generation With Lead Scoring

• Save time and money and improve your sales win rates when you apply our methodology to score contacts with your lead gen engine more accurately and pass better qualified leads over to your sellers.
• Our methodology teaches marketers to develop your own lead scoring approach based upon lead/contact profile vs. your Ideal Customer Profile (ICP) and scores contact engagement. Applying the methodology to arrive at your own approach to scoring will mean reduced lead gen costs, higher conversion rates, and increased marketing-influenced wins.

Bibliography

Bilardi, Emma. “How to Create Buyer Personas.” Product Marketing Alliance, July 2020. Accessed Dec. 2021.

Harrison, Liz, Dennis Spillecke, Jennifer Stanley, and Jenny Tsai. “Omnichannel in B2B sales: The new normal in a year that has been anything but.” McKinsey & Company, 15 March 2021. Accessed Dec. 2021.

Jansen, Hasse. “Buyer Personas – 33 Mind Blowing Stats.” Boardview.io!, 19 Feb. 2016. Accessed Jan. 2022.

Raynor, Lilah. “Understanding The Changing B2B Buyer Journey.” Forbes Agency Council, 18 July 2021. Accessed Dec. 2021.

Simpson, Jon. “Finding Your Audience: The Importance of Developing a Buyer Persona.” Forbes Agency Council, 16 May 2017. Accessed Dec. 2021.

“Successfully Executing Personalized Marketing Campaigns at Scale.” Plexure, 6 Jan. 2020. Accessed Dec 2020.

Ulwick, Anthony W. JOBS TO BE DONE: Theory to Practice. E-book, Strategyn, 1 Jan. 2017. Accessed Jan. 2022.

Reduce Risk With Rock-Solid Service-Level Agreements

Hold Service Providers more accountable to their contractual obligations with meaningful SLA components & remedies

EXECUTIVE BRIEF

Analyst Perspective

Reduce Risk With Rock-Solid Service-Level Agreements

Every year organizations outsource more and more IT infrastructure to the cloud, and IT operations to managed service providers. This increase in outsourcing presents an increase in risk to the CIO to save on IT spend through outsourcing while maintaining required and expected service levels to internal customers and the organization. Ensuring that the service provider constantly meets their obligations so that the CIO can meet their obligation to the organization can be a constant challenge. This brings forth the importance of the Service Level Agreement.

Research clearly indicates that there is a general lack of knowledge when comes to understanding the key elements of a Service Level Agreement (SLA). Even less understanding of the importance of the components of Service Levels and the Service Level Objectives (SLO) that service provider needs to meet so that the outsourced service consistently meets requirements of the organization. Most service providers are very good at providing the contracted service and they all are very good at presenting SLOs that are easy to meet with very few or no ramifications if they don’t meet their objectives. IT leaders need to be more resolute in only accepting SLOs that are meaningful to their requirements and have meaningful, proactive reporting and associated remedies to hold service providers accountable to their obligations.

Ted Walker

Principal Research Director, Vendor Practice

Info-Tech Research Group

Executive Brief

Vendors provide service level commitments to customers in contracts to show a level of trust, performance, availability, security, and responsiveness in an effort create a sense of confidence that their service or platform will meet your organization’s requirements and expectations. Sifting through these promises can be challenging for many IT Leaders. Customers struggle to understand and evaluate what’s in the SLA – are they meaningful and protect your investment? Not understanding the details of SLAs applicable to various types of Service (SaaS, MSP, Service Desk, DR, ISP) can lead to financial and compliance risk for the organization as well as poor customer satisfaction.

This project will provide IT leadership the knowledge & tools that will allow them to:

• Understand what SLAs are and why they need them.
• Develop standard SLAs that meet the organization’s requirements.
• Negotiate meaningful remedies aligned to Service Levels metrics or KPIs.
• Create SLA monitoring & reporting and remedies requirements to hold the provider accountable.

This research:

1. Is designed for:

• The CIO or CFO who needs to better understand their provider’s SLAs.
• The CIO or BU that could benefit from improved service levels.
• Vendor management who needs to standardize SLAs for the organization IT leadership that needs consistent service levels to the business
• The contract manager who needs a better understanding of contact SLAs

• Understand what a Service Level Agreement is and what it’s for
• Learn what the components are of an SLA and why you need them
• Create a checklist of required SLA elements for your organization
• Develop standard SLA template requirements for various service types
• Learn the importance of SLA management to hold providers accountable

Reduce Risk With Rock-Solid Service-Level Agreements (SLAs)

Hold service providers more accountable to their contractual obligations with meaningful SLA components and remedies

The Problem

IT Leadership doesn't know how to evaluate an SLA.

Misunderstanding of obligations given the type of service provided (SAAS, IAAS, DR/BCP, Service Desk)

Expectations not being met, leading to poor service from the provider.

No way to hold provider accountable.

Why it matters

SLAS are designed to ensure that outsourced IT services meet the requirements and expectations of the organization. Well-written SLAs with all the required elements, metrics, and remedies will allow IT departments to provide the service levels to their customer and avoid financial and contractual risk to the organization.

The Solution

1. Understand the key service elements within an SLA

• Develop a solid understanding of the key elements within an SLA and why they're important.

• Prioritize contractual services and establish concise SLA checklists and performance metrics.

Service types

• Availability/Uptime
• Response Times
• Resolution Time
• Accuracy
• First-Call Resolution

Agreement Types

• SaaS/IaaS
• Service Desk
• MSP
• Co-Location
• DR/BCP
• Security Ops

Performance Metrics

• Reporting
• Remedies & Credits
• Monitoring
• Exclusion

Example SaaS Provider

• Response Times ✓
• Availability/Uptime ✓
• Resolution Time ✓
• Update Times ✓
• Coverage Time ✓
• Monitoring ✓
• Reporting ✓
• Remedies/Credits ✓

SLA Management Framework

1. SLO Monitoring

• SLOs must be monitored by the provider, otherwise they can't be measured.

• This is the key element for the provider to validate their performance.

• Capturing SLO metric attainment provides performance trending for each provider.

• Tracking details provide input into overall vendor performance ratings.

Executive Summary

Your Challenge

To understand which SLAs are required for your organization and how they can differ depending on the service type. In addition, these other challenges can also cloud your knowledge of SLAs

• No standardized SLA documents, Service levels, or metrics
• Dealing with lost productivity & revenue due to persistent downtime
• Understanding SLA components and what service levels are requires for a particular service
• How to manage the SLA and hold the vendor accountable

Common Obstacles

There are several unknowns that SLA can present to different departments within the organization:

• Little knowledge of what service levels are required
• Not knowing SLO standards for a service type
• Lack of resources to manage vendor obligations
• Negotiating required metrics/KPIs with the provider
• Low understanding of the risk that poor SLAs can present to the organization

Info-Tech's Approach

Info-Tech has a three-step approach to effective SLAs

• Understand the elements of an SLA
• Create Requirements for your organization
• Manage the SLA obligations

There are some basic components that every SLA should have – most don’t have half of what is required

Info-Tech Insight

SLAs need to have clear, easy to measure objectives to meet your expectations and service level requirements, including meaningful reporting and remedies to hold the provider accountable to their obligations.

Your challenge

This research is designed to help organizations gain a better understanding of what an SLA is, understand the importance of SLAs in IT contracts, and ensure organizations are provided with rock-solid SLAs that meet their requirements and not just what the vendor wants to provide.

• Vendors can make SLAs weak and difficult to understand; sometimes the metrics are meaningless. Not fully understanding what makes up a good SLA can bring unknown risks to the organization.
• Managing vendor SLA obligations effectively is important. Are adequate resources available? Does the vendor provide manual vs. automated processes and which do you need? Is the process proactive from the vendor or reactive from the customer?

SLAs come in many variations and for many service types. Understanding what needs to be in them is one of the keys to reducing risk to your organization.

“One of the biggest mistakes an IT leader can make is ignoring the ‘A’ in SLA,” adds Wendy M. Pfeiffer, CIO at Nutanix. “

An agreement isn’t a one-sided declaration of IT capabilities, nor is it a one-sided demand of business requirements,” she says. “An agreement involves creating a shared understanding of desired service delivery and quality, calculating costs related to expectations, and then agreeing to outcomes in exchange for investment.” (15 SLA mistakes IT leaders still make | CIO)

Common obstacles

There are typically a lot of unknowns when it comes to SLAs and how to manage them.

Most organizations don’t have a full understanding of what SLAs they require and how to ensure they are met by the vendor. Other obstacles that SLAs can present are:

• Inadequate resources to create and manage SLAs
• Poor awareness of standard or required SLA metrics/KPIs
• Lack of knowledge about each provider’s commitment as well as your obligations
• Low vendor willingness to provide or negotiate meaningful SLAs and credits
• The know-how or resources to effectively monitor and manage the SLA’s performance

SLAs need to address your requirements

55% of businesses do not find all of their service desk metrics useful or valuable (Freshservice.com)

27% of businesses spend four to seven hours a month collating metric reports (Freshservice.com)

Executive Summary

Info-Tech’s Approach

• Understand the elements of an SLA
  • Availability
  • Monitoring
  • Response Times
  • SLO Calculation
  • Resolution Time
  • Reporting
  • Milestones
  • Exclusions
  • Accuracy
  • Remedies & Credits
• Create standard SLA requirements and criteria
  • SLA Element Checklist
  • Corporate Requirements and Standards
  • SLA Templates and Policy
• Effectively Manage the SLA Obligations
  • SLA Management Framework
    • SLO Monitoring
    • Concise Reporting
    • Attainment Tracking
    • Score Carding
    • Remedy Reconciliation

Info-Tech’s three phase approach

Reduce Risk With Rock-Solid Service-Level Agreements

Phase 1

Understand SLA Elements

Phase Content:

• 1.1 What are SLAs, types of SLAs, and why are they needed?
• 1.2 Elements of an SLA
• 1.3 Obligation management monitoring, Reporting requirements
• 1.4 Exclusions
• 1.5 SLAs vs. SLOs vs. SLIs

Outcome:

This phase will present you with an understanding of the elements of an SLA: What they are, why you need them, and how to validate them.

Phase 2

Create Requirements

Phase Content:

• 2.1 Create a list of your SLA criteria
• 2.2 Develop SLA policy & templates
• 2.3 Create a negotiation strategy
• 2.4 SLA Overachieving discussion

Outcome:

This phase will leverage knowledge gained in Phase 1 and guide you through the creation of SLA requirements, criteria, and templates to ensure that providers meet the service level obligations needed for various service types to meet your organization’s service expectations.

Phase 3

Manage Obligations

Phase Content:

• 3.1 SLA Monitoring, Tracking
• 3.2 Reporting
• 3.3 Vendor SLA Reviews & Optimizing
• 3.4 Performance management

Outcome:

This phase will provide you with an SLA management framework and the best practices that will allow you to effectively manage service providers and their SLA obligations.

Insight summary

Overarching insight

SLAs need to have clear, easy-to-measure objectives to meet your expectations and service level requirements, including meaningful reporting and remedies to hold the provider accountable to their obligations.

Phase 1 insight

Not understanding the required elements of an SLA and not having meaningful remedies to hold service providers accountable to their obligations can present several risk factors to your organization.

Phase 2 insight

Creating standard SLA criteria for your organization’s service providers will ensure consistent service levels for your business units and customers.

Phase 3 insight

SLAs can have appropriate SLOs and remedies but without effective management processes they could become meaningless.

Tactical insight

Be sure to set SLAs that are easily measurable from regularly accessible data and that are straight forward to interpret.

Tactical insight

Beware of low, easy to attain service levels and metrics/KPIs. Service levels need to meet your expectations and needs not the vendor’s.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

SLA Tracker & Trending Tool

Track the provider’s SLO attainment and see how their performance is trending over time

SLA Evaluation Tool

Evaluate SLA service levels, metrics, credit values, reporting, and other elements

SLA Template & Metrics Reference Guide

Reference guide for typical SLA metrics with a generic SLA Template

Service-Level Agreement Checklist

Complete SLA component checklist for core SLA and contractual elements.

Key deliverable:

Service-Level Agreement Evaluation Tool

Evaluate each component of the SLA , including service levels, metrics, credit values, reporting, and processes to meet your requirements

Blueprint objectives

Understand the components of an SLA and effectively manage their obligations

• To provide an understanding of different types of SLAs, their required elements, and what they mean to your organization. How to identify meaningful service levels based on service types. We will break down the elements of the SLA such as service types and define service levels such as response times, availability, accuracy, and associated metrics or KPIs to ensure they are concise and easy to measure.
• To show how important it is that all metrics have remedies to hold the service provider accountable to their SLA obligations.

Once you have this knowledge you will be able to create and negotiate SLA requirements to meet your organization’s needs and then manage them effectively throughout the term of the agreement.

InfoTech Insight:

Right-size your requirements and create your SLO criteria based on risk mitigation and create measurements that motivate the desired behavior from the SLA.

Blueprint benefits

IT Benefits

• An understanding of standard SLA service levels and metrics
• Reduced financial risk through clear and concise easy-to-measure metrics and KPIs
• Improved SLA commitments from the service provider
• Meaningful reporting and remedies to hold the provider accountable
• Service levels and metrics that meet your requirements to support your customers

Business Benefits

• Better understanding of an SLA framework and required SLA elements
• Improved vendor performance
• Standardized service levels and metrics aligned to your organization’s requirements
• Reduced time in reviewing and comprehending vendor SLAs
• Consistent performance from your service providers

Measure the value of this blueprint

1. Dollars Saved

• Improved performance from your service provider
• Reduced financial risk through meaningful service levels & remedies
• Dollars gained through:
  • Reconciled credits from obligation tracking and management
  • Savings due to automated processes

• Reduced time in creating effective SLAs through requirement templates
• Time spent tracking and managing SLA obligations
• Reduced negotiation time
• Time spent tracking and reconciling credits

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way wound help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is between three to six calls over the course of two to three months.

Phase 1 - Understand

• Call #1: Scope requirements, objectives, and your specific SLA challenges

Phase 2 - Create Requirements

• Call #2: Review key SLA and how to identify them
• Call #3: Deep dive into SLA elements and why you need them
• Call #4: Review your service types and SLA criteria
• Call #5: Create internal SLA requirements and templates

Phase 3 - Management

• Call #6: Review SLA Management Framework
• Call #7: Review and create SLA Reporting and Tracking

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Reduce Risk With Rock-Solid Service-Level Agreements

Phase 1

Phase 1

Understand SLA Elements

Phase Steps

• 1.1 What are SLAs, the types of SLAs, and why are they needed?
• 1.2 Elements of an SLA
• 1.3 Obligation management monitoring, Reporting requirements
• 1.4 Exclusions and exceptions
• 1.5 SLAs vs. SLOs vs. SLIs

Create Requirements

Manage Obligations

1.1 What are SLAs, the types of SLAs, and why are they needed?

SLA Overview

What is a Service Level Agreement?

An SLA is an overarching contractual agreement between a service provider and a customer (can be external or internal) that describes the services that will be delivered by the provider. It describes the service levels and associated performance metrics and expectations, how the provider will show it has attained the SLAs, and defines any remedies or credits that would apply if the provider fails to meet its commitments. Some SLAs also include a change or revision process.

SLAs come in a few forms. Some are unique, separate, standalone documents that define the service types and levels in more detail and is customized to your needs. Some are separate documents that apply to a service and are web posted or linked to an MSA or SSA. The most common is to have them embedded in, or as an appendix to an MSA or SSA. When negotiating an MSA it’s generally more effective to negotiate better service levels and metrics at the same time.

Objectives of an SLA

To be effective, SLAs need to have clearly described objectives that define the service type(s) that the service provider will perform, along with commitment to associated measurable metrics or KPIs that are sufficient to meet your expectations. The goal of these service levels and metrics is to ensure that the service provider is committed to providing the service that you require, and to allow you to maintain service levels to your customers whether internal or external.

1.1 What are SLAs, the types of SLAs, and why are they needed?

Key Elements of an SLA

Principle service elements of an SLA

There are several more common service-related elements of an SLA. These generally include:

• The Agreement – the document that defines service levels and commitments.
• The service types – the type of service being provided by the vendor. These can include SaaS, MSP, Service Desk, Telecom/network, PaaS, Co-Lo, BCP, etc.
• The service levels – these are the measurable performance objectives of the SLA. They include availability (uptime), response times, restore times, priority level, accuracy level, resolution times, event prevention, completion time, etc.
• Metrics/KPIs – These are the targets or commitments associated to the service level that the service provider is obligated to meet.
• Other elements – Reporting requirements, monitoring, remedies/credit values and process.

Contractual Construct Elements

These are construct components of an SLA that outline their roles and responsibilities, T&Cs, escalation process, etc.

In addition, there are several contractual-type elements including, but not limited to:

• A statement regarding the purpose of the SLA.
• A list of services being supplied (service types).
• An in-depth description of how services will be provided and when.
• Vendor and customer requirements.
• Vendor and customer obligations.
• Acknowledgment/acceptance of the SLA.
• They also list each party’s responsibilities and how issues will be escalated and resolved.

