Contact Tymans Group
We're here to get your IT Operations performant and resilient
We have the highest respect for your person. We contact you only with responses to your questions. Our company ethics insist on transparency and honesty.
We have the highest respect for your person. We contact you only with responses to your questions. Our company ethics insist on transparency and honesty.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify your organization's biggest Agile pain points so you can focus attention on those topics that are impacting your Agile capabilities the most.
Ensure that your organization has a solid understanding of Agile principles and practices to help ensure your Agile transformation is successful. Understand Agile's different way of working and identify the steps your organization will need to take to move from traditional Waterfall delivery to Agile.
The Backlog Management Module helps teams develop a better understanding of backlog management and user story decomposition. Improve your backlog quality by implementing a three-tiered backlog with quality filters.
The Scrum Simulation Module helps teams develop a better understanding of Scrum practices and the behavioral blockers affecting Agile teams and organizational culture. This module features two interactive simulations to encourage a deeper understanding of good Scrum practices and Agile principles.
The Estimation Module helps teams develop a better understanding of Agile estimation practices and how to apply them. Teams learn how Agile estimation and reconciliation provide reliable planning estimates.
The Product Owner Module helps teams understand product management fundamentals and a deeper understanding of the product owner role. Teams define their product management terminology, create quality filters for PBIs moving through the backlog, and develop their product roadmap approach for key audiences.
The Product Roadmapping Module helps teams understand product road mapping fundamentals. Teams learn to effectively use the six tools of Product Roadmapping.
Alex Ciraco and Hans Eckman
Application Practice
Info-Tech Research Group
Agile transformations are more likely to be successful when the entire organization genuinely understands Agile fundamentals, principles and practices, as well as the role each person plays in its success. Focus on developing a solid understanding of Agile practices so your organization can "Be Agile", not just "Do Agile".
| 1. Identify Common Agile Challenges |
2. Establish a Solid Foundation for Agile Delivery |
3. Agile Modules |
|
|---|---|---|---|
| Phase Steps |
1.1 Identify common agile challenges |
2.1 Align teams with Agile fundamentals 2.2 Interpret your common Agile challenges survey results 2.3 (Optional) Move stepwise to iterative Agile delivery 2.4 Identify insights and team feedback |
|
| Phase Outcomes |
Understand common challenges associated with Agile transformations and identify your organization's struggles. |
Establish and apply a uniform understanding of Agile fundamentals and principles. Create a roadmap for your transition to Agile delivery and prioritized challenges. |
Foster deeper understanding of Agile principles and practices to resolve pain points. |
Everyone's Agile journey is not the same.
78% of IT professionals believe the business is "usually" or "always" out of sync with project requirements.
Source: "10 Ways Requirements Can Sabotage Your Projects Right From the Start"
Only 34% of software is rated as both important and effective by users.
Leaders and stakeholders are frustrated with long lead times to implement changes. Agile/DevOps promotes smaller, more frequent releases to start earning value sooner.
Time to delivering value depends on Frequency of Releases
64% of IT professionals adopt Agile to enhance their ability to manage changing priorities.
71% of IT professionals found their ability to manage changing priorities improved after implementing Agile.
Traditional delivery processes work on the assumption that product requirements will remain constant throughout the SDLC. This results in delayed delivery of product enhancements which are critical to maintaining a positive customer experience.
Adapted from: "12th Annual State of Agile Report"
"…while there is value in the items on the right, we value the items on the left more."
– Source: "The Agile Manifesto"
|
We value. . . |
||
|---|---|---|
|
Individuals and Interactions |
OVER |
Processes and Tools |
|
Working Software |
OVER |
Comprehensive Documentation |
|
Customer Collaboration |
OVER |
Contract Negotiation |
|
Responding to Change |
OVER |
Following a Plan |
|
Being Agile |
OVER |
Being Prescriptive |
Collaboration
Iterations
Continual Improvement
Prioritization
A "One and Done" Approach (Planning & Documentation Based)
Elapsed time to deliver any value: Months to years
An "Iterative" Approach (Empirical/Evidence Based)
Elapsed time to deliver any value: Weeks
"Although Agile methods are increasingly being adopted in globally distributed settings, there is no panacea for success."
– "Negotiating Common Ground in Distributed Agile Development: A Case Study Perspective."
"Without proper planning, organizations can start throwing more resources at the work which spirals into the classic Waterfall issues of managing by schedule."
– Kristen Morton, Associate Implementation Architect,
OneShield Inc., Info-Tech Interview
With shared ownership instead of silos, we can deliver value at the end of every iteration (aka sprint)
* There are many Agile methodologies to choose from, but Scrum is by far the most widely used (and is shown above).
Key Elements of the Agile SDLC
A well-formed backlog can be thought of as a DEEP backlog:
(Perforce, 2018)
Expand the concepts of defining "ready" and "done" to include the other stages of a PBIs journey through product planning.
Info-Tech Insight: A quality filter ensures quality is met and teams are armed with the right information to work more efficiently and improve throughput.
Many steps in this blueprint are accompanied by supporting deliverables to help you accomplish your goals.
Common Agile Challenges Survey
Survey the organization to understand which of the common Agile challenges the organization is experiencing
Roadmap for Transition to Agile
Identify steps you will take to move your organization toward Agile delivery
|
IT Benefits |
Business Benefits |
|---|---|
|
|
Implementing quality and consistent Agile practices improves SDLC metrics and reduces time to value.
Align Agile coaching and practices to address your key pain points identified in the Common Agile Challenges Survey.
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."
What does a typical GI on this topic look like?
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between 6 to 8 calls over the course of 1 to 2 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
|
Phases 1-2 |
Backlog Management |
Scrum Simulation |
Estimation |
Product Owner |
Product Roadmapping |
|
|---|---|---|---|---|---|---|
|
Establish a Solid Foundation for Agile Delivery |
Define the |
Assess the IT |
Bridge the Gap and |
Establish an Effective Product Owner Role |
Create Effective Product Roadmaps |
|
|
Activities |
1.1 Gather Agile challenges and gaps |
|
|
|
|
|
|
Deliverables |
|
|
|
|
|
|
|
Agile Modules |
||||||
For additional assistance planning your workshop, please refer to the facilitation planning tool in the appendix.
Mentoring for Agile Teams
Get practical help and guidance on your Agile transformation journey.
Implement DevOps Practices That Work
Streamline business value delivery through the strategic adoption of DevOps practices.
Deliver on Your Digital Product Vision
Build a product vision your organization can take from strategy through execution.
Deliver Digital Products at Scale
Deliver value at the scale of your organization through defining enterprise product families.
Phase 1 |
Phase 2 |
Agile Modules |
|---|---|---|
|
1.1 Identify common Agile challenges |
2.1 Align teams with Agile fundamentals 2.2 Interpret your common Agile challenges survey results 2.3 (Optional) Move stepwise to iterative Agile delivery 2.4 Identify insights and team feedback |
|
This phase will walk you through the following activities:
This phase involves the following participants:
Develop Your Agile Approach for a Successful Transformation
1.1 Distribute Common Agile Challenges Survey and collect results
This step involves the following participants:
There isn't one approach that cures all the problems your Agile teams are facing. First, understand these common challenges, then develop a plan to address the root causes.
Use Info-Tech's Common Agile Challenges Survey to determine common issues and what problems individual teams are facing. Use the Agile modules and supporting guides in this blueprint to provide targeted support on what matters most.
Output
Participants
Record the results in the Roadmap for Transition to Agile Template
Phase 1 | Phase 2 | Agile Modules |
|---|---|---|
1.1 Identify common Agile challenges | 2.1 Align teams with Agile fundamentals 2.2 Interpret your common Agile challenges survey results 2.3 (Optional) Move stepwise to iterative Agile delivery 2.4 Identify insights and team feedback |
|
This phase will walk you through the following activities:
This phase involves the following participants:
2.1.1 Share what Agile means to you
2.1.2 (Optional) Contrast two delivery teams
2.1.3 (Optional) Dissect the Agilist's Oath
2.1.4 (Optional) Create your prototype definitions of ready
2.1.5 (Optional) Create your prototype definitions of done
2.1.6 Identify the challenges of implementing agile in your organization
|
What is Agile? |
Why do we do it? |
|---|---|
|
(e.g. Agile mindset, principles, and practices) |
(e.g. benefits) |
Output
Participants
Time to delivering value depends on frequency of releases.
Source: 5Q Partners
Companies also accelerated the pace of creating digital or digitally enhanced products and services.
(McKinsey, 2020 )
"The Digital Economy incorporates all economic activity reliant on or significantly enhanced by the use of digital inputs, including digital technologies, digital infrastructure, digital services and data."
(OECD Definition)
Where are you now?
Where do You Want to Be?
* Google Cloud/Accelerate State of DevOps 2021
A "One and Done" Approach (Planning & Documentation Based)
Elapsed time to deliver any value: Months to years
An "Iterative" Approach (Empirical/Evidence Based)
Elapsed time to deliver any value: Weeks
Discussion (5-10 minutes)


Discuss differences between these teams:
|
| What would have to happen at your organization to make working like this possible? |
|---|
|
Which aspects of the Agilist's Oath are "easy" in your org? |
|---|
|
Which aspects of the Agilist's Oath are "hard" in your org? |
|---|
"Although Agile methods are increasingly being adopted in globally distributed settings, there is no panacea for success."
– "Negotiating Common Ground in Distributed Agile Development: A Case Study Perspective."
"Without proper planning, organizations can start throwing more resources at the work which spirals into the classic Waterfall issues of managing by schedule."
– Kristen Morton, Associate Implementation Architect,
OneShield Inc., Info-Tech Interview
"…while there is value in the items on the right, we value the items on the left more."
– Source: "The Agile Manifesto"
|
We value. . . |
||
|---|---|---|
|
Individuals and Interactions |
OVER |
Processes and Tools |
|
Working Software |
OVER |
Comprehensive Documentation |
|
Customer Collaboration |
OVER |
Contract Negotiation |
|
Responding to Change |
OVER |
Following a Plan |
|
Being Agile |
OVER |
Being Prescriptive |
View additional transition models in the appendix
Key Elements of the Agile SDLC
* There are many Agile methodologies to choose from, but Scrum (shown above) is by far the most widely used.
|
Product Owner |
Scrum Master |
Team Members |
|
|---|---|---|---|
|
Responsible |
|
|
|
|
Accountable |
|
|
|
|
Consulted |
|
|
|
|
Informed |
|
|
|
| Are any of these challenges for your organization? | Done When: |
|---|---|
|
Project Backlog Refinement (PO & SM): Prepare user stories to be used in the next two to three future sprints. User stories are broken down into small manageable pieces of work that should not span sprints. If a user story is too big for a sprint, it is broken down further here. The estimation of the user story is examined, as well as the acceptance criteria, and each is adjusted as necessary from the Agile team members' input. |
Regularly over the project's lifespan |
|
Sprint Planning (PO, SM & Delivery Team): Discuss the work for the upcoming sprint with the business. Establish a clear understanding of the expectations of the team and the sprint. The product owner decides if priority and content of the user stories is still accurate. The development team decides what they believe can be completed in the sprint, using the user stories, in priority order, refined in backlog refinement. |
At/before the start of each sprint |
| Daily Stand-Up (SM & Delivery Team): Coordinate the team to communicate progress and identify any roadblocks as quickly as possible. This meeting should be kept to fifteen minutes. Longer conversations are tabled for a separate meeting. These are called "stand-ups" because attendees should stay standing for the duration, which helps keep the meeting short and focused. The questions each team member should answer at each meeting: What did I do since last stand-up? What will I do before the next stand-up? Do I have any roadblocks? |
Every day during the sprint |
| Sprint Demo (PO, SM, Delivery Team & Stakeholders): Review and demonstrate the work completed in the sprint with the business (demonstrate working and tested code which was developed during the sprint and gather stakeholder feedback). |
At the end of each sprint |
| Sprint Retrospective (SM & Delivery Team & PO): Discuss how the sprint worked to determine if anything can be changed to improve team efficiency. The intent of this meeting is not to find/place blame for things that went wrong, but instead to find ways to avoid/alleviate pain points. |
At the end of each sprint |
|
Ready |
Done |
|---|---|
|
|
* Note that your definitions of ready and done may vary from project to project, and they should be decided on collectively by the delivery team at the beginning of the project (part of setting their "norms") and updated if/when needed.