Common types of SLAs explained

Service-level SLA

• This service-level agreement construct is the Service-based SLA. This SLA covers an identified service for all customers in general (for example, if an IT service provider offers customer response times for a service to several customers). In a service-based agreement, the response times would be the same and apply to all customers using the service. Any customer using the service would be provided the same SLA – in this case the same defined response time.

Customer-based SLA

• A customer-based SLA is a unique agreement with one customer. The entire agreement is defined for one or all service levels provided to a particular customer (for example, you may use several services from one telecom vendor). The SLAs for these services would be covered in one contract between you and the vendor, creating a unique customer-based vendor agreement. Another scenario could be where a vendor offers general SLAs for its services but you negotiate a specific SLA for a particular service that is unique or exclusive to you. This would be a customer-based SLA as well.

Multi-level SLA

• This service-level agreement construct is the multi-level SLA. In a multi-level SLA, components are defined to the organizational levels of the customer with cascading coverage to sublevels of the organization. The SLA typically entails all services and is designed to the cover each sub-level or department within the organization. Sometimes the multi-level SLA is known as a master organization SLA as it cascades to several levels of the organization.

InfoTech Insight: Beware of low, easy to attain Service levels and metrics/KPIs. Service levels need to meet your requirements, expectations, and needs not the vendor’s.

1.2 Elements of SLA-objectives, service types, and service levels

Objectives of Service Levels

The objective of the service levels and service credits are to:

• Ensure that the services are of a consistently high quality and meet the requirements of the customer
• Provide a mechanism whereby the customer can attain meaningful recognition of the vendors failure to deliver the level of service for which it was contracted to deliver
• Incentivize the vendor or service provider to comply with and to expeditiously provide a remedy for any failure to attain the service levels committed to in the SLA
• To ensure that the service provider fulfills the defined objectives of the outsourced service

Service types

There are several service types that can be part of an SLA. Service types are the different nature of services associated with the SLA that the provider is performing and being measured against. These can include:

Service Desk, SaaS, PaaS, IaaS, ISP/Telecom/Network MSP, DR & BCP, Co-location security ops, SOW.

Each service type should have standard service level targets or obligations that can vary depending on your requirements and reliance on the service being provided.

Service levels

Service levels are measurable targets, metrics, or KPIs that the service provider has committed to for the particular service type. Service levels are the key element of SLAs – they are the performance expectations set between you and the provider. The service performance of the provider is measured against the service level commitments. The ability of the provider to consistently meet these metrics will allow your organization to fully benefit from the objectives of the service and associated SLAs. Most service levels are time related but not all are.

Common service levels are:

Response times, resolution times per percent, restore/recovery times, accuracy, availability/uptime, completion/milestones, updating/communication, latency.

Each service level has standard or minimum metrics for the provider. The metrics, or KPIs, should be relatively easy to measure and report against on a regular basis. Service levels are generally negotiable to meet your requirements.

1.2.1 Activity SLA Checklist Tool

1-2 hours

Input

• SLA content, Service elements
• Contract terms & exclusions
• Service metrices/KPIs

Output

• A concise list of SLA components
• A list of missing SLA elements
• Evaluation of the SLA

Materials

• Comprehensive checklist
• Service provider SLA
• Internal templates or policies

Participants

• Vendor or contract manager
• IT or business unit manager
• Legal
• Finance

Using this checklist will help you review a provider’s SLA to ensure it contains adequate service levels and remedies as well as contract-type elements.

Instructions:

Use the checklist to identify the principal service level elements as well as the contractual-type elements within the SLA.

Review the SLA and use the dropdowns in the checklist to verify if the element is in the SLA and whether it is within acceptable parameters as well the page or section for reference.

The checklist contains a list of service types that can be used for reference of what SLA elements you should expect to see in that service type SLA.

Download the SLA Checklist Tool

1.3 Monitoring, reporting requirements, remedies/credit process

Monitoring & Reporting

As mentioned, well-defined service levels are key to the success of the SLA. Validating that the metrics/KPIs are being met on a consistent basis requires regular monitoring and reporting. These elements of the SLA are how you hold the provider accountable to the SLA commitments and obligations. To achieve the service level, the service must be monitored to validate that timelines are met and accuracy is achieved.

• Data or details from monitoring must then be presented in a report and delivered to the customer in an agreed-upon format. These formats can be in a dashboard, portal, spreadsheet, or csv file, and they must have sufficient criteria to validate the service-level metric. Reports should be kept for future review and to create historical trending.
• Monitoring and reporting should be the responsibility of the service provider. This is the only way that they can validate to the customer that a service level has been achieved.
• Reporting criteria and delivery timelines should be defined in the SLA and can even have a service level associated with it, such as a scheduled report delivery on the fifth day of the following month.
• Reports need to be checked and balanced. When defining report criteria, be sure to define data source(s) that can be easily validated by both parties.
• Report criteria should include compliance requirements, target metric/KPIs, and whether they were attained.
• The report should identify any attainment shortfall or missed KPIs.

Too many SLAs do not have these elements as often the provider tries to put the onus on the customer to monitor their performance of the service levels. .

1.3.1 Monitoring, reporting requirements, remedies/credit process

Remedies and Credits

Service-level reports validate the performance of the service provider to the SLA metrics or KPIs. If the metrics are met, then by rights, the service provider is doing its job and performing up to expectations of the SLA and your organization.

• What if the metrics are not being met either periodically or consistently? Solving this is the goal of remedies. Remedies are typically monetary costs (in some form) to the provider that they must pay for not meeting a service-level commitment. Credits can vary significantly and should be aligned to the severity of the missed service level. Sometimes there no credits offered by the vendor. This is a red flag in an SLA.
• Typically expressed as a monetary credit, the SLA will have service levels and associated credits if the service-level metric/KPI is not met during the reporting period. Credits can be expressed in a dollar format, often defined as a percentage of a monthly fee or prorated annual fee. Although less common, some SLAs offer non-financial credits. These could include: an extension to service term, additional modules, training credits, access to a higher support level, etc.
• Regardless of how the credit is presented, this is typically the only way to hold your provider accountable to their commitments and to ensure they perform consistently to expectations. You must do a rough calculation to validate the potential monetary value and if the credit is meaningful enough to the provider.

Research shows that credit values that equate to just a few dollars, when you are paying the provider tens of thousands of dollars a month for a service or product, the credit is insignificant and therefore doesn’t incent the provider to achieve or maintain a service level.

1.3.2 Monitoring, reporting requirements, remedies/credit process

Credit Process

Along with meaningful credit values, there must be a defined credit calculation method and credit redemption process in the SLA.

Credit calculation. The credit calculation should be simple and straight forward. Many times, we see providers define complicated methods of calculating the credit value. In some cases complicated service levels require higher effort to monitor and report on, but this shouldn’t mean that the credit for missing the service level needs to require the same effort to calculate. Do a sample credit calculation to validate if the potential credit value is meaningful enough or meets your requirements.

Credit redemption process. The SLA should define the process of how a credit is provided to the customer. Ideally the process should be fairly automated by the service provider. If the report shows a missed service level, that should trigger a credit calculation and credit value posted to account followed by notification. In many SLAs that we review, the credit process is either poorly defined or not defined at all. When it is defined, the process typically requires the customer to follow an onerous process and submit a credit request that must then be validated by the provider and then, if approved, posted to your account to be applied at year end as long as you are in complete compliance with the agreement and up-to-date on your account etc. This is what we need to avoid in provider-written SLAs. You need a proactive process where the service provider takes responsibility for missing an SLA and automatically assigns an accurate credit to your account with an email notice.

Secondary level remedies. These are remedies for partial performance. For example, the platform is accessible but some major modules are not working (i.e.: the payroll platform is up and running and accessible but the tax table is not working properly so you can’t complete your payroll run on-time). Consider the requirement of a service level, metric, and remedy for critical components of a service and not just the platform availability.

Info-Tech Insight SLA’s without adequate remedies to hold the vendor accountable to their commitments make the SLAs essentially meaningless.

1.4 Exclusions indemnification, force majeure, scheduled maintenance

Contract-Related Exclusions

Attaining service-level commitments by the provider within an SLA can depend on other factors that could greatly influence their performance to service levels. Most of these other factors are common and should be defined in the SLA as exclusions or exceptions. Exceptions/exclusions can typically apply to credit calculations as well. Typical exceptions to attaining service levels are:

• Denial of Service (DoS) attacks
• Communication/ISP outage
• Outages of third-party hosting
• Actions or inactions of the client or third parties
• Scheduled maintenance but not emergency maintenance
• Force majeure events which can cover several different scenarios

Attention should be taken to review the exceptions to ensure they are in fact not within the reasonable control of the provider. Many times the provider will list several exclusions. Often these are not reasonable or can be avoided, and in most cases, they allow the service provider the opportunity to show unjustified service-level achievements. These should be negotiated out of the SLA.

1.5 Activity SLA Evaluation Tool

1-2 hours

Input

• SLA content
• SLA elements
• SLA objectives
• SLO calculation methods

Output

• Rating of the SLA service levels and objectives
• Overall rating of the SLA content
• Targeted list of required improvements

Materials

• SLA comprehensive checklist
• Service provider SLA

Participants

• Vendor or contract manager
• IT manager or leadership
• Application or business unit manager

The SLA Evaluation Tool will allow you evaluate an SLA for content. Enter details into the tool and evaluate the service levels and SLA elements and components to ensure the agreement contains adequate SLOs to meet your organization’s service requirements.

Instructions:

Review and identify SLA elements within the service provider’s SLA.

Enter service-level details into the tool and rate the SLOs.

Enter service elements details, validate that all required elements are in the SLA, and rate them accordingly.

Capture and evaluate service-level SLO calculations.

Review the overall rating for the SLA and create a targeted list for improvements with the service provider.

Download the SLA Evaluation Tool

1.5 Clarification: SLAs vs. SLOs vs. SLIs

SLA – Service-Level Agreement The promise or commitment

• This is the formal agreement between you and your service provider that contains their service levels and obligations with measurable metrics/KPIs and associated remedies. SLAs can be a separate or unique document, but are most commonly embedded within an MSA, SOW, SaaS, etc. as an addendum or exhibit.

SLO – Service-Level Objective The goals or targets

• This service-level agreement construct is the customer-based SLA. A Customer-based SLA is a unique agreement with one customer. The entire agreement is defined for one or all service levels provided to a particular customer. For example, you may use several services from one telecom vendor. The SLAs for these services would be covered in one contract between you and the Telco vendor, creating a unique customer-based to vendor agreement. Another scenario: a vendor offers general SLAs for its services and you negotiate a specific SLA for a particular service that is unique or exclusive to you. This would be a customer-based SLA as well.

Other common names are Metrics and Key Performance Indicators (KPIs )

SLI – Service-Level Indicator How did we do? Did we achieve the objectives?

• An SLI is the actual metric attained after the measurement period. SLI measures compliance with an SLO (service level objective). So, for example, if your SLA specifies that your systems will be available 99.95% of the time, your SLO is 99.95% uptime and your SLI is the actual measurement of your uptime. Maybe it’s 99.96%. maybe 99.99% or even 99.75% For the vendor to be compliant to the SLA, the SLI(s) must meet or exceed the SLOs within the SLA document.

Other common names: attainment, results, actual

Info-Tech Insight:

Web-posted SLAs that are not embedded within a signed MSA, can present uncertainty and risk as they can change at any time and typically without direct notice to the customer

Reduce Risk With Rock-Solid Service-Level Agreements

Phase 2

Understand SLA Elements

Phase 2

Create Requirements

Phase Steps

• 2.1 Create a list of your SLA criteria
• 2.2 Develop SLA policy & templates
• 2.3 Create a negotiation strategy
• 2.4 SLA overachieving discussion

Manage Obligations

2.1 Create a list of your SLA criteria

Principle Service Elements

With your understanding of the types of SLAs and the elements that comprise a well-written agreement

• The next step is to start to create a set of SLA criteria for service types that your organization outsources or may require in the future.
• This criteria should define the elements of the SLA with tolerance levels that will require the provider to meet your service expectations.
• Service levels, metrics/KPIs, associated remedies and reporting criteria. This criteria could be captured into table-like templates that can be referenced or inserted into service provider SLAs.
• Once you have defined minimum service-level criteria, we recommend that you do a deeper review of the various service provider types that your organization has in place. The goal of the review is to understand the objective of the service type and associated service levels and then compare them to your requirements for the service to meet your expectations. Service levels and KPIs should be no less than if your IT department was providing the service with its own resources and infrastructure.
• Most IT departments have service levels that they are required to meet with their infrastructure to the business units or organization, whether it’s App delivery, issue or problem resolution, availability etc. When any of these services are outsourced to an external service provider, you need to make all efforts to ensure that the service levels are equal to or better than the previous or existing internal expectations.
• Additionally, the goal is to identify service levels and metrics that don’t meet your requirements or expectations and/or service levels that are missing.

2.2 Develop SLA policies and templates

Contract-type Elements

After creating templates for minimum-service metrics & KPIs, reporting criteria templates, process, and timing, the next step should be to work on contract-type elements and additional service-level components. These elements should include:

• Reporting format, criteria, and timelines
• Monitoring requirements
• Minimum acceptable remedy or credits process; proactive by provider vs. reactive by customer
• Roles & responsibilities
• Acceptable exclusion details
• Termination language for persistent failure to meet SLOs

These templates or criteria minimums can be used as guidelines or policy when creating or negotiating SLAs with a service provider.

Start your initial element templates for your strategic vendors and most common service types: SaaS, IaaS, Service Desk, SecOps, etc. The goal of SLA templates is to create simple minimum guidelines for service levels that will allow you to meet your internal SLAs and expectations. Having SLA templates will show the service provider that you understand your requirements and may put you in a better negotiating position when reviewing with the provider.

When considering SLO metrics or KPIs consider the SMART guidance:

Simple: A KPI should be easy to measure. It should not be complicated, and the purpose behind recording it must be documented and communicated.

Measurable: A KPI that cannot be measured will not help in the decision-making process. The selected KPIs must be measurable, whether qualitatively or quantitatively. The procedure for measuring the KPIs must be consistent and well-defined.

Actionable: KPIs should contribute to the decision-making process of your organization. A KPI that does not make any such contributions serves no purpose.

Relevant: KPIs must be related to operations or functions that a security team seeks to assess.

Time-based: KPIs should be flexible enough to demonstrate changes over time. In a practical sense, an ideal KPI can be grouped together by different time intervals.

(Guide for Security Operations Metrics)

2.2.1 Activity: Review SLA Template & Metrics Reference Guide

1-2 hours

Input

• Service level metrics
• List of who is accountable for PPM decisions

Output

• SLO templates for service types
• SLA criteria that meets your organization’s requirements

Materials

• SLA Checklist
• SLA criteria list with SLO & credit values
• PPM Decision Review Workbook

Participants

• Vendor manager
• IT leadership
• Procurement or contract manager

1. Review the SLA Template and Metrics Reference Guide for common metrics & KPIs for the various service types. Each Service Type tab has SLA elements and SLO metrics typically associated with the type of service.
2. Some service levels have common or standard credits* that are typically associated with the service level or metric.
3. Use the SLA Template to enter service levels, metrics, and credits that meet your organization’s criteria or requirements for a given service type.

Download the SLA Template & Metrics Reference Guide

*Credit values are not standard values, rather general ranges that our research shows to be the typical ranges that credit values should be for a given missed service level

2.3 Create a negotiation strategy

Once you have created service-level element criteria templates for your organization’s requirements, it’s time to document a negotiation position or strategy to use when negotiating with service providers. Not all providers are flexible with their SLA commitments, in fact most are reluctant to change or create “unique” SLOs for individual customers. Particularly cloud vendors providing IaaS, SaaS, or PaaS, SLAs. ISP/Telcom, Co-Lo and DR/BU providers also have standard SLOs that they don’t like to stray far from. On the other hand, security ops (SIEM), service desk, hardware, and SOW/PS providers who are generally contracted to provide variable services are somewhat more flexible with their SLAs and more willing to meet your requirements.

• Service providers want to avoid being held accountable to SLOs, and their SLAs are typically written to reflect that.

The goal of creating internal SLA templates and policies is to set a minimum baseline of service levels that your organization is willing to accept, and that will meet their requirements and expectations for the outsourced service. Using these templated SLOs will set the basis for negotiating the entire SLA with the provider. You can set the SLA purpose, objectives, roles, and responsibilities and then achieve these from the service provider with solid SLOs and associated reporting and remedies.

Info-Tech Insight

Web-posted SLAs that are not embedded within a signed MSA can present uncertainty and risk as they can change at any time and typically without direct notice to the customer

2.3.1 Negotiating strategy guidance

• Be prepared. Create a negotiating plan and put together a team that understands your organization’s requirements for SLA.
• Stay informed. Request provider’s recent performance data and negotiate SLOs to the provider’s average performance.
• Know what you need. Corporate SLA templates or policies should be positioned to service providers as baseline minimums.
• Show some flexibility. Be willing to give up some ground on one SLO in exchange for acceptance of SLOs that may be more important to your organization.
• Re-group. Have a fallback position or Plan B. What if the provider can’t or won’t meet your key SLOs? Do you walk?
• Do your homework. Understand what the typical standard SLOs are for the type of service level.