Step 1:
|
Definition of Ready |
Checklist: |
Definition of Done |
Checklist – For each user story: |
|---|---|---|---|
|
The checklist of things that must be true/done to begin the oil change. |
|
The checklist of things that must be true/done at the end of the oil change. |
|
Step 2:
Checklist – For each user story: |
|---|
|
Checklist – For each user story: |
|---|
|
Step 3:
|
Definition of Ready Checklist – For each user story: |
Disposition |
|---|---|
|
The value of story to the user is clearly indicated. |
Keep as is |
| The acceptance criteria for story have been clearly described. | Keep as is |
| User story dependencies identified. | Modify to: "Story has been traced to the project, epic, and sprint goal" |
| User story sized by delivery team. | Modify to: "User Stories have been sized by the Delivery team using Story Points" |
| Scrum team accepts user experience artifacts. | Keep as is |
| Performance criteria identified, where appropriate. | Keep as is |
| Person who will accept the user story is identified. |
Delete |
| The team knows how to demo the story. | Keep as is |
|
Add: "Any performance related criteria have been identified where appropriate" |
|
|
Add: "Any data model related changes have been identified where needed" |
Step 4:
Definition of Ready | Checklist – For each user story: |
|---|---|
User stories and related requirements contain clear descriptions of what is expected of a given functionality. Business value is identified. |
|
Record the results in the Roadmap for Transition to Agile Template
* This checklist helps Agile teams determine if the stories in their backlog are ready for sprint planning. As your team gains experience with Agile, tailor this list to your needs and follow it until the practice becomes second nature.
Step 5:
|
Definition of Done Checklist – For each user story: |
|---|
|
Definition of Done Checklist – For each user story: |
|---|
|
Step 6:
Definition of Ready Checklist – For each user story: | Disposition |
|---|---|
| Keep as is |
| Delete |
| Modify to: "All acceptance criteria for the user story have been met" |
| Modify to: "The user story is ready to be demonstrated to Stakeholders" |
| Keep as is |
| Keep as is |
| Modify to: "Unit, smoke and regression testing has been performed (preferably automated), all tests were passed" |
| Add: "Any performance related criteria associated with the story have been met" |
Step 7:
Definition of Done | Checklist – For each user story: |
|---|---|
When the user story is accepted by the product owner and is ready to be released. |
|
Record the results in the Roadmap for Transition to Agile Template
* This checklist helps Agile teams determine if the stories in their backlog are ready for sprint planning. As your team gains experience with Agile, tailor this list to your needs and follow it until the practice becomes second nature.
It turns out Waterfall is not as good at reducing risk and ensuring delivery after all.
| CHAOS RESOLUTION BY AGILE VERSUS WATERFALL | ||||
|---|---|---|---|---|
| Size | Method | Successful | Challenged | Failed |
| All Size Projects | Agile | 39% | 52% | 9% |
| Waterfall | 11% | 60% | 29% | |
Standish Group; CHAOS REPORT 2015
"I believe in this [Waterfall] concept, but the implementation described above is risky and invites failure."
– Winston W. Royce
|
Waterfall |
Agile |
|
|---|---|---|
|
Roles and Responsibilities |
Silo your resources Defined/segregated responsibilities Handoffs between siloes via documents |
Avoid siloes Collective responsibility Transitions instead of handoffs |
|
Belief System |
Trust the process Assign tasks to individuals |
Trust the delivery team Assign ownership/responsibilities to the team |
|
Planning Approach |
Create a detailed plan before work begins Follow the plan |
High level planning only The plan evolves over project lifetime |
|
Delivery Approach |
One and done (big bang delivery at end of project) |
Iterative delivery (regularly demonstrate working code) |
|
Governance Approach |
Phases and gates Artifacts and approvals |
Demo working tested code and get stakeholder feedback Support delivery team and eliminate roadblocks |
|
Approach to Stakeholders |
Involved at beginning and end of project "Arm's length" relationship with delivery team |
Involved throughout project (sprint by sprint) Closely involved with delivery team (through full time PO) |
|
Approach to Requirements/Scope |
One-time requirements gathering at start of project Scope is fixed at beginning of project ("carved in stone") |
On going requirements gathering and refinement over time Scope is roughly determined at beginning (expect change) |
|
Approach to Changing Requirements |
Treats change like it is "bad" Onerous CM process (discourages change) Scope changes "require approval" and are disruptive |
Accepts change as natural part of development. Light Change Management process (change is welcome) Scope changes are handled like all changes |
Valuable product delivered in multiple releases
If moving directly from Waterfall to Agile is too much for your organization, this can be a valuable interim step (but it won't give you the full benefits of Agile, so be careful about getting stuck here).
Record the results in the Roadmap for Transition to Agile Template
2.2.1 Review the results of your Common Agile Challenges Survey (30-60 minutes)
2.2.2 Align your support with your top five challenges
This step involves the following participants:
Outcomes of this step
Using the Agile Challenges support mapping on the following slides, build your transformation plan and supporting resources. You can build your plan by individual team results or as an enterprise approach.
| Priority | Agile Challenge | Module Name and Sequence |
|---|---|---|
| 1 |
|
|
| 2 |
|
|
| 3 |
|
|
| 4 |
|
|
| 5 |
|
|
Agile Challenges |
Supporting Resources |
|---|---|
| Difficulty establishing an effective product owner (PO) or uncertainty about the PO role |
Modules:
|
| Uncertainty about minimum viable product (MVP) and how to identify your MVP |
Modules:
|
| How non-Agile teams (like architecture, info sec, operations, etc.) work with Agile teams |
Modules:
|
| Project Governance/Gating processes that are unfriendly to Agile |
Modules:
|
| Uncertainty about the role of a PM/PMO in Agile |
Modules:
|
| Uncertainty about how to budget/plan Agile projects |
Modules:
|
| Creating an Agile friendly RFP/Contract (e.g. how to contract and work with an Agile vendor) |
Modules:
|
Note: Modules listed as (Future) are in development and may be available in draft format.