2.4 SLO overachieving incentive discussion

Monitoring & Reporting

• SLO overachieving metrics are seen in some SLAs where there is a high priority for a service provider to meet and or exceed the SLOs within the SLA. These are not common terms but can be used to improve the overall service levels of a provider. In these scenarios the provider is sometimes rewarded for overachieving on the SLOs, either consistently or on a monthly or quarterly basis. In some cases, it can make financial sense to incent the service provider to overachieve on their commitments. Incentives can drive behaviors and improved performance by the provider that can intern improve the benefits to your organization and therefore justify an incent of some type.
• Example: You could have an SLO for invoice accuracy. If not achieved, it could cost the vendor if they don’t meet the accuracy metric, however if they were to consistently overachieve the metric it could save accounts payable hours of time in validation and therefore you could pass on some of these measurable savings to the provider.
• Overachieving incentives can add complexity to the SLA so they need to be easily measurable and simple to manage.
• Overachieving incentives can also be used in provider performance improvement plans, where a provider might have poor trending attainment and you need to have them improve their performance in a short period of time. Incentives typically will motivate provider improvement and generally will cost much less than replacing the provider.
• There is another school of thought that you shouldn’t have to pay a provider for doing their job; however, others are of the opinion that incentives or bonuses improve the overall performance of individuals or teams and are therefore worth consideration if both parties benefit from the over performance.

Reduce Risk With Rock-Solid Service-Level Agreements

Phase 3

Understand SLA Elements

Create Requirements

Phase 3

Manage Obligations

Phase Steps

• 3.1 SLA monitoring and tracking
• 3.2 Reporting
• 3.3 Vendor SLA reviews & optimizing
• 3.4 Performance management

3.1 SLA monitoring, tracking, and remedy reconciliation

The next step to effective SLAs is the management component. It could be fruitless if you were to spend your time and efforts negotiating your required service levels and metrics and don’t have some level of managing the SLA. In that situation you would have no way of knowing if the service provider is attaining their SLOs.

There are several key elements to effective SLA management:

• SLO monitoring
• Simple, concise reporting
• SLO attainment tracking
• Score carding & trending
• Remedy reconciliation

SLA Management framework

SLA Monitoring → Concise Reporting → Attainment Tracking → Score Carding →Remedy Reconciliation

“A shift we’re beginning to see is an increased use of data and process discovery tools to measure SLAs,” says Borowski of West Monroe. “While not pervasive yet, these tools represent an opportunity to identify the most meaningful metrics and objectively measure performance (e.g., cycle time, quality, compliance). When provided by the client, it also eliminates the dependency on provider tools as the source-of-truth for performance data.” – Stephanie Overby

3.1 SLA management framework

SLA Performance Management

• SLA monitoring provides data for SLO reports or dashboards. Reports provide attainment data for tacking over time. Attainment data feeds scorecards and allows for trending analysis. Missed attainment data triggers remedies.
• All service providers monitor their systems, platforms, tickets, agents, sensors etc. to be able to do their jobs. Therefore, monitoring is readily available from your service provider in some form.
• One of the key purposes of monitoring is to generate data into internal reports or dashboards that capture the performance metrics of the various services. Therefore, service-level and metric reports are readily available for all of the service levels that a service provider is contracted or engaged to provide.
• Monitoring and reporting are the key elements that validate how your service provider is meeting its SLA obligations and thus are very important elements of an SLA. SLO report data becomes attainment data once the metric or KPI has been captured.
• As a component of effective SLA management, this attainment data needs to be tracked/recorded in an easy-to-read format or table over a period of time. Attainment data can then be used to generate scorecards and trending reports for your review both internally and with the provider as required.
• If attainment data shows that the service provider is meeting their SLA obligations, then the SLA is meeting your requirements and expectations. If on the other hand, attainment data shows that obligations are not being met, then actions must be taken to hold the service provider accountable. The most common method is through remedies that are typically in the form of a credit through a defined process (see Sec. 1.3). Any credits due for missed SLOs should also be tracked and reported to stakeholders and accounting for validation, reconciliation, and collection.

3.2 Reporting

Monitoring & Reporting

• Many SLAs are silent on monitoring and reporting elements and require that the customer, if aware or able, to monitor the providers service levels and attainment and create their own KPI and reports. Then if SLOs are not met there is an arduous process that the customer must go through to request their rightful credit. This manual and reactive method creates all kinds of risk and cost to the customer and they should make all attempts to ensure that the service provider proactively provides SLO/KPI attainment reports on a regular basis.
• Automated monitoring and reporting is a common task for many IT departments. There is no reason that a service provider can’t send reports proactively in a format that can be easily interpreted by the customer. The ideal state would be to capture KPI report data into a customer’s internal service provider scorecard.
• Automated or automatic credit posting is another key element that service providers tend to ignore, primarily in hopes that the customer won’t request or go through the trouble of the process. This needs to change. Some large cloud vendors already have automated processes that automatically post a credit to your account if they miss an SLO. This proactive credit process should be at the top of your negotiation checklist. Service providers are avoiding thousands of credit dollars every year based on the design of their credit process. As more customers push back and negotiate more efficient credit processes, vendors will soon start to change and may use it as a differentiator with their service.

3.2.1 Performance tracking and trending

What gets measured gets done

SLO Attainment Tracking

A primary goal of proactive and automated reporting and credit process is to capture the provider’s attainment data into a tracker or vendor scorecard. These tracking scorecards can easily create status reports and performance trending of service providers, to IT leadership as well as feed QBR agenda content.

Remedy Reconciliation

Regardless of how a credit is processed it should be tracked and reconciled with internal stakeholders and accounting to ensure credits are duly applied or received from the provider and in a timely manner. Tracking and reconciliation must also align with your payment terms, whether monthly or annually.

“While the adage, ‘You can't manage what you don't measure,’ continues to be true, the downside for organizations using metrics is that the provider will change their behavior to maximize their scores on performance benchmarks.” – Rob Lemos

3.2.1 Activity SLA Tracker and Trending Tool

1-2 hours setup

Input

• SLO metrics/KPIs from the SLA
• Credit values associated with SLO

Output

• Monthly SLO attainment data
• Credit tracking
• SLO trending graphs

Materials

• Service provider SLO reports
• Service provider SLA
• SLO Tracker & Trending Tool

Participants

• Contract or vendor managers
• Application or service managers
• Service provider

An important activity in the SLA management framework is to track the provider’s SLO attainment on a monthly or quarterly basis. In addition, if an SLO is missed, an associated credit needs to be tracked and captured. This activity allows you to capture the SLOs from the SLA and track them continually and provide data for trending and review at vendor performance meetings and executive updates.

Instructions: Enter SLOs from the SLA as applicable.

Each month, from the provider’s reports or dashboards, enter the SLO metric attainment.

When an SLO is met, the cell will turn green. If the SLO is missed, the cell will turn red and a corresponding cell in the Credit Tracker will turn green, meaning that a credit needs to be reconciled.

Use the Trending tab to view trending graphs of key service levels and SLOs.

Download the SLO Tracker and Trending Tool

3.3 Vendor SLA reviews and optimizing

Regular reviews should be done with providers

Collecting attainment data with scorecards or tracking tools provides summary information on the performance of the service provider to their SLA obligations. This information should be used for regular reviews both internally and with the provider.

Regular attainment reviews should be used for:

• Performance trending upward or downward
• Identifying opportunities to revise or improve SLOs
• Optimizing SLO and processes
• Creating a Performance Improvement Plan (PIP) for the service provider

Some organizations choose to review SLA performance with providers at regular QBRs or at specific SLA review meetings

This should be determined based on the criticality, risk, and strategic importance of the provider’s service. Providers that provide essential services like ERP, payroll, CRM, HRIS, IaaS etc. should be reviewed much more regularly to ensure that any decline in service is identified early and addressed properly in accordance with the service provider. Negative trending performance should also be documented for consideration at renewal time.

3.4 Performance management

Dealing with persistent poor performance and termination

Service providers that consistently miss key service level metrics or KPIs present financial and security risk to the organization. Poor performance of a service provider reflects directly on the IT leadership and will affect many other business aspects of the organization including:

• Ability to conduct day-to-day business activities
• Meet internal obligations and expectations
• Employee productivity and satisfaction
• Maintain corporate policies or industry compliance
• Meet security requirements

Communication is key. Poor performance of a service provider needs to be dealt with in a timely manner in order to avoid more critical impact of the poor performance. Actions taken with the provider can also vary depending again on the criticality, risk, and strategic importance of the provider’s service.

Performance reviews should provide the actions required with the goal of:

• Making the performance problems into opportunities
• Working with the provider to create a PIP with aggressive timelines and ramifications if not attained
• Non-renewal or termination consideration, if feasible including provider replacement options, risk, costs, etc.
• SLA renegotiation or revisions
• Warning notifications to the service provider with concise issues and ramifications

To avoid the issues and challenges of dealing with chronic poor performance, consider a Persistent or Chronic Failure clause into the SLA contract language. These clauses can define chronic failure, scenarios, ramifications there of, and defined options for the client including increased credit values, non-monetary remedies, and termination options without liability.

Info-Tech Insight

It’s difficult to prevent chronic poor performance but you can certainly track it and deal with it in a way that reduces risk and cost to your organization.

SLA Hall of Shame

Crazy service provider SLA content collection

• Excessive list of unreasonable exclusions
• Subcontractors’ behavior could be excluded
• Downtime credit, equal to downtime percent x the MRC
• Controllable FM events (internal labor issues, health events)
• Difficult downtime or credit calculations that don’t make sense
• Credits are not valid if agreement is terminated early or not renewed
• Customer is not current on their account, SLA or credits do not count/apply
• Total downtime = to prorated credit value (down 3 hrs = 3/720hrs = 0.4% credit)
• SLOs don’t apply if customer fails to report the issue or request a trouble ticket
• Downtime during off hours (overnight) do not count towards availability metrics
• Different availability commitments based on different support-levels packages
• Extending the agreement term by the length of downtime as a form of a remedy

SLA Dos and Don’ts

Dos

• Do negotiate SLOs to vendor’s average performance
• Do strive for automated reporting and credit processes
• Do right-size and create your SLO criteria based on risk mitigation
• Do review SLA attainment results with strategic service providers on a regular basis
• Do ensure that all key elements and components of an SLA are present in the document or appendix

Don'ts

• Don’t accept the providers response that “we can’t change the SLOs for you because then we’d have to change them for everyone”
• Don’t leave SLA preparation to the last minute. Give it priority as you negotiate with the provider
• Don’t create complex SLAs with numerous service levels and SLOs that need to be reported and managed
• Don’t aim for absolute perfection. Rather, prioritize which service levels are most important to you for the service

Summary of Accomplishment

Problem Solved

Knowledge Gained

• Understanding of the elements and components of an SLA
• A list of SLO metrics aligned to service types that meet your organization’s criteria
• SLA metric/KPI templates
• SLA Management process for your provider’s service objectives
• Reporting and tracking process for performance trending

Deliverables Completed

• SLA component and contract element checklist
• Evaluation or service provider SLAs
• SLA templates for strategic service types
• SLA tracker for strategic service providers

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

Contact your account representative for more information.

workshops@infotech.com

1-888-670-8889

Related Info-Tech Research

Improve IT-Business Alignment Through an Internal SLA

• Understand business requirements, clarify current capabilities, and enable strategies to close service-level gaps.

Data center Co-location SLA & Service Definition Template

• In essence, the SLA defines the “product” that is being purchased, permitting the provider to rationalize resources to best meet the needs of varied clients, and permits the buyer to ensure that business requirements are being met.

Ensure Cloud Security in IaaS, PaaS, and SaaS Environments

• Keep your information security risks manageable when leveraging the benefits of cloud computing.

Bibliography

Henderson, George. “3 Most Common Types of Service Level Agreement (SLA).” Master of Project Academy. N.d. Web.

“Guide to Security Operations Metrics.” Logsign. Oct 5, 2020. Web.

Lemos, Rob. “4 lessons from SOC metrics: What your SpecOps team needs to know.” TechBeacon. N.d. Web.

“Measuring and Making the Most of Service Desk Metrics.” Freshworks. N.d. Web.

Overby, Stephanie. “15 SLA Mistakes IT Leaders Still Make.” CIO. Jan 21, 2021.

State of Hybrid Work in IT: A Trend Report

When tech giants can’t agree and best practices change by the minute, forge your own path to your next normal.

Hybrid is here. Now how do we do this?

The pandemic has catapulted hybrid work to the forefront of strategic decisions an organization needs to make. According to our State of Hybrid Work in IT survey conducted in July of 2022, nearly all organizations across all industries are continuing some form of hybrid or remote work long-term (n=518). Flexible work location options are the single greatest concern for employees seeking a new job. IT departments are tasked with not only solving hybrid work questions for their own personnel but also supporting a hybrid-first organization, which means significant changes to technology and operations.

Faced with decisions that alter the very foundation of how an organization functions, IT leaders are looking for best practices and coming up empty. The world of work has changed quickly and unexpectedly. If you feel you are “winging it” in the new normal, you are not alone.

95% of organizations are continuing some form of hybrid or remote work.

n=518

47% of respondents look at hybrid work options when evaluating a new employer, vs. 46% who look at salary.

n=518

Hybrid work model decision tree

Your organization, your employees, your goals – your hybrid work

The days of a “typical” workplace have passed. When it comes to the new world of hybrid work, there is no best-of-breed example to follow.

Among the flood of contradictory decisions made by industry leaders, your IT organization must forge its own path, informed by the needs of your employees and your organizational goals.

All IT work models can support the broader organization. However, IT is more effective in a hybrid work mode.

Stay informed on where your industry is headed, but learn from, rather than follow, industry leaders.

All industries reported primarily using partial, balanced & full hybrid work models.

All industries reported some fully remote work, ranging from 2-10% of organizations surveyed.

Construction and healthcare & life sciences did not require any fully in-office work. Other industries, between 1-12% required fully in-office work.

Move beyond following tech giants

The uncomfortable truth about hybrid work is that there are many viable models, and the “best of breed” depends on who you ask. In the post-pandemic workspace, for every work location model there is an industry leader that has made it functional. And yet this doesn’t mean that every model will be viable for your organization.

In the absence of a single best practice, rely on an individualized cost-benefit assessment rooted in objective feasibility criteria. Every work model – whether it continues your status quo or overhauls the working environment – introduces risk. Only in the context of your particular organization does that risk become quantifiable.

Don’t make the mistake of emulating the tech giants, unless they are your direct competition. Instead, look to organizations that have walked your path in terms of scope, organizational goals, industry, and organizational structure.

Comparative

Your competitors

Info-Tech Insight

Remember, your competitors are not just those who compete for the same customers but also those who compete for your employees.

IT must balance commitments to both the organization and its employees

IT has two roles: to effectively support the broader organization and to function effectively within the department. It therefore has two main stakeholder relationships: the organization it supports and the employees it houses. Hybrid work impacts both. Don't make the mistake of overweighting one relationship at the expense of the other. IT will only function effectively when it addresses both.

Track your progress with the right metrics

This report contains:

1. IT and the Organization
   1. IT Effectiveness
      in a Hybrid World
   2. The Impact of Hybrid on Infrastructure & Operations
2. IT and Its Employees
   1. What Hybrid Means for the IT Workforce
   2. Leadership for Hybrid IT Teams

This report is based on organizations like yours

This report is based on organizations like yours

This report is based on organizations like yours

This report is based on organizations like yours

At a high level, hybrid work in IT is everywhere

INDUSTRY

ORGANIZATIONAL SIZE

POSITION LEVEL

• Executive
• Director
• Supervisor/Manager
• Student/Contractor/Team Member

100% of industries, organizational sizes, and position levels reported some form of hybrid or remote work.

Work model breakdown at the respondent level

n=516

Industry lens: Work location model

Percentage of IT roles currently in a hybrid or remote work arrangement

Work location model by organization size

Hybrid work options

Expense reimbursement

NOTES

n=518

Home office setup: One-time lump-sum payment

Home utilities: Gas, electricity, lights, etc.

Other: Office supplies, portion of home rent/mortgage payments, etc.

01 TECHNOLOGY

IT and the Organization

Section 1

The promise of hybrid work for IT department effectiveness and the costs of making it happen

In this section:

1. IT Effectiveness in a Hybrid World
2. The Impact of Hybrid on Infrastructure & Operations

Hybrid work models in IT bolster effectiveness

IT’s effectiveness, meaning its ability to enable organizational goal attainment, is its ultimate success metric. In the post-pandemic world, this indicator is intimately tied to IT’s work location model, as well as IT’s ability to support the work location model used by the broader organization.

In 2022, 90% of organizations have embraced some form of hybrid work (n=516). And only a small contingent of IT departments have more than 90% of roles still working completely in office, with no remote work offered (n=515).

This outcome was not unexpected, given the unprecedented success of remote work during the pandemic. However, the implications of this work model were far less certain. Would productivity remain once the threat of layoffs had passed? Would hybrid work be viable in the long term, once the novelty wore off? Would teams be able to function collaboratively without meeting face to face? Would hybrid allow a great culture
to continue?