Agile Challenges | Supporting Resources |
|---|---|
| An Agile skills deficit (e.g. new-to-Agile teams who have difficulty "doing Agile right") | Modules:
|
| General resistance in the organization to process changes required by Agile | Modules:
|
| Lack of Agile training, piloting and coaching being offered by the organization | Modules:
|
| Different Agile approaches are used by different teams, making it difficult to work together | Modules:
|
| Backlog management challenges (e.g. how to manage a backlog, and make effective use of Epics, Features, User Stories, Tasks and Bugs) | Modules:
|
| Quality Assurance challenges (testing not being done well on Agile projects) | Modules:
|
| Hierarchical management practices and organization boundaries make it difficult to be Agile | Modules:
|
Note: Modules listed as (Future) are in development and may be available in draft format.
Agile Challenges | Supporting Resources |
|---|---|
| Difficulty with establishing autonomous Agile teams (self managing, cross functional teams that are empowered by the organization to deliver) | Modules:
|
| Lack of management support for Agile | Modules:
|
| Poor understanding of Agile estimation techniques and how to apply them effectively | Modules:
|
| Difficulty creating effective product roadmaps in Agile | Modules:
|
| How do we know when an Agile project is ready to go live | Modules:
|
| Sprint goals are not being consistently met, or Sprint deliverables that are full of bugs | Modules:
|
Note: Modules listed as (Future) are in development and may be available in draft format.
Note: Modules listed as (Future) are in development and may be available in draft format.
Agile Challenges | Supporting Resources |
|---|---|
| An Agile skills deficit (e.g. new-to-Agile teams who have difficulty "doing Agile right") | Blueprints: Perform an Agile Skills Assessment; Mentoring for Agile Teams |
| General resistance in the organization to process changes required by Agile | Blueprints: Master Organizational Change Management Practices |
| Lack of Agile training, piloting and coaching being offered by the organization | Blueprints: Perform an Agile Skills Assessment; Mentoring for Agile Teams |
| Different Agile approaches are used by different teams, making it difficult to work together | Blueprints: Create a Horizontally Optimized SDLC to Better Meet Business Demands, Extend Agile Practices Beyond IT |
| Backlog management challenges (e.g. how to manage a backlog, and make effective use of epics, features, user stories, tasks and bugs) | Blueprints: Deliver on Your Digital Product Vision, Managing Requirements in an Agile Environment |
| Quality Assurance challenges (testing not being done well on Agile projects) | Blueprints: Build a Software Quality Assurance Program, Automate Testing to Get More Done |
| Hierarchical management practices and organization boundaries make it difficult to be Agile | Blueprints: Master Organizational Change Management Practices |
Agile Challenges | Supporting Resources |
|---|---|
| Difficulty with establishing autonomous Agile teams (self managing, cross functional teams that are empowered by the organization to deliver) | Blueprints: Master Organizational Change Management Practices |
| Lack of management support for Agile | Blueprints: Master Organizational Change Management Practices |
| Poor understanding of Agile estimation techniques and how to apply them effectively | Blueprints: Estimate Software Delivery with Confidence, Managing Requirements in an Agile Environment |
| Difficulty creating effective product roadmaps in Agile | Blueprints: Deliver on Your Digital Product Vision |
| How do we know when an Agile project is ready to go live | Blueprints: Optimize Applications Release Management,Drive Business Value With a Right-Sized Project Gating Process, Managing Requirements in an Agile Environment |
| Sprint goals are not being consistently met, or sprint deliverables that are full of bugs | Blueprints: Build a Software Quality Assurance Program, Automate Testing to Get More Done, Managing Requirements in an Agile Environment |
2.3.1 (Optional) Identify a hypothetical project
2.3.2 (Optional) Capture your traditional delivery approach
2.3.3 (Optional) Consider what a two-phase delivery looks like
2.3.4 (Optional) Consider what a four-phase delivery looks like
2.3.5 (Optional) Consider what a four-phase delivery with monthly sprints looks like
2.3.6 (Optional) Decide on your target state and the steps required to get there
This step involves the following participants:
Outcomes of this step
Your transition to Agile and more frequent releases doesn't need to be all at once. Organizations may find it easier to build toward smaller iterations.
|
Name of your imaginary 2-year long project: |
e.g. Big Bang ERP |
|---|---|
|
Brief Project Description: |
e.g. Replace home-grown legacy ERP with a modern COTS product in a single release scheduled to be delivered in 24 months |
Record this in the Roadmap for Transition to Agile Template
For best results, complete these sub-exercises with representatives from as many functional areas as possible
(e.g. stakeholders, project management, business analysis, development, testing, operations, architecture, infosec)
|
Step |
Description |
Who is involved |
|---|---|---|
| 1 |
|
PM, Business Analysts, Stakeholders, etc. |
| 2 |
|
PM, Architects, InfoSec, ARB, Operations, etc. |
| 3 |
|
PM, Developers, etc. |
| 4 |
|
PM, Testers, etc. |
| 5 |
|
PM, Developers, Testers, Stakeholders, etc. |
| 6 |
|
PM, Developers, Testers, Operations, InfoSec, CAB, etc. |
| 7 |
|
PM, etc. |
Step | Description | Who is involved |
|---|---|---|
| 1 |
| PM, Business Analysts, Stakeholders, etc. |
| 2 |
| PM, Architects, InfoSec, ARB, Operations, etc. |
| 3 |
| PM, Developers, etc. |
| 4 |
| PM, Testers, etc. |
| 5 |
| PM, Developers, Testers, Stakeholders, etc. |
| 6 |
| PM, Developers, Testers, Operations, InfoSec, CAB, etc. |
| 7 |
| PM, etc. |
|
People |
Processes |
Technology |
|---|---|---|
|
|
|
How difficult would this be to achieve in your organization? (1-easy, 10-next to impossible)
e.g. 2
People | Processes | Technology |
|---|---|---|
| e.g. Heavy and time-consuming process steps (e.g. architecture reviews, data modelling, infosec approvals, change approval board) will need to be streamlined and made more "iteration-friendly." e.g. Gather detailed requirements only for Phase 1A, and leave the rest as high-level requirements to be more fully defined at the beginning of each subsequent phase. |
|
How difficult would this be to achieve in your organization? (1-easy, 10-next to impossible)
e.g. 5
People | Processes | Technology |
|---|---|---|
|
|
|
How difficult would this be to achieve in your organization? (1-easy, 10-next to impossible)
e.g. 8
|