All signs point to yes. For most IT departments, the benefits of hybrid work outweigh its costs. IT is significantly more effective when some degree of remote or hybrid work is present.

n=518

Remote Work Effectiveness Paradox

When IT itself works fully onsite, lower effectiveness is reported (6.2). When IT is tasked with supporting fully, 100% remote organizations (as opposed to being fully remote only within IT), lower effectiveness is reported then as well (5.9). A fully remote organization means 100% virtual communication, so the expectations placed on IT increase, as do the stakes of any errors. Of note, hybrid work models yield consistent effectiveness scores when implemented at both the IT and organizational levels.

IT has risen to the challenge of hybrid

Despite the challenges initially posed by hybrid and remote organizations, IT has thrived through the pandemic and into this newly common workplace.

Most organizations have experienced an unchanged or increased level of service requests and incidents. However, for the majority of organizations, service desk support has maintained (58%) or improved (35%). Only 7% of IT organizations report decreased service desk support.

Is your service desk able to offer the same level of support compared to the pre-pandemic/pre-hybrid work model?

How has the volume of your service requests/incidents changed?

Has hybrid work impacted your customer satisfaction scores?

Industry lens: Volume of service requests

It is interesting to note that service request volumes have evolved similarly across industries, mirroring the remarkable consistency with which hybrid work has been adopted across disparate fields, from construction to government.

Of note are two industries where the volume of service requests mostly increased: government and media, information, telecom & technology.

With the global expansion of digital products and services through the pandemic, it’s no surprise to see volumes increase for media, information, telecom & technology. With government, the shift from on premises to rapid and large-scale hybrid or remote work for administrative and knowledge worker roles likely meant additional support from IT to equip employees and end users with the necessary tools to carry out work offsite.

How has the volume of your service requests/incidents changed?

The transition to hybrid was worth the effort

Hybrid and remote work have been associated with greater productivity and organizational benefits since before the pandemic. During emergency remote work, doubts arose about whether productivity would be maintained under such extreme circumstances and were quickly dispelled. The promise of remote productivity held up.

Now, cautiously entering a “new normal,” the question has emerged again. Will long-term hybrid work bring the same benefits?

The expectations have held up, with hybrid work benefits ranging from reduced facilities costs to greater employee performance.

Organizational hybrid work may place additional strain on IT,
but it is clear IT can handle the challenge. And when it does,
the organizational benefits are tremendous.

88% of respondents reported increased or consistent Infrastructure & Operations customer satisfaction scores.

What benefits has the organization achieved as a result of moving to a hybrid work model?

n=487

Hybrid has sped up modernization of IT processes and infrastructure

Of the organizations surveyed, the vast majority reported significant changes to both the process and the technology side of IT operations. Four key processes affected by the move to hybrid were:

• Incident management
• Service request support
• Asset management
• Change management

Within Infrastructure & Operations, the area with the greatest degree
of change was network architecture (reported by 44% of respondents), followed closely by service desk (41%) and recovery workspaces and mitigations (40%).

63% of respondents reported changes to conference room technology to support hybrid meetings.

n=496

IT Infrastructure & Operations changes, upgrades, and modernization

What process(es) had the highest degree of change in response to supporting hybrid work?

Hybrid has permanently changed deployment strategy

Forty-five percent of respondents reported significant changes to deployment as a result of hybrid work, with an additional 42% reporting minor changes. Only 13% of respondents stated that their deployment processes remained unchanged following the shift to hybrid work.

With the ever-increasing globalization of business, deployment modernization practices such as the shift to zero touch are no longer optional or a bonus. They are a critical part of business operation that bring efficiency benefits beyond just supporting hybrid work.

The deployment changes brought on by hybrid span across industries. Even in manufacturing, with the greatest proportion of respondents reporting “no change” to deployment practices (33%), most organizations experienced some degree of change.

Has a hybrid work model led you to make any changes to your deployment, such as zero touch, to get equipment to end users?

Industry lens: Deployment changes

Has a hybrid work model led you to make any changes to your deployment, such as zero touch, to get equipment to end users?

Hybrid work has accelerated organizational digitization

Over half of respondents reported significantly decreased reliance on printed copies as a result of hybrid. While these changes were on the horizon for many organizations even before the pandemic, the necessity of keeping business operations running during lockdowns meant that critical resources could be invested in these processes. As a result, digitization has leapt forward.

This represents an opportunity for businesses to re-evaluate their relationships with printing vendors. Resources spent on printing can be reduced or reallocated, representing additional savings as a result of moving to hybrid. Additionally, many respondents report a willingness – and ability – from vendors to partner with organizations in driving innovation and enabling digitization.

With respect to changes pertaining to hard copies/printers as a result of your hybrid work model:

Hybrid work necessitates network and communications modernization

The majority (63%) of respondents reported making significant changes to conference room technology as a result of hybrid work. A significant proportion (30%) report that such changes were not needed, but this includes organizations who had already set up remote communication.

An important group is the remaining 8% of respondents, who cite budgetary restrictions as a key barrier in making the necessary technology upgrades. Ensure the business case for communication technology appropriately reflects the impact of these upgrades, and reduce the impact of legacy technology where possible:

• Recognize not just meeting efficiency but also the impact on culture, engagement, morale, and external and internal clients.
• Connect conference room tech modernization to the overall business goals and work it into the IT strategy.
• Leverage the scheduling flexibility available in hybrid work arrangements to reduce reliance on inadequate conference technology by scheduling in-person meetings where possible and necessary.

Have you made changes/upgrades
to the conference room technology to support hybrid meetings?
(E.g. Some participants joining remotely, some participants present in a conference room)

How we can help

For a comprehensive list of resources, visit
Info-Tech’s Hybrid Workplace Research Center

02 PEOPLE

IT and Its Employees

Section 2

Cultivate the dream team in a newly hybrid world

In this section:

1. What Hybrid Means for the IT Workforce
2. Leadership for IT Hybrid Teams

Hybrid means permanent change to how IT hires

Since before the pandemic, the intangibles of having a job that works with your lifestyle have been steadily growing in importance. Considerations like flexible work options, work-life balance, and culture are more important to employees now than they were two years ago, and employers must adapt.

Salary alone is no longer enough to recruit the best talent, nor is it the key to keeping employees engaged and productive. Hybrid work options are the single biggest concern for IT professionals seeking new employment, just edging out salary. This means employers must not offer just some work flexibility but truly embrace a hybrid environment.

What are you considering when looking at a potential employer?

A recession may not significantly impact hybrid work decisions overall

Declining economic conditions suggest that a talent market shift may be imminent. Moving toward a recession may mean less competition for top talent, but this doesn't mean hybrid will be left behind as a recruitment tactic.

Just over half of IT organizations surveyed are considering expanding hybrid work or moving to fully remote work even in a recession. Hybrid work is a critical enabler of organizational success when resources are scarce, due to the productivity benefits and cost savings it has demonstrated. Organizations that recognize this and adequately invest in hybrid tools now will have equipped themselves with an invaluable tool for weathering a recession storm, should one come.

What impact could a potential recession in the coming year have on your decisions around your work location?

Hybrid work may help small organizations in a declining economy

The potential for a recession has a greater impact on the workforce decisions of small organizations. They likely face greater financial pressures than medium and large-sized organizations, pressures that could necessitate halting recruitment efforts or holding firm on current salaries and health benefits.

A reliance on intangible benefits, like the continuation of hybrid work, may help offset some of negative effects of such freezes, including the risk of lower employee engagement and productivity. Survey respondents indicated that hybrid work options (47%) were slightly more important to them than salary/compensation (46%) and significantly more important than benefits (29%), which could work in favor of small organizations in keeping the critical employees needed to survive an economic downturn.

Currently considering some form of hiring/salary freeze or cutbacks, if a recession occurs

NOTES

n=520

Small: <101 employees

Medium: 101-5000 employees

Large: >5,000 employees

Hybrid mitigates the main challenge of remote work

One advantage of hybrid over remote work is the ability to maintain an in-office presence, which provides a failsafe should technology or other barriers stand in the way of effective distance communication. To take full advantage of this, teams should coordinate tasks with location, so that employees get the most out of the unique benefits of working in office and remotely.

Activities to prioritize for in-office work:

• Collaboration and brainstorming
• Team-building activities
• Introductions and onboarding

Activities to prioritize for remote work:

• Individual focus time

As a leader, what are your greatest concerns with hybrid work?

Hybrid necessitates additional effort by managers

When it comes to leading a hybrid team, there is no ignoring the impact of distance on communication and team cohesion. Among leaders’ top concerns are employee wellbeing and the ability to pick up on signs of demotivation among team members.

The top two tactics used by managers to mitigate these concerns center on increasing communication:

• Staying available through instant messaging.
• Increasing team meetings.

Tactics most used by highly effective IT departments

Team success is linked to the number of tools at the manager’s disposal

The most effective hybrid team management tools focus on overcoming the greatest obstacle introduced by remote work: barriers to communication and connection.

The most effective IT organizations use a variety of tactics. For managers looking to improve hybrid team effectiveness, the critical factor is less the tactic used and more the ability to adapt their approach to their team’s needs and incorporate team feedback. As such, IT effectiveness is linked to the total number of tactics used by managers.

IT department effectiveness

Autonomy is key to hybrid team success

Not all hybrid work models are created equal. IT leaders working with hybrid teams have many decisions to make, from how many days will be spent in and out of office to how much control employees get over which days they work remotely.

Employee and manager preferences are largely aligned regarding the number of days spent working remotely or onsite: Two to three days in office is the most selected option for both groups, although overall manager preferences lean slightly toward more time spent in office.

Comparison of leader and employee preference for days in-office

Do employees have a choice in the days they work in office/offsite?

For most organizations, employees get a choice of which days they spend working remotely. This autonomy can range from complete freedom to a choice between several pre-approved days depending on team scheduling needs.

Work is still needed to increase autonomy in hybrid teams

Organizations’ success in establishing hybrid team autonomy varies greatly post pandemic. Responses are roughly equally split between staff feeling more, less, or the same level of autonomy as before the pandemic. Evaluated in the context of most organizations continuing a hybrid approach, this leads to the conclusion that not all hybrid implementations are being conducted equally effectively when it comes to employee empowerment.

As an employee, how much control do you have over the decisions related to where, when, and how you work currently?

Connectedness in hybrid teams lags behind

A strong case can be made for fostering autonomy and empowerment on hybrid teams. Employees who report lower levels of control than before the pandemic also report lower engagement indicators, such as trust in senior leadership, motivation, and intention to stay with the organization. On the other hand, employees experiencing increased levels of control report gains in these areas.

The only exception to these gains is the sense of team connectedness, which employees experiencing more control report as lower than before the pandemic. A greater sense of connectedness among employees reporting decreased control may be related to more mandatory in-office time or a sense of connection over shared team-level disengagement.

These findings reinforce the need for hybrid teams to invest in team building and communication practices and confirm that significant benefits are to be had when a sense of autonomy can be successfully instilled.

Employees who experience less control than before the pandemic report lowered engagement indicators ... except sense of connectedness

Employees who experience more control than before the pandemic report increased engagement indicators ... except sense of connectedness

Case study: Hybrid work at Microsoft Canada

How we can help

For a comprehensive list of resources, visit
Info-Tech’s Hybrid Workplace Research Center

Recommendations

The last two years have been a great experiment, but it’s not over.

Info-Tech Insight

Hybrid and remote teams require more attention, connection, and leadership from managers. The shift from doing the day-to-day to effectively leading is critical for the success of nontraditional work models. As hybrid and remote work become engrained in society, organizations must ensure that the concept of the “working manager” is as obsolete as the rotary telephone.

Bibliography

“8 Unexpected Benefits of Online Learning for Development.” Center for Creative Leadership (CCL), 14 Oct. 2020. Accessed 5 Nov. 2021.
“2021 Global Workplace Report.” NTT, 2021. Accessed 6 July 2022.
“Advantages of Online Learning for Leadership Development: What Our Research Says.” CCL, 8 Dec. 2020. 5 Nov. 2021.
“Annual Work Trend Index Report – Great Expectations: Making Hybrid Work Work.” Microsoft WorkLab, 2022. Accessed 6 July 2022.
Aten, Jason. “Google’s Employees Return to the Office Today. This Former Exec Says Hybrid Work Won’t Last.” Inc.Com, 4 April 2022. Web.
Bariso, Justin. “Google Spent 2 Years Researching What Makes a Great Remote Team. It Came Up With These 3 Things.” Inc.Com, 8 April 2019. Web.
Berger, Chloe. “What Is ‘Hybrid Guilt’? Going to Office Part-Time May Be Worst Option.” Fortune, 22 Aug. 2022. Web.
Brodkin, Jon. “After Remote-Work Ultimatum, Musk Reveals Plan to Cut 10% of Tesla Jobs.” Ars Technica, 3 June 2022. Web.
Brown, Brené, host. “Brené with Scott Sonenshein on Why We’ll Never Be the Same Again (and Why It’s Time to Talk About It).” Dare to Lead with Brené Brown, 11 April 2022. Brené Brown, https://brenebrown.com/podcast/why-well-never-be-the-same-again-and-why-its-time-to-talk-about-it/.
Burgess, Mark. “Most Asset Managers Operating Under Hybrid Work Model: Survey.” Advisor’s Edge, 13 Sept. 2022. Web.
Caminiti, Susan. “Workers Want Hybrid but Say It’s Exhausting Them. Here’s How Companies Can Fix That.” CNBC, 8 Feb. 2022. Web.
Capossela, Chris. “The next Chapter of Our Hybrid Workplace: Update on Our Washington State Work Sites.” The Official Microsoft Blog, 14 Feb. 2022. Web.
Carrigan, John. “Meta Embraces ‘Work From Anywhere’ Ahead of Return to Office.” Human Resources Director, 25 March 2022. Web.
Chaturvedi, H., and Ajoy Kumar Dey. The New Normal: Reinventing Professional Life and Familial Bonding in the Post COVID 19 Era. Bloomsbury Publishing, 2021.
Commonwealth of Massachusetts. “Alternative Work Options.” Mass.Gov, n.d. Accessed 17 Sept. 2022.
Commonwealth of Massachusetts. “Hybrid Work for Commonwealth Employees.” Mass.Gov, n.d. Accessed 17 Sept. 2022.
“COVID-19 and the Future of Business.” IBM, 21 Sept. 2020. Web.
Daniel, Will. “The Layoffs at Tesla Show That White-Collar Workers Are Screwed, Hedge Funder Famous from ‘The Big Short’ Predicts.” Fortune, 29 June 2022. Web.
D’Auria, Gemma, and Aaron De Smet. “Leadership in a Crisis: Responding to Coronavirus.” McKinsey, 16 March 2020. Web.
Dave, Paresh. “Google Mandates Workers Back to Silicon Valley, Other Offices from April 4.” Reuters, 3 March. 2022. Web.
Delaney, Kevin. “What We Know Now About the Business Impact of Hybrid Work.” Time, 6 Sept. 2022. Web.
Dobson, Sarah. “Legal Considerations for Hybrid Work.” Canadian HR Reporter, 15 Sept. 2022. Web.
Dondo, Jean. “Hybrid Work Is the Way for More Than a Quarter of Canadian Investment Firms.” Wealth Professional, 14 Sept. 2022. Web.
Elias, Jennifer. “Twitter to Reopen Offices March 15, Though Remote Work Remains an Option.” CNBC, 3 March 2022. Web.
Esade Business & Law School. “Leadership After Covid-19: Learning To Navigate The Unknown Unknowns.” Forbes, 30 March 2021. Web.
“Famous Companies Without Offices.” The Hoxton Mix, 19 Oct. 2021. Web.
Gerdeman, Dina. “COVID Killed the Traditional Workplace. What Should Companies Do Now?” HBS Working Knowledge, 8 March 2021. Web.
Gleason, Mike. “Apple’s Hybrid Work Plans Draw Worker Pushback.” SearchUnifiedCommunications, TechTarget, 24 Aug. 2022. Web.
Gleeson, Brent. “13 Tips For Leading And Managing Remote Teams.” Forbes, 26 Aug. 2020. Web.
Gratton, Lynda. “How to Do Hybrid Right.” Harvard Business Review, 1 May 2021. Web.
“Guide: Understand team effectiveness.” re:Work, Google, n.d. Accessed 5 Nov. 2021.
Hardy, Karen. “Your Business Has Decided on Hybrid Work… Now What?” CIO, 12 Sept. 2022. Web.
Hirsch, Arlene S. “How to Boost Employee Performance in a Hybrid Work Environment.” SHRM, 6 Sept. 2022. Web.
“How to Get Hybrid Work Right.” CBRE Canada, 14 June 2022. Web.
“Hybrid Work: When Freedom Benefits from Rules.” Audi, 12 Sept. 2022. Accessed 18 Sept. 2022.
“Hybrid Workplace | Global Culture Report.” O.C. Tanner, 2022, Web.
“Intel Is Hiring for Various Roles with Temporary Remote Work Benefits.” SightsIn Plus, 11 June 2022. Web.
Iyer, Viswanathan. “Council Post: Hybrid Work: Beyond The Point Of No Return.” Forbes, 14 Sept. 2022. Web.
Johnson, Ricardo. “Securing Hybrid Work All Starts with Zero-Trust.” SC Media, 29 Aug. 2022. Web.
Jones, Jada. “The Rules of Work Are Changing, and Hybrid Work Is Winning.” ZDNET, 1 Sept. 2022. Web.
Kowitt, Beth. “Inside Google’s Push to Nail Hybrid Work and Bring Its 165,000-Person Workforce Back to the Office Part-Time.” Fortune, 17 May 2022. Web.
Kumra, Gautam, and Diaan-Yi Lin. “The Future of (Hybrid) Work.” McKinsey, 2 Sept. 2022. Web.
Lagowska, Urszula, et al. “Leadership under Crises: A Research Agenda for the Post-COVID-19 Era.” Brazilian Administration Review, vol. 17, no. 2, Aug. 2020. Web.
Larson, Barbara Z., et al. “A Guide to Managing Your (Newly) Remote Workers.” Harvard Business Review, 18 March 2020. Web.
“Leadership During COVID-19: Resources for Times of Uncertainty.” CCL, n.d. Accessed 5 Nov. 2021.
“Managing Remote Employees: How to Lead From a Distance.” CCL, 7 April 2020. Accessed 5 Nov. 2021.
“Managing Remote Teams.” Know Your Team, n.d. Web. Accessed 5 Nov. 2021.
Mayhem, Julian. “Virtual Leadership - Essential Skills for Managing Remote Teams.” VirtualSpeech, 4 Nov. 2020. Web.
McKendrick, Joe. “Keeping Hybrid Workers In Sync, Digitally And In-Person.” Forbes, 22 Aug. 2022. Web.
McKenna, Karissa, et al. “Webinar: Build Leadership Skills for the New World of Work.” CCL, 15 June 2020. Accessed 5 Nov. 2021.
Mearian, Lucas. “Microsoft Edges Back to ‘Normal’ with Workplace Reopening Plan.” Computerworld, 14 Feb. 2022. Web.
“Meta Careers.” Meta, n.d. Accessed 17 Sept. 2022.
Miller, Mark. “5 Tips to Make Your Hybrid Work Model More Effective.” Entrepreneur, 25 Aug. 2022. Web.
Nica, Irina. “How to Manage a Remote Team: 14 Effective Tips for Your Business.” Business 2 Community, 8 July 2021. Web.
O’Halloran, Joe. “Organisations Struggle to Support IT in a Hybrid Work Model.” ComputerWeekly.com, 17 June 2022. Web.
Ong, Ivan. “Council Post: Why Hybrid Work Is The Way To Go.” Forbes, 12 Sept. 2022. Web.
Osborne, Charlie. “The End of Fully Remote Work? Google Begins Shift to the Hybrid Office.” ZDNet. 3 March 2022. Web.
Pazzanese, Christina. “Back to Office? Stay Remote? Go Hybrid?” Harvard Gazette, 24 Aug. 2022. Web.
“PinFlex.” Pinterest Careers, n.d. Accessed 17 Sept. 2022.
Rand, Ben. “Does Hybrid Work Actually Work? Insights from 30,000 Emails.” Harvard Business School – Working Knowledge, 6 Sept. 2022. Web.
“Remote Locations, Working with Flexibility.” Amazon.jobs, n.d. Accessed 17 Sept. 2022.
Renjen, Punit. “The Heart of Resilient Leadership: Responding to COVID-19.” Deloitte Insights, 16 March 2020. Web.
Shih, Clara. “Keeping Hybrid Employees Engaged.” Harvard Business Review, 11 Aug. 2022. Web.
Singerman, Michelle. “Is the Hybrid Work Model Working? CPAs Spill the Beans.” Chartered Professional Accountants Canada, 24 Aug. 2022. Web.
Stern, Stefan. “Hybrid Working: Why the Office-Home Balance Is Still a Challenge.” Financial Times, 4 Sept. 2022.
Subramaniam, Vanmala, et al. “Ready to Go Back to the Office? Employers and Workers Are Divided over the Fate of Remote Work.” The Globe and Mail, 1 Sept. 2022. Web.
Tong, Goh Chiew. “Inflation and Hybrid Work ‘skyrocketed’ Demand for Flexible Workspace, WeWork Says.” CNBC, 6 Sept. 2022. Web.
Tsipursky, Gleb. “Commentary: The Psychology behind Why Some Leaders Are Resisting a Hybrid Work Model.” Fortune, 8 June 2021. Web.
Turner, Jack. “Tesla Doubles Down on Remote Working Ban, Tracks Office Attendance.” Tech.Co, 3 July 2022. Web.
“Virtual Leadership Styles for Remote Businesses.” Maryville Online, 4 Feb. 2021. Web.
“Webinar: How Leaders Can Build Organizational Resilience.” CCL, 15 June 2020. Accessed 5 Nov. 2021.
“Why GitLab Uses the Term All-Remote to Describe Its 100% Remote Workforce.” GitLab, 2022. Accessed 17 Sept. 2022.
Wigert, Ben, and Sangeeta Agrawal. “Returning to the Office: The Current, Preferred and Future State of Remote Work.” Gallup, 31 Aug. 2022. Web.
Wingard, Jason. “Elon Musk’s Big Bet Against Remote Work: Will Tesla Win?” Forbes, 4 June 2022. Web.