Identify your current state from Exercises 2.3.1-2.3.5 |
e.g. One-and-done |
|---|---|
|
Identify your desired state from Exercises 2.3.1-2.3.5 |
e.g. 24x1 Month Sprints |
|
Now |
Next | Later | ||||||
|---|---|---|---|---|---|---|---|---|
|
What are you going to do now? |
What are you going to do very soon? |
What are you going to do in the future? |
||||||
|
Roadmap Item |
Who |
Date |
Roadmap Item |
Who |
Date |
Roadmap Item |
Who |
Date |
|
Work with Stakeholders to identify a product owner for the project. |
AC |
Jan 1 |
Break down full deliverable into 4 phases with high level requirements for each phase |
DL |
Feb 15 |
Work with operations to set up Dev, Test, Pre-Prod, and Prod environments for first phase (make use of automation/scripting) |
DL |
Apr 15 |
|
Work with PO and stakeholders to help them understand Agile approach |
Jan 15 |
Work with PO to create a project backlog for the first phase deliverable |
JK |
Feb 28 |
Work with QA group to select and implement test automation for the project (start with smoke and regression tests) |
AC |
Apr 30 |
|
|
Work with project gating body, architecture, infosec and operations to agree on incremental deliveries for the project and streamlined activities to get there |
AC |
Mar 15 |
||||||
Record the results in the Roadmap for Transition to Agile Template
2.4.1 Identify key insights and takeaways
2.4.2 Perform an exit survey
This step involves the following participants:
Outcomes of this step
| What key insights have you gained? | What takeaways have you identified? |
|---|---|
|
|
|
Download Survey Template: |
|---|
|
Backlog Management |
Scrum Simulation |
Estimation |
Product Owner |
Product Roadmapping |
|---|---|---|---|---|
|
1: User stories and the art of decomposition 2: Effective backlog management & refinement 3: Identify insights and team feedback |
1: Scrum sprint planning and retrospective simulation 2: Pass the balls – sprint velocity game |
1: Improve product backlog item estimation 2: Agile estimation fundamentals 3: Understand the wisdom of crowds 4: Identify insights and team feedback |
1: Understand product management fundamentals 2: The critical role of the product owner 3: Manage effective product backlogs and roadmaps 4: Identify insights and team feedback |
1: Identify your product roadmapping pains 2: The six "tools" of product roadmapping 3: Product roadmapping exercise |
Organizations often struggle with numerous pain points around Agile delivery.
The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.
Agile modules provide supporting activities:
Each module provides guidance and supporting activities related to a specific Agile challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
This phase involves the following participants:
Backlog 1.1 Identify your backlog and user story decomposition pains
Backlog 1.2 What are user stories and why do we use them?
Backlog 1.3 User story decomposition: password reset
Backlog 1.4 (Optional) Decompose a real epic
This step involves the following participants:
Outcomes of this step
|
What are your specific backlog management and user story decomposition challenges? |
|---|
|
User stories are core to Agile delivery.
Good user story decomposition practices are key to doing Agile effectively.
|
Why do we capture requirements as user stories (what value do they provide)? |
|---|
|
How do they differ from traditional (should/shall) requirements (and are they better)? |
|---|
|
What else stands out to you about user stories? |
|---|
Example:
As a banking customer, I want to see the current balance of my accounts so that I can know how much money I have in each account.
User stories enable collaboration and conversations to fully determine actual business requirements over time.
e.g. As a banking customer, I want to see the current balance of my accounts so that I can know how much money I have in each account.
Requirements, determined within the iterations, outline the steps to complete the story: how the user will access their account, the types of funds allowed, etc.
User stories allow the product owners to prioritize and manage the product needs (think of them as "virtual sticky notes").
The process of taking large PBIs (e.g. epics and features) and breaking them down in to small PBIs (e.g. user stories and tasks) is called user story decomposition and is often challenging for new-to-Agile teams
| User Story 1: | User Story 2: | User Story 3: |
|---|---|---|
|
|
|
A single epic can be broken down into multiple user stories
| User Story 1: | User Story 2: | User Story 3: | User Story 4: |
|---|---|---|---|
|
|
|
|
|
Acceptance Criteria: |
Acceptance Criteria: |
Acceptance Criteria: |
Acceptance Criteria: |
Your audience will dictate the level of detail and granularity you should include in your enabler, but it is a good rule of thumb to stick to the feature level.
| Enablers | Description |
|---|---|
Enabler Epics | Non-functional and other technical requirements that support your features (e.g. data and system requirements) |
Enabler Capabilities of Features | |
Enabler Stories |
|
Exploration |
Architectural |
|---|---|
|
Any efforts toward learning customer or user needs and creation of solutions and alternatives. Exploration enablers are heavily linked to learning milestones. |
Any efforts toward building components of your architecture. These will often be linked to delivery teams other than your pure development team. |
| Infrastructure |
Compliance |
|
Any efforts toward building various development and testing environments. Again, these are artifacts that will relate to other delivery teams. |
Any efforts toward regulatory and compliance requirements in your development activities. These can be both internal and external. |
Source: Scaled Agile, "Enablers."
The following questions can be helpful in dissecting an epic down to the user story level. The same line of thinking can also be useful for bundling multiple small PBIs together.
As a ____ I want _____ so that ______
| User Story 1: | User Story 2: | User Story 3: |
|---|---|---|
|
|
|
Backlog 2.1 Identify enablers and blockers
This step involves the following participants:
Outcomes of this step
Use a tiered approach to managing your backlog, and always work on the highest priority items first.
A better way to view them is "pre-planning" and "planning."
A well-formed backlog can be thought of as a DEEP backlog:
(Perforce, 2018)
Each activity is a variation of measuring value and estimating effort to validate and prioritize a PBI.
A PBI meets our definition of done and passes through to the next backlog tier when it meets the appropriate criteria. Quality filters should exist between each tier.
Expand the concepts of defining "ready" and "done" to include the other stages of a PBIs journey through product planning.