Implement the Next-Generation IT Operating Model

The operating model for organizations embracing Exponential IT and transforming into technology-first enterprises.

Analyst Perspective

Be the organization that can thrive in an exponential IT world.

Carlene McCubbin Research Practice Lead CIO Organizational Transformation Practice Info-Tech Research Group	Brittany Lutes Research Director, CIO Organization Transformation Practice Info-Tech Research Group

IT leaders are increasingly expected to be responsible for understanding and delivering high-value customer experiences. This evolution depends on the distribution and oversight of IT capabilities that are embedded throughout the organizational structure.

Defining digital strategic objectives, establishing governance frameworks for an autonomous culture, and enabling the organization to act on insightful data are all impossible without a new way of operating that involves the oversight and accountability of advancing IT roles. Through exponential change, functional groups can lose clarity regarding their responsibilities, creating a sense of ambiguity and disorder.

But adopting a new way of working that supports an exponential IT organization does not have to be difficult. Leveraging Info-Tech Research Group's next-generation operating model, you can clearly demonstrate how the organization will collaborate to deliver on the various digital and IT services. This is no longer just an IT operating model, but a technology-first enterprise model.

Included in this blueprint:

Exponential IT Model

Defines how the Exponential IT model operates and delivers value to the organization.
This is done by exploring:

• Exponential IT cultural norms and behaviors
• Opportunities and risks of the Exponential IT model
• A breakdown of the embedded, integrated, and centralized aspects of the model
• Operating model value stream stages
• An assessment on whether the Exponential IT operating model is right for your organization

Changing Role of IT Leader

Defines how chief information officers (CIOs) can operate or elevate their role in this changing operating model.

• Identifies why the C-suite is changing – again
• How IT leaders should consider where they will add value in the new operating model
• Outlines examples of future organization-wide structures and where IT roles are positioned
• Supports IT leaders in developing themselves to operate in this structure

Executive Summary

Your Challenge

IT is challenged to change how it operates to better support evolving organizations. IT must:

• Consider the needs of customers, end users, and organization stakeholders simultaneously.
• Leverage resources strategically to support the various IT and digital services being offered.
• Create a digital services enablement office to design, monitor, and enhance services continuously.

While many organizations have projects that support a digital strategy, few have an operating model that supports this digital services strategy.

Common Obstacles

Organizations struggle to support the definition and ongoing maintenance of services because:

• The organization's Digital and IT services offerings are not clear.
• The functional team accountable to deliver on each IT or Digital service is ambiguous.
• There are insufficient resources to support all the IT and Digital services being offered.
• C-suite leaders required to support the services are missing or in the wrong role to effectively lead.
• Technology has not been standardized to ensure consistency and effectiveness.

Info-Tech's Approach

Embrace the IT operating model that focuses on the enablement and delivery of Digital and IT services by:

• Having technology stakeholders actively collaborate to decide on priorities and deliver on objectives.
• Leveraging data more effectively across the organization to understand and meet user needs.
• Ensuring technology architecture and security standards are well-established and followed by all throughout the organization.
• Allocating dedicated and skilled resources to ensure services can be continuously delivered.

Info-Tech Insight

The first IT operating model where customer engagement with IT and Digital Services is at the forefront.

What is an operating model?

An IT operating model is a visual representation of the way your IT organization will function using a clear and coherent blueprint. This visualization demonstrates how capabilities are organized and aligned to deliver on the business mission and strategic and technological objectives.

The should visualize the optimization and alignment of the IT organization to deliver the capabilities required to achieve business goals. Additionally, it should demonstrate the workflow so key stakeholders can understand where inputs flow in and outputs flow out of the IT organization. Investing time in the front-end to get the operating model right is critical. This will give you a framework to rationalize future organizational changes, allowing you to be more iterative and your model to change as the business changes.

From computerization to digitization to the new frontier in autonomization, IT has progressively matured, enabling it to actively lead this next stage of business transformation.

EXPONENTIAL RISK
Autonomous processes will integrate with human-led processes, creating risks to business continuity, information security, and quality of delivery. Supplier power will exacerbate business risks.

EXPONENTIAL REWARD
The efficiency gains and new value chains created through artificial intelligence (AI), robotics, and additive manufacturing will be very significant. Most of this value will be realized through the augmentation of human labor.

EXPONENTIAL DEMAND
Autonomous solutions for productivity and back-office applications will eventually become commoditized and provided by a handful of large vendors. There will, however, be a proliferation of in-house algorithms and workflows to autonomize the middle and front office, offered by a busy landscape of industry-centric capability vendors.

EXPONENTIAL IT

Exponential IT involves IT leading the cognitive re-engineering of the organization with evolved practices for:

• IT governance
• Asset management
• Vendor management
• Data management
• Business continuity management
• Information security management

To learn more about IT's journey into autonomization, check out Info-Tech Research Group's Adopt an Exponential IT Mindset blueprint.

The IT operating model must evolve to respond to exponential change

• Ensuring customers are not an afterthought to IT leaders. Customers inform how and where IT leaders invest resources to realize organizational objectives.
• Adopting a formalized approach to service definition and delivery to eliminate silos.
• Leveraging data throughout the organization to better inform and enable the various digital services in meeting customer demands.
• Responding to employee demands for development and training opportunities by applying skills in new settings.
• Having cross-collaboration mechanisms built into the ways of operating to reduce silos across the organization.
• Enabling services through a strong set of governance and risk mandates and practices.
• Eliminating the need for IT capabilities to only be within an IT department.

IT can no longer be just a service provider:

78% of IT leaders with established digital strategies and 45% of IT leaders with emerging digital strategies are driven by customer experiences.
Source: Foundry "Digital Business Study,"2023

40% - The number of CIOs that are responsible for creating new products or services to support revenue generation.
Source: Foundry, "The State of the CIO," 2023

This change requires a breakdown of traditional IT-business divisions

CIOs must recognize that separating IT from the business is restrictive

• Many organizations have recently completed or are in the process of completing a digital transformation focused on enhanced employee and customer experiences.
• Post-transformation organizations must change how they operate to continue to deliver on those enhanced experiences, especially for the customer.
• There must no longer be a wall between IT and the business, but a unified organization offering digital services that include IT components. Already, 81% of work is being performed across the functional boundaries created in an organization (Deloitte, 2023).
• Effectively designing, delivering, and maintaining these services depends on a Digital Services functional layer, expanding IT's involvement into how the business delivers worthwhile experiences to customers.
• This Digital Services functional layer will consider whether the new services are better owned by the IT group or another area of the organization.
• CIOs need to be prepared to adopt a new way of operating or be left to manage a smaller subset of IT functions.

"I think we've done the IT industry a disservice by constantly referring to IT and the business, artificially creating this wedge."
– David Vidoni, VP of IT at Pegasystems
Source: Dan Roberts, CIO, 2023

Four trends driving an Exponential IT organization include:

Emerging Technologies

• 67% of respondents to KPMG's 2022 Global Tech Survey indicated they intend to embrace emerging platforms by the end of 2024.(1)
• The technology landscape is constantly shifting with artificial intelligence (AI), quantum computing, 5G cellular networks, and next-generation robotics. Each of these technologies requires new capabilities and a new way in which those capabilities are organized.

Enhanced Customer Experiences

• 24% of CIOs have been tasked by their CEO to increase the customer experience.(3)
• Organizations realize that to gain and retain customers, it has become necessary to consistently evaluate service offerings and identify opportunities for enhancement or new services.

Digital Trust

• 1/3 of CISOs plan to increase their GRC focus during the next year and 36% have already begun to implement Zero Trust components.(2)
• Risk and security capabilities mature focusing on defined enterprise accountability, consideration of ethics and inclusivity and proactive security controls.

Embedded Technology & Skills

• Spending on embedded software is expected to increase to $21.5 billion by 2027.(4)
• The technology strategy no longer resides solely within IT. The organization must take ownership of this strategy while they define their digital strategies. Technology services are also embedded.

(1) "Global Tech Survey," KPMG, 2022
(2) "Global Digital Trust Insights Report," PwC, 2023
(3) "State of IT Report," Foundry, 2023
(4) "Global surge in embedded software demand; here is why," DAC Digital, 2023

Application of the Four Key Trends on your Exponential IT operating model:

Adopting an Exponential IT operating model is typically influenced by resonating with the following drivers:

Section 1: The Next-Generation Operating Model

The Technology Value Trinity

All three elements of the Technology Value Trinity work together to deliver business value and achieve strategic needs. As one changes, the others must change as well.
How do these three elements relate?

• I&T Operating Model aligns resources, processes, measures, stakeholders, value streams, and decision rights to enable the delivery of your strategy and priorities. This is done by strategically structuring IT capabilities in a way that enables the organization's vision and considers the context in which the model will operate.
• Digital and IT Strategy tells you what you must achieve to be successful. For an Exponential IT organization, customer demands and digital service offerings would drive strategic decisions.
• I&T Governance is the confirmation of IT's goals and strategy, which ensures the alignment of IT and business strategy. This is the mechanism by which you continuously prioritize work so that what is delivered aligns with the strategy.

Strategy, operating models, and governance are too often considered separate practices – strategies are defined without clarity on how to support. A significant change to your strategy necessitates a change to your operating model, which in turn necessitates a change to your governance and organizational structure.

The Exponential IT operating model delivers value across seven components

Organizations adopting the Exponential IT Model will experience new norms and behaviors

Customer-Centric
Dedicated to the customer experience and making sure that the end customer is considered first and foremost.

"Yes" Approach
The organization can say yes to emerging technology and customer desires because it has organized itself to be agile in its digital service offerings.

Digital Service Ownership
Digital service offerings are owned and managed across the organization ensuring the continuous delivery of value to customers.

Employee Development
Resources are organized into pods based on specific skills or functions increasing the likelihood of adopting new skills.

Autonomization
Centralized and accessible data provides service owners autonomy when making informed decisions that support enhanced customer experiences.

Exponential IT is an embedded model approach

Info-Tech has identified seven common IT operating model archetypes. Each model represents a different approach to who delivers technology services and how. Each model is designed to drive different outcomes, as the way your organization is structured will dictate the way it behaves. The Exponential IT model is an emerging archetype which capitalizes on embedded delivery.

Centralized	Shifted	Embedded
Owned and operated by leadership within IT. IT takes full responsibility of the functional areas and maintains control over the outcomes.	Can be owned/operated by a variety of leadership roles throughout the organization. This can shift from IT ownership to other organizational leadership. Decisions about ownership are often made to enable quick response or mitigate risks.	Owned/operated by leadership outside of traditional IT. Another area of the organization has taken authoritative power over the outcome of this functional area for a quicker response.

Even as an embedded IT operating model, shifted and centralized IT functions as support

1. Embedded functions required for scaled autonomation
   Definition and oversight of the organization's strategic direction demonstrated through a customer-first culture, data insights, and a well-defined risk appetite.
2. Integrated design and optimization of the digital service offering
   Actively considers the customer experience and designs the appropriate services to be delivered. Considers all aspects in the design and delivery of services by exploring opportunities to integrate components to enhance customer experiences or architecting new service offerings to eliminate gaps.
3. Centralized standards for IT technology, security & resources
   Technology functions continue to deliver exceptional services to the enterprise including clear standards for technology and solution architecture, application of security requirements, and resources to enable various service offerings.

Opportunities and risks of the Exponential IT model

The Exponential IT operating model blends embedded, shifted and centralized delivery to balance agility & risk

The Exponential IT model commands a new placement and significance of IT capabilities

Using capabilities for the operating model

• Capabilities are focused on the entire system that would be in place to satisfy a particular need. This not only includes the people who are able to complete a specific task, but the technology, processes, and resources required to deliver.
• Focusing on capabilities rather than the individuals in organizational redesign enables a more objective and holistic view of what your organization is striving toward.
• Capabilities deliver on specific need(s) and how they are organized changes the way those needs are delivered.

1. Embedded functions required for autonomization

Overview of the function:

• Focuses on a single strategy and roadmap for the organization that actively includes technology.
• Governance, risk, compliance, and general oversight are defined and embedded throughout the organization.
• Ensures that quality data is being generated to help inform the defined digital service offering.
• Readies the organization to adopt emerging technology quickly and with minimal disruption to other digital service offerings.
• A team of technical experts that decides what information should exist for operational efficiency or service innovation.

2. Integrated design and optimization of the digital service offering

Overview of the function:

• Analyzes and responds to insights about the customer experience.
• Maintains the portfolio of the organization's digital service offerings.
• Considers what is necessary to operate efficiently as an organization while simultaneously exploring emerging technology to optimize new or existing digital services.
• Requires the expertise and involvement of both business-minded and technology-skilled resources.
• The differentiating factor from other IT operating models is how it holistically considers all the components throughout the organization and how they are connected.

3. Centralized standards for IT technology, security & resources

Overview of the function:

• Compared with other IT operating model archetypes, the Exponential IT model has fewer capabilities that are centralized within the technology function of an organization.
• Architecture and standards are the foundation of successful embedded delivery, ensuring reuse, improved integration, and a unified experience. This includes technology, risk, data, AI and security architecture, models, and standards.
• Employee resources are also organized in pods to be leveraged based on greatest need and skills availability.
• This lets the organization be more agile when innovating and implementing new digital service offerings.

Exponential IT explores new value stream stages

Customer Perspective		The organization is continually anticipating their wants and needs and establishing mechanisms to vocalize those needs.	Customer receives the right IT and digital services to respond to their needs.	The service is easy to use and continuously responds to wants and needs.	The service is meeting expectations or exceeding them.	There is a dedicated service owner who can hear demands and feedback, then action desirable outcomes.
Value Stream Stages
Organizational Perspective	Expected Outcome	Customers' wants and needs are understood and at times anticipated before the customer requests them.	Assess needs to determine if service is already offered or needs to be created. Design services that will enhance the customer experience.	Look for opportunities to integrate processes and resources to increase the performance of IT and Digital Services.	Ensure that the right employees with the right skills are working to develop or enhance service offering.	The service owner manages the ongoing lifecycle of the service and establishes a roadmap on how value will continue to be delivered.
	Critical Processes	Customer experience Research and innovation Stakeholder management	Research and innovation Service design & portfolio management	Performance management Continuous improvement Integration planning	Service management Resource planning and allocation	Service strategy & roadmap Service governance Service performance management
	Metrics	Customer satisfaction score Service-to-need alignment	Gaps in service portfolio Speed to design services	Service performance Service adoption	Time to resolve customer demand Frequency by which service requires enhancements	Service satisfaction Alignment of service strategy to organization strategy

1.1 Assess if the Exponential IT operating model is right for your organization

1 hour

1. Begin by downloading the Exponential IT Operating Model Assessment.
2. Review the questions within each of the operating model components. For each question, use the drop-down menu to determine your level of agreement.
3. The more your organization agrees with the statements, the more likely your organization is prepared to implement an Exponential IT operating model.
4. The less your organization agrees with the statements, the more likely you should adopt a different IT operating model.
5. For support implementing the Exponential IT or another IT operating model, explore the Visualize Your IT Operating Model blueprint (coming soon).

Input

• Desire to change the organization's IT & Digital operating model

Output

• Desire to implement the IT & Digital Service Enablement operating model

Materials

• Exponential IT Operating Model Assessment

Participants

• Executive IT leadership
• Business leadership

Explore other Info-Tech research to support your organization transformation initiatives

Visualize the IT Operating Model blueprint (coming soon)

Redesign Your IT Organizational Structure

Section 2: Elevating the CIO Role

The next generation of IT C-suite roles are here

As the operating model changes and becomes increasingly embedded into the organization's delivery of IT and Digital Services, new C-suite roles are being defined

• One of the most critical roles being defined in this change is the Chief Digital Services Officer (CDSO) who focuses on all components of the digital experience from the lens of the customer.
• There are two directions from which the CDSO role is typically approached as it gains popularity:
• CIOs evolve beyond just information and technology—focusing on how IT & Digital Services enhance the customer experience
• Business leaders who have technical know-how increase their involvement and responsibility over IT related functions
• IT leaders need to consider where they would rather sit: focused only on technology and remaining a service provider to the organization, or embedding technology into the services, products, and organization in general?

Info-Tech Insight

This is not about making the CIO report to someone else but allowing the CIO to elevate their role into that of a CDSO.

Increasing IT leadership's span of control throughout the organization

As maturity increases so does span of control, ownership & executive influence

Organizations hoping to fully adopt the Exponential IT operating model require a shift in leadership expectations. Notably, these leaders will have oversight and accountability for functions beyond the traditional IT group.

As the organization matures its governance, security, and data management practices, increasing how it delivers high-impact experiences to customers, it would have one leader who owns all the components to ensure clear alignment with goals and business strategy.

Emerging Exponential IT organizations will have distributed authority

• Organizations beginning their transition toward an exponential model often continue to have distributed leaders providing oversight of distinct functional areas.
• Their spans of control are smaller, but very clearly defined, eliminating confusion through a transparent accountability framework.
• Each leader strives toward optimization and efficiency regarding IT capabilities, for which they are responsible.

1. Distributed Leadership
   Embedded functions required for scaled autonomation
   Distributed leaders identify the ways technology will enable them to advance enterprise objectives while maintaining autonomy over their own functions. They may oversee technology.
2. Experience Officer
   Integrated design and optimization of the digital service offering
   An Experience Officer will help consider the insights gained from enterprise data and make informed decisions around enterprise service offerings. They actively explore new ways to deliver high-value experiences.
3. Chief Technology Officer (CTO)
   Centralized standards for IT technology, security & resources
   A CTO will continue to oversee the core technology, including infrastructure and service management functions.

Established organizations will be driven by a digital transformation journey

• Organizations that have begun to deliver on their transformation journey will typically see two distinct C-suite leaders emerge—the CIO and the CDO.
• The Chief Digital Officer (CDO) often explores ways to optimize the integration and management of data to enable insightful decision making from the organization.
• The Chief Information Officer (CIO), however, considers mechanisms to standardize how new technologies can be integrated with the architecture.
• While both leaders have distinct responsibilities, their roles intersect at the customer experience.

Advanced organizations will be managed by a single emerging role

• A single leader will oversee all the functional areas where value is delivered and enabled by IT capabilities.
• Through a large span of control, this leader can holistically consider opportunities to optimize the customer experience and ensure recommendations are actioned to deliver on that enhanced experience.
• This leader's span of control will require a strong understanding of both strategic and operational functions to authoritatively oversee all aspects for which they are responsible.

CDSO – Chief Digital Service Officer

1. Embedded functions required for scaled autonomation
   The CDSO will set, oversee, and manage the delivery of an enterprise's digital strategy, ensuring accountability through good governance and data practices.
2. Integrated design and optimization of the digital service offering
   They ensure that the enterprise holistically considers the various services that could be offered to exceed customer expectations through high-impact experiences.
3. Centralized standards for IT technology, security & resources
   They also ensure stable and secure architecture standards to enable consistency across the organization and a seamless ability to integrate new technology to support service offerings.

Evolution of the IT C-suite now includes the CDSO

Examples of what the emerging organizational structure can look like

This is more than a new title for IT leaders

It's about establishing a business first perspective

• IT leaders exploring this new way of operating are not just adopting the new title of CDSO or CDIO.
• These leaders must change how information, technology, and digital experiences are consumed across the various stakeholders – especially the end customer.
• IT leaders who pursue this new IT operating model choose to be more than order takers for an organization.
• They are:
• Partners in defining the organization's digital service offerings
• Recognizing the benefits of distributing decision-making authority for IT-related aspects to others throughout the organization
• Prioritizing capabilities like portfolio management, architecture, vendor management, relationship management, cloud and user experience

"'For me, the IT portfolio for the next few years and the IT architecture have taken the place that IT strategy used to have,' he adds. This view doesn't position IT outside of the organization, but rather gives it central importance in the company."
– Bernd Rattey, Group CIO and CDO of Deutsche Bahn (DB), qtd. by Jens Dose, CIO, 2023

1.2 Plan your career move to CDSO

1-3 hours

• Create a roadmap on how to move from your current role to CDSO by identifying current strengths and opportunities to improve.
• Download the Career Vision Roadmap Tool from the website. An example of this is on the next slide.
• Document the tagline. This is your overarching career focus and goal – what is your passion? Think beyond titles to what you want to be doing, the atmosphere you want to be in, and what you want to add value to.
• Document the current role: what are the strengths, achievements and opportunities?
• Consider the CDSO role: how will you build stronger relationships and competencies to elevate your profile within the organization? What is an example of what someone would display in this role?
• Define specific roles or stakeholders that you should develop a stronger relationship with.

Download the Career Vision Roadmap Tool

Input

• Desire to implement the IT & Digital Service Enablement Operating Model

Output

• Roadmap to elevate from a CIO to a CDSO

Materials

• Career Vision Roadmap
• IT & Digital Services Enablement operating model archetype
• CDSO job profile

Participants

• CIO (or any other role aspiring to eventually become a CDSO)
• Individual activity

Career Vision Roadmap:
Executive Leader
Akbar K.

Sample

To provide customers with an exceptional experience by ensuring all IT and Digital Services consider and anticipate their needs or wants. Enable IT and Digital Services to be successful through clear leadership, strong collaboration, and continuous improvement or innovation.

CIO

1. Establish technology standards that enable the organization to consistently and securely integrate platforms or solutions.
2. Lead the project team that defined and standardized the organization's reference architecture.
3. Need to work on listening to a variety of stakeholder demands rather than only specific roles/titles.

Transition

• Strengths: Technology acumen, budget planning, allocating resources
• Enhance: Stakeholder relationship management.
• Work with current CDO to define and implement more digital transformation initiatives.

CDSO

• Being responsive to customer expectations and communicating clear and realistic timelines.
• Establish trust among the organization that services will deliver expected value.
• Empowering service owners to manage and oversee the delivery of their services.

Network Opportunities

• Connect with board members and understand each of their key areas of priority.
• Begin to interact with end customers and define ways that will enhance their customer experience.
• Chief Digital Officer

Actions now in line with aspiration

Appendix: Capabilities & Capability Model

IT and digital capabilities

Using capabilities for the operating model:

• Capabilities are focused on the entire system that would be in place to satisfy a particular need. This not only includes people who have skills to complete a specific task, but also the technology, processes, and resources required to deliver.
• Focusing on capabilities rather than the individuals in organizational redesign enables a more objective and holistic view of what your organization is striving toward.
• Capabilities deliver on specific need(s) and how they are organized changes the way those need(s) are delivered.

Research Contributors and Experts

Donna Bales
Principal Research Director
Info-Tech Research Group

Scott Bickley
Practice Lead – Vendor Management Practice
Info-Tech Research Group

Christine Coz
Executive Counselor – Executive Services
Info-Tech Research Group

Valence Howden
Principal Research Director
Info-Tech Research Group

Duraid Ibrahim
Executive Counselor – Executive Services
Info-Tech Research Group

Chris Goodhue
Managing Partner– Executive Services
Info-Tech Research Group

Carlene McCubbin
Practice Lead – CIO Practice
Info-Tech Research Group

Mike Tweedie
Practice Lead – CIO Practice
Info-Tech Research Group

Vicki van Alphen
Executive Counselor – Executive Services
Info-Tech Research Group

*Plus an additional 5 industry experts who anonymously contributed to this research piece.

Related Info-Tech Research

Adopt an Exponential IT Mindset

• To succeed in the coming business transformation, IT will have to adopt different priorities in its mission, governance, capabilities, and partnerships.
• CIOs will have to provide exceptionally mature services while owning business targets.

Become a Transformational CIO

• Business transformations are happening, but CIOs are often involved only when it comes time to implement change. This makes it difficult for the CIO to be perceived as an organizational leader.
• Elevate your stature as a business leader.
• Create a high-powered IT organization that is focused on driving lasting change, improving client experiences, and encouraging collaboration across the entire enterprise.

Define Your Digital Business Strategy

• Design a strategy that applies innovation to your business model, streamline and transform processes, and make use of technologies to enhance interactions with customers and employees.
• Pre-pandemic digital strategies have been primarily focused on automation. However, your post-pandemic digital strategy must focus on driving resilience for growth opportunities.

Bibliography

Bennet, Trevon. "What is a Chief Experience Officer (CXO)? And what do they do?" Indeed, 14 March 2023. https://www.indeed.com/career-advice/finding-a-job/what-is-chief-experience-officer#:~:text=A%20CXO%20plans%20strategies%20and,customer%20acquisition%20and%20retention%20strategies
Bishop, Carrie. "Five years of Digital Services in San Francisco." Medium, 20 January 2022. https://medium.com/san-francisco-digital-services/five-years-of-digital-services-in-san-francisco-805a758c2b83
DAC Digital and Chawla, Yash. "Global surge in embedded software demand; here is why." DAC Digital, 2023 <ttps://dac.digital/global-surge-in-embedded-software-demand-here-is-why/
Deloitte. "If you want your digital transformation to succeed, align your operating model to your strategy." Harvard Business Review, 31 January 2020. https://hbr.org/sponsored/2020/01/if-you-want-your-digital-transformation-to-succeed-align-your-operating-model-to-your-strategy.
Deloitte. "2023 Global Human Capital Trends Report." Deloitte, 2023. https://www2.deloitte.com/content/dam/Deloitte/sg/Documents/human-capital/sea-cons-hc-trends-report-2023.pdf
Dose, Jens. "Deutsche Bahn CIO on track to decentralize IT." CIO, 19 April 2023. https://www.cio.com/article/473071/deutsche-bahn-cio-on-track-to-decentralize-it.html
Ehrlich, Oliver., Fanderl, Harald., Maldara, David., & Mittangunta, Divya. "How the operating model can unlock the power of customer experience." McKinsey, 28 June 2022. https://www.mckinsey.com/capabilities/growth-marketing-and-sales/our-insights/how-the-operating-model-can-unlock-the-full-power-of-customer-experience
FCW. "Digital Government Summit Agenda." FCW. 2021. https://events-archive.fcw.com/events/2021/digital-government-summit/index.html
Foundry. "State of the CIO." IDG, 25 January 2023. https://foundryco.com/tools-for-marketers/research-state-of-the-cio/
Foundry. "Digital Business Study 2023: IT Leaders are future-proofing their business with digital strategies." IDG, 2023. https://foundryco.com/tools-for-marketers/research-digital-business/
Indeed Editorial Team. "Centralized vs. Decentralized Structures: 7 Key Differences." Indeed, 10 March 2023. https://www.indeed.com/career-advice/career-development/centralized-vs-decentralized
Indeed Editorial Team. "What is process integration?." Indeed, 14 November 2022. https://ca.indeed.com/career-advice/career-development/process-integration#:~:text=Process%20integration%2C%20or%20business%20process,it%20reach%20its%20primary%20objectives
KPMG International. "Global Tech Report." KPMG, 2022.
McHugh, Brian. "Service orchestration is reshaping IT—Here's what to know." Active Batch, 8 November 2022. https://www.advsyscon.com/blog/service-orchestration-what-is/
Morris, Chris. "IDC FutureScape: Worldwide CIO Agenda 2023 Predictions."" IDC, January, 2023. https://www.idc.com/getdoc.jsp?containerId=AP49998523
PwC. "Global Digital Trust Insights Report." PwC, 2023
Roberts, Dan. "5 CIOs on building a service-oriented IT culture." CIO, 13 April 2023. https://www.cio.com/article/472805/5-cios-on-building-a-service-oriented-it-culture.html
Singh, Yashvendra. "CIOs must evolve to stave off existential threat to their role." CIO, 30 March 2023. https://www.cio.com/article/465612/cios-must-evolve-to-stave-off-existential-threat-to-their-role.html
Spacey, John. "16 Examples of IT Services." Simplicable, 28 January 2018. https://simplicable.com/IT/it-services

Security Priorities 2022

The pandemic has changed how we work

disruptions to the way we work caused by the pandemic are here to stay.

The pandemic has introduced a lot of changes to our lives over the past two years, and this is also true for various aspects of how we work. In particular, a large workforce moved online overnight, which shifted the work environment rapidly.

People changed how they communicate, how they access company information, and how they connect to the company network. These changes make cybersecurity a more important focus than ever.

Although changes like the shift to remote work occurred in response to the pandemic, they are largely expected to remain, regardless of the progression of the pandemic itself. This report will look into important security trends and the priorities that stemmed from these trends.

30% more professionals expect transformative permanent change compared to one year ago.

47% of professionals expect a lot of permanent change; this remains the same as last year. (Source: Info-Tech Tech Trends 2022 Survey; N=475)

The cost of a security breach is rising steeply

The shift to remote work exposes organizations to more costly cyber incidents than ever before.

Remote work is here to stay, and the cost of a breach is higher when remote work is involved.

The cost comes not only directly from payments but also indirectly from reputational loss. (Source: IBM, 2021)

Security teams can participate in the solution

The numbers are clear: in 2022, when we face a threat environment like WE’VE never EXPERIENCED before, good security is worth the investment

Breaches are 34% less costly when mature zero trust is implemented.

A fully staffed and well-prepared security team could save the cost through quick responses. (Source: IBM, 2021)

Top security priorities and constraints in 2022

Survey results

As part of its research process for the 2022 Security Priorities Report, Info-Tech Research Group surveyed security and IT leaders (N=97) to ask their top security priorities as well as their main obstacles to security success in 2022:

Top Priorities Survey respondents were asked to force-rank their security priorities. Among the priorities chosen most frequently as #1 were talent management, addressing ransomware threats, and securing hybrid/remote work.