Info-Tech Insight: A quality filter ensures quality is met and teams are armed with the right information to work more efficiently and improve throughput.
| Notes and Instructions |
|---|
|
The primary intent of this exercise is to explain the complex notion of MVP (it is one of the most misunderstood and contentious issues in Agile delivery). The exercise is intended to explain it in a simple and digestible way that will fundamentally change participants' understanding of MVP. Note that the slide contains animations. |
| Imagine that your stakeholder tells you they want a blue 4-door sedan (consider this our "MVP" at this point), and you decide to build it the traditional way. As you build it (tires, then frame, then body, then joint body with frame and install engine), the stakeholder doesn't have anything they can use, and so they are only happy (and able to get value) at the end when the entire car is finished (point out the stakeholder "faces" go from unhappy to happy in the end). |
| Animation 1: When we use Agile methods, we don't want to wait until the end before we have something the stakeholders can use. So instead of waiting until the entire car is completed, we decide our first iteration will be to give the stakeholder "a simple (blue) wheeled transportation device"…namely a skateboard that they can use for a little while (it's not a car, but it is something the stakeholder can use to get places). |
| Animation 2: After the stakeholder has tried out the skateboard, we ask for feedback. They tell us the skateboard helped them to get around faster than walking, but they don't like the fact that it is so hard to maintain your balance on it. So, we add a handle to the skateboard to turn it into a scooter. The stakeholder then uses the scooter for a while. Stakeholder feedback says staying balanced on the scooter is much easier, but they don't have a place to put groceries when they go shopping, so can we do something about that? |
| (Continued on next slide…) |
| Notes and Instructions |
|---|
| Animation 3: Next, we build the stakeholder a bicycle and let them use it for a while before asking for feedback. The stakeholder tells us they love the bicycle, but they admit they get tired on long trips, so is there something we can do about that? |
| Animation 4: So next we add a motor to the bicycle to turn it into a motorcycle, and again we give it to the stakeholder to use for a while. When we ask the stakeholder for feedback, they tell us that they love the motorcycle so much because they love the feeling of the wind in their hair, they've decided that they no longer want a 4-door sedan, but instead would prefer a blue 2-door convertible. |
| Animation 5: And so, for our last iteration, we build the stakeholder what they actually wanted (a blue 2-door convertible) instead of what they asked for (a blue 4-door sedan), and we see that they are happier than they would have been if we had delivered the traditional way. |
|
INSIGHTS:
|
|
NOT Like This: |
|
|---|---|
|
It's Like This: |
A great and wise pharaoh hires two architects to build his memorial pyramids.
Several years go by, and then…
Backlog 3.1 Identify key insights and takeaways
Backlog 3.2 Perform exit survey and capture results
This step involves the following participants:
Outcomes of this step
What key insights have you gained? | What takeaways have you identified? |
|---|---|
|
|
Download Survey Template: |
|---|
Backlog Management | Scrum Simulation | Estimation | Product Owner | Product Roadmapping |
|---|---|---|---|---|
1: User stories and the art of decomposition 2: Effective backlog management & refinement 3: Identify insights and team feedback | 1: Scrum sprint planning and retrospective simulation 2: Pass the balls – sprint velocity game | 1: Improve product backlog item estimation 2: Agile estimation fundamentals 3: Understand the wisdom of crowds 4: Identify insights and team feedback | 1: Understand product management fundamentals 2: The critical role of the product owner 3: Manage effective product backlogs and roadmaps 4: Identify insights and team feedback | 1: Identify your product roadmapping pains 2: The six "tools" of product roadmapping 3: Product roadmapping exercise |
Organizations often struggle with numerous pain points around Agile delivery.
The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.
Agile modules provide supporting activities:
Each module provides guidance and supporting activities related to a specific Agile challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
This phase involves the following participants:
Scrum sprint planning and retrospective simulation
1.1 Identify your scrum pains
1.2 Review scrum simulation intro
1.3 Create a mock backlog
1.4 Review sprint 0
1.5 Determine a budget and timeline
1.6 Understand minimum viable product
1.7 Plan your first sprint
1.8 Do a sprint retrospective
1.9 "What if" exercise (understanding what a fluid backlog really means)
1.10 A sprint 1 example
1.11 Simulate more sprints
This step involves the following participants:
Outcomes of this step
Talk to the nature of the Scrum team:
Speak about the "bank realizes that the precise scope of the first release can only be fully known at the end of the project" statement and what it means.
Discuss exercise and everyone's roles (make sure everyone clear), make it as realistic as possible. Your level of participation will determine how much value you get.
Discuss any questions the participants might have about the background section on the introduction tab. The exercise has been defined in a way that minimizes the scope and complexity of the work to be done by assuming there are existing web-capable services exposed to the bank's legacy system(s) and that the project is mostly about putting a deployable web front end in place.
Speak about "definition of done": Why was it defined this way? What are the boundaries? What happens if we define it to be only up to unit testing?
This exercise is intended to help participants understand the steps involved in creating an initial backlog and deciding on their MVP.
Note: The output from this exercise will not be used in the remainder of the simulation (a backlog for the simulation already exists on tab Sprint 0) so don't overdo it on this exercise. Do enough to help the participants understand the basic steps involved (brainstorm features and functions for the app, group them into epics, and decide which will be in- and out-of-scope for MVP). Examples have been provided for all steps of this exercise and are shown in grey to indicate they should be replaced by the participants.
Step 1: Have all participants brainstorm "features and functions" that they think should be available in the online banking app (stop once you have what feels like a "good enough" list to move on to the next step) – these do not need to be captured as user stories just yet.
Step 2: Review the list of features and functions with participants and decide on several epics to capture groups of related features and functions (bill payments, etc.). Think of these as forming the high-level structure of your requirements. Now, organize all the features and functions from Step 1, into their appropriate epic (you can identify as many epics as you like, but try to keep them to a minimum).
Step 3: Point out that on the Introduction tab, you were told the bank wants the first release to go live as soon as possible. So have participants go over the list of features and functions and identify those that they feel are most important (and should therefore go into the first release – that is, the MVP), and which they would leave for future releases. Help participants think critically and in a structured way about how to make these very hard decisions. Point out that the product owner is the ultimate decision maker here, but that the entire team should have input into the decision. Point out that all the features and functions that make up the MVP will be referred to as the "project backlog," and all the rest will be known as the "product backlog" (these are of course, just logical separations, there is only one physical backlog).
Step 4: This step is optional and involves asking the participants to create user stories (e.g. "As a __, I want ___ so that ___") for all the epics and features and functions that make up their chosen MVP. This step is to get them used to creating user stories, because they will need to get used to doing this. Note that many who are new to Agile often have difficulty writing user stories and end up overdoing it (e.g. providing a long-winded list of things in the "I want ___" part of the user story for an epic) or struggling to come up with something for the "so that ____" part). Help them to get good at quickly capturing the gist of what should be in the user story (the details come later).
Total Number of Sprints = 305/20 = 15.25 → ROUND UP TO 16 (Why? You can't do a "partial sprint" – plus, give yourself a little breathing room.)
Cost Per Sprint = 6 x $75 x 8 x 10 = $36,000
Total Timeline = 16 * 2 = 32 Weeks
Total Cost of First Release = $36,000 x 16 = $572,000
Talk about the "commitment" a Scrum delivery team makes to the organization ("We can't tell you exactly what we will deliver, but based on what we know, if you give the team 32 weeks, we will deliver something like what is in the project backlog – subject to any changes our stakeholder tell us are needed"). Most importantly, the team commits to doing the most important backlog items first, so if we run out of time, the unfinished work will be the least valuable user stories. Lastly, to keep to the schedule/timeline, items may move in and out of the project backlog – this is part of the normal and important "horse trading" that takes place on health Agile projects.
Speak to the fact that this approach allows you to provide a "deterministic" answer about how long a project will take and how much it will cost while keeping the project requirements flexible.
This is an unprioritized list, organized to make sense, and includes a user story (plus some stuff), and "good enough estimates" – How good?... Eh! (shoulder shrug)
Point out the limited ("lazy") investment → Agile principle: simplicity, the art of maximizing the work not done.
Point out that only way to really understand a requirement is to see a working example (requirements often change once the stakeholders see a working example – the "that's not what I meant" factor).
Estimates are a balancing act (good enough that we understand the overall approximate size of this, and still acknowledges that more details will have to wait until we decide to put that requirement into a Sprint – remember, no one knows how long this project is going to take (or even what the final deliverable will look like) so don't over invest in estimates here.)
Sprint velocity calculation is just a best guess → be prepared to find that your initial guess was off (but you will know this early rather than at the end of the project). This should lead to a healthy discussion about why the discrepancy is happening (sprint retrospectives can help here). Note: Sprint velocity doesn't assume working evenings and weekends!
Speak to the importance of Sprint velocity being based on a "sustainable pace" by the delivery team. Calculations that implicitly expect sustained overtime in order to meet the delivery date must be avoided. Part of the power of Agile comes from this critical insight. Critical → Your project's execution will need to be adjusted to accommodate the actual sprint velocity of the team!
Point out the "project backlog" and separation from the "product backlog" (and no sprint backlog yet!).
Point out the function/benefits of the backlog:
Talk about large items in backlog (>20 pts) and how to deal with them (do we need to break them up now?).
Give participants time to review the backlog: Questions/What would you be doing if this were real/We're going to collectively work through this backlog.
Sprint 0 is your opportunity to: get organized as a team, do high level design, strategize on approach, think about test data, environments, etc. – it is the "Ready-Set" in "Ready-Set-Go."
Think about doing a High/Med/Low value determination for each user story.
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
Step 1: Brainstorm "Features and Functions" that the group feels would be needed for this app
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
Step 2: Identify your epics
|
Epics |
"Features and Functions" in This Epic |
|---|---|
|
Administration |
- Logon and logoff - Register for app - Reset password |
|
Accounts |
- See account balances - See a history of account transactions - Search for a transaction by payee/date/amount |
|
Bill payments |
- Set up payees for online bill payments - Pay a bill online - Schedule a bill payment for the future |
|
Deposits |
- Make a deposit online
|
|
E-transfers |
- Make an e-transfer
|
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
Step 3: Identify your MVP
Epics | "Features and Functions" in This Epic |
|---|---|
Administration | - Logon and logoff - Register for app |
Accounts | - See account balances - See a history of account transactions |
Bill payments | - Set up payees for online bill payments - Pay a bill online |
Epics | In Scope |
|---|---|
| Deposits | - Make a deposit online |
| Accounts | - Search for a transaction by payee/date/amount/etc. |
| Bill payments | - Schedule a bill payment for the future |
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
Step 3: Identify your MVP
Epics | "Features and Functions" in This Epic |
|---|---|
Administration | - Logon and logoff |
Accounts | - See account balances |
Bill payments | - Set up payees for online bill payments |
Epics | In Scope |
|---|---|
| Logon and Logoff | As a user, I want to logon/logoff the app so I can do my banking securely |
| Register for App | As a user, I want to register to use the app so I can bank online |
| See Account Balances | As a user, I want to see my account balances so that I know my current financial status |
| See a History of Account Transactions | As a user, I want to see a history of my account transactions, so I am aware of where my money goes |
| Set up Payees for Online Bill Payments | As a user, I want to set up payees so that I can easily pay my bills |
| Pay a Bill Online | As a user, I want to pay bills online, so they get paid on time |
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
Step 1: Set aside the Mock Backlog just created (you will be using the Backlog on Sprint 0 for remainder of exercise).
Step 2: Introduce and walk through the Backlog on the Sprint 0 tab in the Scrum Simulation Exercise.
Step 3: Discuss and answer any questions the participants may have about the Sprint 0 tab.
Step 4: Capture any important issues or clarifications from this discussion in the table below.
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
|
GIVEN |
Total Story Points in Project Backlog (First Release): | 307 Story Points |
|---|---|---|
| Expected Sprint Velocity: | 20 Story Points/Sprint | |
| Total Team Size (PO, SM and 4-person Delivery Team): | 6 People | |
| Blended Hourly Rate Per Team Member (assume 8hr day): | $75/Hour | |
| Sprint Duration: | 2 Weeks |
|
DETERMINE |
Expected Number of Sprints to Complete Project Backlog: | |
|---|---|---|
| Cost Per Sprint ($): | ||
| Total Expected Timeline (weeks): | ||
| Total Cost of First Release: |
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
Note: Refer to the facilitator slides for more guidance on how to deliver this exercise
The primary intent of this exercise is to explain the complex notion of MVP (it is one of the most misunderstood and contentious issues in Agile delivery). The exercise is intended to explain it in a simple and digestible way that will fundamentally change participants' understanding of MVP.
Note that the slide contains animations.