Top Obstacles Talent management is both the #1 priority and the top obstacle facing security leaders in 2022. Unsurprisingly, the ever-changing environment in a world emerging from a pandemic and budget constraints are also top obstacles.

We know the priorities…

But what are security leaders actually working on?

This report details what we see the world demanding of security leaders in the coming year.

Setting aside the demands – what are security leaders actually working on?

Many organizations are still mastering the foundations of a mature cybersecurity program. This is a good idea! Most breaches are still due to gaps in foundational security, not lack of advanced controls.

We know the priorities…

But what are security leaders actually working on?

One industry plainly stands out from the rest. Government organizations are proportionally much more active in security than other industries, and for good reason: they are common targets. Manufacturing and professional services are proportionally less interested in security. This is concerning, given the recent targeting of supply chain and personal data holders by ransomware gangs.

5 Security Priorities for 2022

People

1. Acquiring and Retaining Talent
   Create a good working environment for existing and potential employees. Invest time and effort into talent issues to avoid being understaffed.
2. Securing a Remote Workforce
   Create a secure environment for users and help your people build safe habits while working remotely.

Process

3. Securing Digital Transformation
   Build in security from the start and check in frequently to create agile and secure user experiences.

Technology

4. Adopting Zero Trust
   Manage access of sensitive information based on the principle of least privilege.
5. Protecting Against and Responding to Ransomware
   Put in your best effort to build defenses but also prepare for a breach and know how to recover.

Acquire and Retain Talent

Priority 01

Security talent was in short supply before the pandemic, and it's even worse now.

Executive summary

Background

Cybersecurity talent has been in short supply for years, but this shortage has inflected upward since the pandemic.

The Great Resignation contributed to the existing talent gap. The pandemic has changed how people work as well as how and where they choose work. More and more senior workers are retiring early or opting for remote working opportunities.

The cost to acquire cybersecurity talent is huge, and the challenge doesn’t end there. Retaining top talent can be equally difficult.

Current situation

• A 2021 survey by ESG shows that 76% of security professional agree it’s difficult to recruit talent, and 57% said their organization is affected by this talent shortage.
• (ISC)2 reports there are 2.72 million unfilled job openings and an increasing workforce gap (2021).

2.72 million unfilled cybersecurity openings (Source: (ISC)2, 2021)

IT leaders must do more to attract and retain talent in 2022

• Over 70% of IT professionals are considering quitting their jobs (TalentLMS, 2021). Meanwhile, 51% of surveyed cybersecurity professionals report extreme burnout during the last 12 months and many of them have considered quitting because of it (VMWare, 2021).
• Working remotely makes it easier for people to look elsewhere, lowering the barrier to leaving.
• This is a big problem for security leaders, as cybersecurity talent is in very short supply. The cost of acquiring and retaining quality cybersecurity staff in 2022 is significant, and many organizations are unwilling or unable to pay the premium.
• Top talent will demand flexible working conditions – even though remote work comes with security risk.
• Most smart, talented new hires in 2022 are demanding to work remotely most of the time.

Talent will be 2022’s #1 strength and #1 weakness

Recommended Actions

Talent acquisition and retention plan

Use this template to explain the priorities you need your stakeholders to know about.

Provide a brief value statement for the initiative.

Address a top priority and a top obstacle with a plan to attract and retain top organizational and cybersecurity talent.

Initiative Description: Provide secure remote work capabilities for staff. Work with HR to refine a hiring plan that addresses geographical and compensation gaps with cybersecurity and general staff. Survey staff engagement to identify points of friction and remediate where needed. Define a career path and growth plan for staff.		Description must include what IT will undertake to complete the initiative.
Primary Business Benefits: Reduction in costs due to turnover and talent loss	Other Expected Business Benefits: Productivity due to good morale/ engagement Improved corporate culture	Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.
Risks: Big organizational and cultural changes Increased attack surface of remote/hybrid workforce		Related Info-Tech Research: Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan Build an IT Employee Engagement Program

Secure a Remote Workforce

Priority 02

Trends suggest remote work is here to stay. Addressing the risk of insecure endpoints can no longer be deferred.

Executive summary

Remote work poses unique challenges to cybersecurity teams. The personal home environment may introduce unauthorized people and unknown network vulnerabilities, and the organization loses nearly all power and influence over the daily cyber hygiene of its users.

In addition, the software used for enabling remote work itself can be a target of cybersecurity criminals.

Current situation

• 70% of workers in technical services work from home.
• Employees of larger firms and highly paid individuals are more likely to be working outside the office.
• 80% of security and business leaders find that remote work has increased the risk of a breach.
(Source: StatCan, 2021)

70% of tech workers work from home (Source: Statcan, 2021)

Remote work demands new security solutions

The security perimeter is finally gone The data is outside the datacenter. The users are outside the office. The endpoints are … anywhere and everywhere. Organizations that did not implement digital transformation changes following COVID-19 experience higher costs following a breach, likely because it is taking nearly two months longer, on average, to detect and contain a breach when more than 50% of staff are working remotely (IBM, 2021). In 2022 the cumulative risk of so many remote connections means we need to rethink how we secure the remote/hybrid workforce.

Security Distributed denial of service DNS hijacking Weak VPN protocols Identity One-time verification allowing lateral movement

Network Risk perimeter stops at corporate network edge Split tunneling Authentication Weak authentication Weak password Access Man-in-the-middle attack Cross-site scripting Session hijacking

Recommended Actions

Roadmap to securing remote/hybrid workforce

Use this template to explain the priorities you need your stakeholders to know about.

Provide a brief value statement for the initiative.

The corporate network now extends to the internet – ensure your security plan has you covered.

Initiative Description: Reassess enterprise security strategy to include the WFH attack surface (especially endpoint visibility). Ensure authentication requirements for remote workers are sufficient (e.g. MFA, strong passwords, hardware tokens for high-risk users/connections). Assess the value of zero trust networking to minimize the blast radius in the case of a breach. Perform penetration testing annually.		Description must include what IT will undertake to complete the initiative.
Primary Business Benefits: Reduced cost of security incidents/reputational damage	Other Expected Business Benefits: Improved ability to attract and retain talent Increased business adaptability	Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.
Risks: Potential disruption to traditional working patterns Cost of investing in WFH versus risk of BYOD		Related Info-Tech Research: Build an Information Security Strategy Develop a Security Awareness and Training Program That Empowers End Users Checklist for Securing Remote Workers

Secure Digital Transformation

Priority 03

Digital transformation could be a competitive advantage…or the cause of your next data breach.

Executive summary

Background

Digital transformation is occurring at an ever-increasing rate these days. As Microsoft CEO Satya Nadella said early in the pandemic, “We’ve seen two years’ worth of digital transformation in two months.”

We have heard similar stories from Info-Tech members who deployed rollouts that were scheduled to take months over a weekend instead.

Microsoft’s own shift to rapidly expand its Teams product is a prime example of how quickly the digital landscape has changed. The global adaption to a digital world has largely been a success story, but rapid change comes with risk, and there is a parallel story of rampant cyberattacks like we have never seen before.

Insight

There is an adage that “slow is smooth, and smooth is fast” – the implication being that fast is sloppy. In 2022 we’ll see a pattern of organizations working to catch up their cybersecurity with the transformations we all made in 2020.

$1.78 trillion expected in digital transformation investments (Source: World Economic Forum, 2021)

An ounce of security prevention versus a pound of cure

The journey of digital transformation is a risky one.

Recommended Actions

Securing digital transformation

Use this template to explain the priorities you need your stakeholders to know about.

Provide a brief value statement for the initiative.

Ensure your investment in digital transformation is appropriately secured.

Initiative Description: Engage security with digital transformation and relevant governance structures (steering committees) to ensure security considerations are built into digital transformation planning. Incorporate security stage gates in project management procedures. Establish a vendor security assessment program.		Description must include what IT will undertake to complete the initiative.
Primary Business Benefits: Increased likelihood of digital transformation success	Other Expected Business Benefits: Ability to make informed decisions for the field rep strategy Reduced long-term cost of digital transformation	Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.
Risks: Potential increased up front cost (reduced long-term cost) Potential slowed implementation with security stage gates in project management		Related Info-Tech Research: Build a Vendor Security Assessment Service Implement a Security Governance and Management Program

Adopt Zero Trust

Priority 04

Governments are recognizing the importance of zero trust strategies. So should your organization.

Why now for zero trust?

John Kindervag modernized the concept of zero trust back in 2010, and in the intervening years there has been enormous interest in cybersecurity circles, yet in 2022 only 30% of organizations report even beginning to roll out zero trust capabilities (Statista, 2022).

Why such little action on a revolutionary and compelling model?

Zero trust is not a technology; it is a principle. Zero trust adoption takes concerted planning, effort, and expense, for which the business value has been unclear throughout most of the last 10 years. However, several recent developments are changing that:

• Securing technology has become very hard! The size, complexity, and attack surface of IT environments has grown significantly – especially since the pandemic.
• Cyberattacks have become rampant as the cost to deploy harmful ransomware has become lower and the impact has become higher.
• The shift away from on-premises datacenters and offices created an opening for zero trust investment, and zero trust technology is more mature than ever before.

The time has come for zero trust adoption to begin in earnest.

97% will maintain or increase zero trust budget (Source: Statista, 2022)

Traditional perimeter security is not working

Zero trust directly addresses the most prevalent attack vectors today

A hybrid workforce using traditional VPN creates an environment where we are exposed to all the risks in the wild (unknown devices at any location on any network), but at a stripped-down security level that still provides the trust afforded to on-premises workers using known devices.

What’s more, threats such as ransomware are known to exploit identity and remote access vulnerabilities before moving laterally within a network – vectors that are addressed directly by zero trust identity and networking. Ninety-three percent of surveyed zero trust adopters state that the benefits have matched or exceeded their expectations (iSMG, 2022).

Top reasons for building a zero trust program in 2022

The business case for zero trust is clearer than ever

Prior obstacles to Zero Trust are disappearing

A major obstacle to zero trust adoption has been the sheer cost, along with the lack of business case for that investment. Two factors are changing that paradigm in 2022:

The May 2021 US White House Executive Order for federal agencies to adopt zero trust architecture finally placed zero trust on the radar of many CEOs and board members, creating the business interest and willingness to consider investing in zero trust.

In addition, the cost of adopting zero trust is quickly being surpassed by the cost of not adopting zero trust, as cyberattacks become rampant and successful zero trust deployments create a case study to support investment.

The cost to remediate a ransomware attack more than doubled from 2020 to 2021. Widespread adoption of zero trust capabilities could keep that number from doubling again in 2022. (Source: Sophos, 2021)

The cost of a data breach is on average $1.76 million less for organizations with mature zero trust deployments.

That is, the cost of a data breach is 35% reduced compared to organizations without zero trust controls. (Source: IBM, 2021)

Recommended Actions

Zero trust roadmap

Use this template to explain the priorities you need your stakeholders to know about.

Provide a brief value statement for the initiative.

Develop a practical roadmap that shows the business value of security investment.

Initiative Description: Define desired business and security outcomes from zero trust adoption. Assess zero trust readiness. Build roadmaps for zero trust: Identity Networking Devices Data		Description must include what IT will undertake to complete the initiative.
Primary Business Benefits: Increased security posture and business agility	Other Expected Business Benefits: Reduced impact of security events Reduced cost of managing complex control set More secure business transformation (i.e. cloud/digital)	Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.
Risks: Learning curve of implementation (start small and slow) Transition from current control set to zero trust model		Related Info-Tech Research: Determine Your Zero Trust Readiness

Protect Against and Respond to Ransomware

Priority 05

Ransomware is still the #1 threat to the safety of your data.

Executive summary

Background

• Ransomware attacks have transformed in 2021 and show no sign of slowing in 2022. There is a new major security breach every week, despite organizations spending over $150 billion in a year on cybersecurity (Nasdaq, 2021).
• Ransomware as a service (RaaS) is commonplace, and attackers are doubling down by holding encrypted data ransom and also demanding payment under threat to disclose exfiltrated data – and they are making good on their threats.
• The global cost of ransomware is expected to rise to $265 billion by 2031 (Cybersecurity Ventures, 2021).
• We expect to see an increase in ransomware incidents in 2022, both in severity and volume – multiple attacks and double extortion are now the norm.
• High staff turnover increases risk because new employees are unfamiliar with security protocols.

150% increase ransomware attacks in 2020 (Source: ENISA)

This is a new golden age of ransomware

Many leaders still don’t know what a ransomware recovery would look like

Recommended Actions

Prevent and respond to ransomware

Use this template to explain the priorities you need your stakeholders to know about.

Provide a brief value statement for the initiative.

Determine your current readiness, response plan, and projects to close gaps.

Initiative Description: Execute a systematic assessment of your current security and ransomware recovery capabilities. Perform tabletop activities and live recoveries to test data recovery capabilities. Train staff to detect suspicious communications and protect their identities.		Description must include what IT will undertake to complete the initiative.
Primary Business Benefits: Improved productivity and brand protection	Other Expected Business Benefits: Reduced downtime and disruption Reduced cost due to incidents (ransom payments, remediation)	Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts.
Risks: Friction with existing staff		Related Info-Tech Research: Create a Ransomware Incident Response Plan Defend Against the Evolving Threat of Ransomware

Deepfakes: Dark-horse threat for 2022

Deepfake video

How long has it been since you’ve gone a full workday without having a videoconference with someone?

We have become inherently trustful that the face we see on the screen is real, but the technology required to falsify that video is widely available and runs on commercially available hardware, ushering in a genuinely post-truth online era.

Criminals can use deepfakes to enhance social engineering, to spread misinformation, and to commit fraud and blackmail.

Deepfake audio

Many financial institutions have recently deployed voiceprint authentication. TD describes its VoicePrint as “voice recognition technology that allows us to use your voiceprint – as unique to you as your fingerprint – to validate your identity” over the phone.

However, hackers have been defeating voice recognition for years already. There is ripe potential for voice fakes to fool both modern voice recognition technology and the accounts payable staff.

Bibliography

“2021 Ransomware Statistics, Data, & Trends.” PurpleSec, 2021. Web.

Bayern, Macy. “Why 60% of IT security pros want to quit their jobs right now.” TechRepublic, 10 Oct. 2018. Web.

Bresnahan, Ethan. “How Digital Transformation Impacts IT And Cyber Risk Programs.” CyberSaint Security, 25 Feb. 2021. Web.

Clancy, Molly. “The True Cost of Ransomware.” Backblaze, 9 Sept. 2021.Web.

“Cost of a Data Breach Report 2021.” IBM, 2021. Web.

Cybersecurity Ventures. “Global Ransomware Damage Costs To Exceed $265 Billion By 2031.” Newswires, 4 June 2021. Web.

“Digital Transformation & Cyber Risk: What You Need to Know to Stay Safe.” Ponemon Institute, June 2020. Web.

“Global Incident Response Threat Report: Manipulating Reality.” VMware, 2021.

Granger, Diana. “Karmen Ransomware Variant Introduced by Russian Hacker.” Recorded Future, 18 April 2017. Web.

“Is adopting a zero trust model a priority for your organization?” Statista, 2022. Web.

“(ISC)2 Cybersecurity Workforce Study, 2021: A Resilient Cybersecurity Profession Charts the Path Forward.” (ISC)2, 2021. Web.

Kobialka, Dan. “What Are the Top Zero Trust Strategies for 2022?” MSSP Alert, 10 Feb. 2022. Web.

Kost, Edward. “What is Ransomware as a Service (RaaS)? The Dangerous Threat to World Security.” UpGuard, 1 Nov. 2021. Web.

Lella, Ifigeneia, et al., editors. “ENISA Threat Landscape 2021.” ENISA, Oct. 2021. Web.

Mello, John P., Jr. “700K more cybersecurity workers, but still a talent shortage.” TechBeacon, 7 Dec. 2021. Web.

Naraine, Ryan. “Is the ‘Great Resignation’ Impacting Cybersecurity?” SecurityWeek, 11 Jan. 2022. Web.

Oltsik, Jon. “ESG Research Report: The Life and Times of Cybersecurity Professionals 2021 Volume V.” Enterprise Security Group, 28 July 2021. Web.

Osborne, Charlie. “Ransomware as a service: Negotiators are now in high demand.” ZDNet, 8 July 2021. Web.

Osborne, Charlie. “Ransomware in 2022: We’re all screwed.” ZDNet, 22 Dec. 2021. Web.

“Retaining Tech Employees in the Era of The Great Resignation.” TalentLMS, 19 Oct. 2021. Web.

Rubin, Andrew. “Ransomware Is the Greatest Business Threat in 2022.” Nasdaq, 7 Dec. 2021. Web.

Samartsev, Dmitry, and Daniel Dobrygowski. “5 ways Digital Transformation Officers can make cybersecurity a top priority.“ World Economic Forum, 15 Sept. 2021. Web.

Seymour, John, and Azeem Aqil. “Your Voice is My Passport.” Presented at black hat USA 2018.

Solomon, Howard. “Ransomware attacks will be more targeted in 2022: Trend Micro.” IT World Canada, 6 Jan. 2022. Web.

“The State of Ransomware 2021.” Sophos, April 2021. Web.

Tarun, Renee. “How The Great Resignation Could Benefit Cybersecurity.” Forbes Technology Council, Forbes, 21 Dec. 2021. Web.

“TD VoicePrint.” TD Bank, n.d. Web.

“Working from home during the COVID-19 pandemic, April 202 to June 2021.” Statistics Canada, 4 Aug. 2021. Web.

“Zero Trust Strategies for 2022.” iSMG, Palo Alto Networks, and Optiv, 28 Jan. 2022. Web.

Looking at Risk in a New Light: The Six Pillars of Vendor Risk Management

Approach vendor risk impact assessments from all perspectives.

Analyst Perspective

Organizations must comprehensively understand the impacts vendors may cause through different potential actions.

The risks from the vendor market have become more prevalent as the technologies and organizational strategies shift to a global direction. With this shift in risk comes a necessary perspective change to align with the greater likelihood of an incident occurring from vendors' (or one of their downstream support vendor's) negative actions.

Organizational leadership must become more aware of the increasing risks that engaging vendors impose. To do so, they need to make informed decisions, which can only be provided by engaging expert resources in their organizations to compile a comprehensive look at potential risk impacts.

Frank Sewell

Research Director, Vendor Management
Info-Tech Research Group

Executive Summary

Info-Tech Insight

Organizations must evolve their risk assessments to be more adaptive to respond to changes in the global market. Ongoing monitoring and continual assessment of vendors’ risks is crucial to avoiding negative impacts.

Info-Tech’s multi-blueprint series on vendor risk assessment

There are many individual components of vendor risk beyond cybersecurity.`

This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

Out of Scope:
This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

The world is constantly changing

The IT market is constantly reacting to global influences. By anticipating changes, leaders can set expectations and work with their vendors to accommodate them.

When the unexpected happens, being able to adapt quickly to new priorities ensures continued long-term business success.

Below are some things no one expected to happen in the last few years:

62%

of IT professionals are more concerned about being a victim of ransomware than they were a year ago.

Info-Tech Tech Trends Survey 2022

82%

of Microsoft non-essential employees shifted to working from home in 2020, joining the 18% already remote.

Info-Tech Tech Trends Survey 2022

89%

of organizations invested in web conferencing technology to facilitate collaboration.

Info-Tech Tech Trends Survey 2022

Looking at Risk in a New Light:

the 6 Pillars of Vendor Risk Management

Vendor Risk

• Financial

• Strategic

• Operational

• Security

• Reputational

• Regulatory

• Organizations must review their risk appetite and tolerance levels, considering their complete landscape.
• Changing regulations, acquisitions, and events that affect global supply chains are current realities, not unlikely scenarios.
• Prepare your vendor risk management for success using due diligence and scenario- based “What If” discussions to bring all the relevant parties to the table and educate your whole organization on risk factors.

Strategic risks on a global scale

Odds are at least one of these is currently affecting your strategic plans

• Vendor Acquisitions
• Global Pandemic
• Global Shortages
• Gas Prices
• Poor Vendor Performance
• Travel Bans
• War
• Natural Disasters
• Supply Chain Disruptions
• Security Incidents

Make sure you have the right people at the table to identify and plan to manage impacts.

Assess internal and external operational risk impacts

Two sides of the same coin

Internal

• Poorly vetted supplemental staff
• Bad system configurations
• Lack of relevant skills
• Poor vendor performance
• Failure to follow established processes
• Weak contractual accountability
• Unsupportable or end-of-life system components

External

• Cyberattacks
• Supply Chain Issues
• Geo-Political Disruptions
• Vendor Acquisitions
• N-Party Non-Compliance
• Vendor Fraud

Operational risk is the risk of losses caused by flawed or failed processes, policies, systems, or events that disrupt business operations.

Identify and manage security risk impacts on your organization

Due diligence will enable successful outcomes

• Poor vendor performance
• Vendor acquisition
• Supply chain disruptions and shortages
• N-party risk
• Third-party risk

What your vendor associations say about you

Regulatory compliance

Consider implementing vendor management initiatives and practices in your organization to help gain compliance with your expanding vendor landscape.

Your organizational risks may be monitored but are your n-party vendors?

Review your expectations with your vendors and hold them accountable

Regulatory entities are looking beyond your organization’s internal compliance these days. Instead, they are more and more diving into your third-party and downstream relationships, particularly as awareness of downstream breaches increases globally.

• Are you assessing your vendors regularly?
• Are you validating those assessments?
• Do your vendors have a map of their downstream support vendors?
• Do they have the mechanisms to hold those downstream vendors accountable to your standards?

Identify and manage risks

Regulatory

Regulatory agencies are putting more enforcement around ESG practices across the globe. As a result, organizations will need to monitor the changing regulations and validate that their vendors and n-party support vendors are adhering to these regulations or face penalties for non-compliance.

Security-Data protection

Data protection remains an issue. Organizations should ensure that the data their vendors obtain remains protected throughout the vendor’s lifecycle, including post-termination. Otherwise, they could be monitoring for a data breach in perpetuity.

Mergers and acquisitions

More prominent vendors continuously buy smaller companies to control the market in the IT industry. Organizations should put protections in their contracts to ensure that an IT vendor’s acquisition does not put them in a relationship with someone that could cause them an issue.

Identify and manage risks

Poor vendor performance

Consider the impact of a vendor that fails to perform midway through the implementation. Organizations need to be able to manage the impact of replacing that vendor and cutting their losses rather than continuing to throw good money away after bad performance.

Supply chain disruptions and global shortages

Geopolitical disruptions and natural disasters have caused unprecedented interruptions to business. Incorporate forecasting of product and ongoing business continuity planning into your strategic plans to adapt as events unfold.

Poorly configured systems

Failing to ensure that your vendor-supported systems are properly configured and that your vendors are meeting your IT change control and configuration standards is more commonplace than expected. Proper oversight and management of your support vendors is crucial to ensure they are meeting expectations in this regard.

What to look for

Identify potential risk impacts

• Is there a record of complaints against the vendor from their employees or customers?
• Is the vendor financially sound, with the resources to support your needs?
• Has the vendor been cited for regulatory compliance issues in the past?
• Does the vendor have a comprehensive list of their n-party vendor partners?
  • Are they willing to accept appropriate contractual protections regarding them?
• Does the vendor self-audit, or do they use a vetted third-party audit firm to issue a SOC report annually?
• Does the vendor operate in regions known for instability?
• Is the vendor willing to make concessions on contractual protections, or are they only offering one-sided agreements with as-is warranties?

Prepare your vendor risk management for success

Due diligence will enable successful outcomes.

1. Obtain top-level buy-in; it is critical to success.
2. Build enterprise risk management (ERM) through incremental improvement.
3. Focus initial efforts on the “big wins” to prove the process works.
4. Use existing resources.
5. Build on any risk management activities that already exist in the organization.
6. Socialize ERM throughout the organization to gain additional buy-in.
7. Normalize the process long term with ongoing updates and continuing education for the organization.

(Adapted from COSO)

How to assess third-party risk

1. Review organizational risks

   Understand the organizations risks to prepare for the “What If” game exercise.

2. Identify and understand potential risks

   Play the “What If” game with the right people at the table.

3. Create a risk profile packet for leadership

   Pull all the information together in a presentation document.

4. Validate the risks

   Work with leadership to ensure that the proposed risks are in line with their thoughts.

5. Plan to manage the risks

   Lower the overall risk potential by putting mitigations in place.

6. Communicate the plan

   It is important not only to have a plan but also to socialize it in the organization for awareness.

7. Enact the plan

   Once the plan is finalized and socialized, put it in place with continued monitoring for success.

Adapted from Harvard Law School Forum on Corporate Governance

Insight summary

Risk impacts often come from unexpected places and have significant consequences.

Knowing who your vendors are using for their support and supply chain could be crucial in eliminating the risk of non-compliance for your organization.

Having a plan to identify and validate the regulatory compliance of your vendors is a must for any organization to avoid penalties.

Insight 1

Organizations’ strategic plans need to be adaptable to avoid vendors’ negative actions causing an expedited shift in priorities.

For example, Philips’ recall of ventilators impacted its products and the availability of its competitors’ products as demand overwhelmed the market.

Insight 2

Organizations often fail to understand how n-party vendors could place them in non-compliance.

Even if you know your complete third-party vendor landscape, you may not be aware of the downstream vendors in play. Ensure that you get visibility into this space as well, and hold your direct vendors accountable for the actions of their vendors.

Insight 3

Organizations need to know where their data lives and ensure it is protected.

Make sure you know which vendors are accessing/storing your data, where they are keeping it, and that you can get it back and have the vendors destroy it when the relationship is over. Without adequate protections throughout the lifecycle of the vendor, you could be monitoring for breaches in perpetuity.

Insight summary

Assessing financial impacts is an ongoing, educative, and collaborative multidisciplinary process that vendor management initiatives are uniquely designed to coordinate and manage for organizations.

Operational risk impacts often come from unexpected places and have unforeseen impacts. Knowing where your vendors place in critical business processes and those vendors' business continuity plans concerning your organization should be a priority for those managing the vendors.

Insight 4

Organizations need to learn how to assess the likelihood of potential risks in the rapidly changing online environments and recognize how their partnerships and subcontractors’ actions can affect their brand.

For example, do you understand how a simple news article raises your profile for short-term and long-term adverse events?

Insight 5

Organizations fail to plan for vendor acquisitions appropriately.

Vendors routinely get acquired in the IT space. Does your organization have appropriate safeguards from inadvertently entering a negative relationship? Do you have plans for replacing critical vendors purchased in such a manner?

Insight 6

Vendors are becoming more and more crucial to organizations’ overall operations, and most organizations have a poor understanding of the potential impacts they represent.

Is your vendor solvent? Do they have enough staff to accommodate your needs? Has their long-term planning been affected by changes in the market? Are they unique in their space?

Identifying vendor risk

Who should be included in the discussion?

• While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make informed decisions.
• Getting input from operational experts at your organization will enhance your business's long-term potential for success.
• Involving those who directly manage vendors and understand the market will aid operational experts in determining the forward path for relationships with your current vendors and identifying emerging potential strategic partners.
• Make sure security, risk, and compliance are all at the table. These departments all look at risk from different angles for the business and give valuable insight collectively.
• Organizations have a wealth of experience in their marketing departments that can help identify real-world scenarios of negative actions.

See the blueprint Build an IT Risk Management Program

Review your risk management plans for new risks on a regular basis.

Keep in mind Risk =
Likelihood x Impact
(R=L*I).

Impact (I) tends to remain the same, while Likelihood (L) is becoming closer to 100% as threat actors become more prevalent.

Managing vendor risk impacts

How could your vendors impact your organization?

• Review vendors’ downstream connections to understand thoroughly who you are in business with
• Institute continuous vendor lifecycle management
• Develop IT risk governance and change control
• Introduce continual risk assessment to monitor the relevant vendor markets
• Monitor and schedule contract renewals and new service/module negotiations
• Perform business alignment meetings to reassess relationships
• Ensure strategic alignment in contracts
• Review vendors’ business continuity plans and disaster recovery testing
• Re-evaluate corporate policies frequently
• Monitor your company’s and associated vendors’ online presence
• Be adaptable and allow for innovations that arise from the current needs
  • Capture lessons learned from prior incidents to improve over time, and adjust your plans accordingly

Organizations must review their risk appetite and tolerance levels, considering their complete landscape.

Changing regulations, acquisitions, new security issues, and events that affect global supply chains are current realities, not unlikely scenarios.

Ongoing Improvement

Incorporating lessons learned.

• Over time, despite everyone’s best observations and plans, incidents will catch us off guard.
• When that happens, follow your incident response plans and act accordingly.
• An essential step is to document what worked and what did not – collectively known as the “lessons learned.”
• Use the lessons learned document to devise, incorporate, and enact a better risk management process.

Sometimes disasters occur despite our best plans to manage them.

When this happens, it is important to document the lessons learned and improve our plans going forward.

The "what if" game

1-3 hours

Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible adverse outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

1. Break into smaller groups (if too small, continue as a single group).
2. Use the Comprehensive Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potentials but manage the overall process to keep the discussion pertinent and on track.
3. Collect the outputs and ask the subject matter experts (SMEs) for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

Download the Comprehensive Risk Impact Tool

High risk example from tool

Note: Even though a few items are “scored” they have not been added to the overall weight, signaling that the company has noted but does not necessarily hold them against the vendor.

How to mitigate:

• Contractually insist that the vendor have a third-party security audit performed annually with the stipulation that they will not denigrate below your acceptable standards.
• At renewal negotiate better contractual terms and protections for your organization.

Low risk example from tool

Summary

Seek to understand all potential risk impacts to better prepare your organization for success.

• Organizations need to understand and map out their entire vendor landscape.
• Understand where all your data lives and how you can control it throughout the vendor lifecycle.
• Organizations need to be realistic about the likelihood of potential risks in the changing global world.
• Those organizations that consistently follow their established risk-assessment and due-diligence processes are better positioned to avoid penalties.
• Understand how your vendors prioritize your organization in their business continuity processes.
• Bring the right people to the table to outline potential risks in the market and your organization.
• Socialize the third-party vendor risk management process throughout the organization to heighten awareness and enable employees to help protect the organization.
• Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
• Incorporate lessons learned from prior incidents into your risk management process to build better plans for future issues.

Organizations must evolve their risk assessments to be more meaningful to respond to global changes in the market.

Organizations should increase the resources dedicated to monitoring the market as regulatory agencies continue to hold them more and more accountable.

Bibliography

Olaganathan, Rajee. “Impact of COVID-19 on airline industry and strategic plan for its recovery with special reference to data analytics technology.” Global Journal of Engineering and Technology Advances, vol 7, no 1, 2021, pp. 033-046.

Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012.

Frigo, Mark L., and Richard J. Anderson. “Embracing Enterprise Risk Management: Practical Approaches for Getting Started.” COSO, 2011.

Weak Cybersecurity is taking a toll on Small Businesses (tripwire.com)

SecureLink 2022 White Paper SL_Page_EA+PAM (rocketcdn.me)

Shared Assessments Member Poll March 2021 "Guide: Evolving Work Environments Impact of Covid-19 on Profile and Management of Third Parties“

“Cybersecurity only the tip of the iceberg for third-party risk management”. Help Net Security, April 21, 2021. Accessed: 2022-07-29.

“Third-Party Risk Management (TPRM) Managed Services”. Deloitte, 2022. Accessed: 2022-07-29.

“The Future of TPRM: Third Party Risk Management Predictions for 2022”. OneTrust, December 20th2021. Accessed 2022-07-29.

“Third Party Vendor definition”. Law Insider, Accessed 2022-07-29.

“Third Party Risk”. AWAKE Security, Accessed 2022-07-29.

Glidden, Donna. "Don't Underestimate the Need to Protect Your Brand in Publicity Clauses", Info-Tech Research Group, June 2022.

Greenaway, Jordan. "Managing Reputation Risk: A start-to-finish guide", Transmission Private, July 2022. Accessed June 2022.

Jagiello, Robert D, and Thomas T Hills. “Bad News Has Wings: Dread Risk Mediates Social Amplification in Risk Communication. ”Risk analysis : an official publication of the Society for Risk Analysis vol. 38,10 (2018): 2193-2207.doi:10.1111/risa.13117

Kenton, Will. "Brand Recognition", Investopedia, August 2021. Accessed June 2022. Lischer, Brian. "How Much Does it Cost to Rebrand Your Company?", Ignyte, October 2017. Accessed June 2022.

"Powerful Examples of How to Respond to Negative Reviews", Review Trackers, February 2022. Accessed June 2022.

"The CEO Reputation Premium: Gaining Advantage in the Engagement Era", Weber Shadwick, March 2015. Accessed on June 2022.

"Valuation of Trademarks: Everything You Need to Know",UpCounsel, 2022. Accessed June 2022.

Related Info-Tech Research

Identify and Manage Financial Risk Impacts on Your Organization

• Vendor management practices educate organizations on potential financial impacts that vendors may incur and suggest systems to help manage them.
• Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

Identify and Manage Reputational Risk Impacts on Your Organization

• Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
• Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

Identify and Manage Strategic Risk Impacts on Your Organization

• Vendor management practices educate organizations on potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
• Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your strategic plan with our Strategic Risk Impact Tool.

Regulatory guidance and industry standards

• International Organization for Standardization (ISO)
• FOREIGN CORRUPT PRACTICES ACT (FCPA)
• Sarbanes–Oxley Act (SOX)
• National Institute of Standards & Technology (NIST)
• Control Objectives for Information and Related Technologies (COBIT)
• EU General Data Protection Regulation 2016/679 (“GDPR”);
• UK General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018 (UKGDPR)
• Swiss Federal Act on Data Protection(Swiss FDPA) – coming September 1, 2023
• IR35 (UK Off-Payroll compliance)
Technology Code of Practice (UK)
• Modern Slavery Act 2015 (UK)
• Defense Federal Acquisition Regulation Supplement (DFARS)
• Cybersecurity Maturity Model Certification (CMMC)
• Payment Card Industry Data Security Standard (PCI DSS)
• Family Educational Rights and Privacy Act (FERPA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Health Information Technology for Economic and Clinical Health Act (HITECH)