Imagine that your stakeholder tells you they want a blue 4-door sedan (consider this our "MVP" at this point), and you decide to build it the traditional way. As you build it (tires, then frame, then body, then joint body with frame and install engine), the stakeholder doesn't have anything they can use, and so they are only happy (and able to get value) at the end when the entire car is finished (point out the stakeholder "faces" go from unhappy to happy in the end).
Animation 1:
When we use Agile methods, we don't want to wait until the end before we have something the stakeholders can use. So instead of waiting until the entire car is completed, we decide our first iteration will be to give the stakeholder "a simple (blue) wheeled transportation device"…namely a skateboard that they can use for a little while (it's not a car, but it is something the stakeholder can use to get places).
Animation 2:
After the stakeholder has tried out the skateboard, we ask for feedback. They tell us the skateboard helped them to get around faster than walking, but they don't like the fact that it is so hard to maintain your balance on it. So, we add a handle to the skateboard to turn it into a scooter. The stakeholder then uses the scooter for a while. stakeholder feedback says staying balanced on the scooter is much easier, but they don't have a place to put groceries when they go shopping, so can we do something about that?
(Continued on next slide…)
Animation 3:
So next we build the stakeholder a bicycle and let them use it for a while before asking for feedback. The stakeholder tells us they love the bicycle, but they admit they get tired on long trips, so is there something we can do about that?
Animation 4:
So next we add a motor to the bicycle to turn it into a motorcycle, and again we give it to the stakeholder to use for a while. When we ask the stakeholder for feedback, they tell us that they LOVE the motorcycle so much, and that because they love the feeling of the wind in their hair, they've decided that they no longer want a 4-door sedan, but instead would prefer a blue 2-door convertible.
Animation 5:
And so, for our last iteration, we build the stakeholder what they wanted (a blue 2-door convertible) instead of what they asked for (a blue 4-door sedan), and we see that they are happier than they would have been if we had delivered the traditional way.
INSIGHTS:
An MVP cannot be fully known at the beginning of a project (it is the "journey" of creating the MVP with stakeholders that defines what it looks like in the end).
Sometimes, stakeholders don't (or can't) know what they want until they see it.
There is no "straight path" to your MVP, you determine the path forward based on what you learned in the previous iterations.
This approach is part of the "power of Agile" and demonstrates why Agile can produce better outcomes and happier stakeholders.
|
NOT Like This: |
|
|---|---|
|
It's Like This: |
A great and wise pharaoh hires two architects to build his memorial pyramids.
Several years go by, and then…
Step 1: Divide participants into independent Scrum delivery teams (max 7-8 people per team) and assign a PO (5 minutes)
Step 2: Instruct each team to work together to decide on their "MVP strategy" for delivering this project (10-15 minutes)
Step 3: Have each team decide on which user stories they would put in their first sprint backlog (5-10 minutes)
Step 4: Have each team report on their findings. (10 minutes)
|
Describe your team's "MVP strategy" for this project (Explain why you chose this strategy): |
Identify your first sprint backlog (Explain how this aligns with your MVP strategy): |
|---|---|
|
What, if anything, did you find interesting, insightful or valuable by having completed this exercise: |
|---|
Step 1: Thinking about the work you did in Exercise 3.2.7, identify what worked well and what didn't
Step 2: Create a list of "Start/Stop/Continue" items using the table below
Step 3: Present your list and discuss with other teams
|
Start: |
Stop: |
Continue: |
|---|---|---|
|
Scenario: |
How would you deal with this: |
|---|---|
|
After playing with and testing the Sprint 1 deliverable, your stakeholders find several small bugs that need to be fixed, along with some minor changes they would like made to the system. The total amount of effort to address all of these is estimated to be 4 story points in total. |
(e.g. First and foremost, put these requests into the Project Backlog, then…) |
|
Despite your best efforts, your stakeholders tell you that your Sprint 1 deliverable missed the mark by a wide margin, and they have major changes they want to see made to it. |
|
|
Several stakeholders have come forward and stated that they feel strongly that the "DEPOSIT – Deposit a cheque by taking a photo" User Story should be part of the first release, and they would like to see it moved from the Product Backlog to the project backlog (Important Note: they don't want this to change the delivery date for the first release) |
|
|
|
|
Discussion |
|---|
|
Discussion and learnings |
|---|
2.1 Execute the ball passing sprints
This step involves the following participants:
Outcomes of this step
Goal 1. Pass as many balls as possible (Story Points) through the system during each sprint.
Goal 2. Improve your estimation and velocity after each retrospective.
Points Completed
Rules:
Scoring:
Epic 1: 3 sprints
Group Retrospective
Epic 2: 3 sprints (repeat)
Goal 1: Pass as many balls (Story Points) through the system during each sprint.
Goal 2: Improve your estimation and velocity after each retrospective.
Rules:
Scoring:
Goal:
Pass as many balls as possible through the system during each cycle.
Game Setup
Use your phone's timer to create 2-minute cycles:
Facilitator Tips
Alternate Versions
Trends to Look For and Discuss
Trends to Look For and Discuss
3.1 Identify key insights and takeaways
3.2 Perform exit survey and capture results
This step involves the following participants:
Outcomes of this step
What key insights have you gained? | What takeaways have you identified? |
|---|---|
|
|
Download Survey Template: |
|---|
Backlog Management | Scrum Simulation | Estimation | Product Owner | Product Roadmapping |
|---|---|---|---|---|
1: User stories and the art of decomposition 2: Effective backlog management & refinement 3: Identify insights and team feedback | 1: Scrum sprint planning and retrospective simulation 2: Pass the balls – sprint velocity game | 1: Improve product backlog item estimation 2: Agile estimation fundamentals 3: Understand the wisdom of crowds 4: Identify insights and team feedback | 1: Understand product management fundamentals 2: The critical role of the product owner 3: Manage effective product backlogs and roadmaps 4: Identify insights and team feedback | 1: Identify your product roadmapping pains 2: The six "tools" of product roadmapping 3: Product roadmapping exercise |
Organizations often struggle with numerous pain points around Agile delivery.
The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.
Agile modules provide supporting activities:
Each module provides guidance and supporting activities related to a specific Agile Challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
This phase involves the following participants:
1.1 Identify your estimation pains
1.2 (Optional) Why do we estimate?
1.3 How do you estimate now?
This step involves the following participants:
Outcomes of this step
Know the truth about estimates and their potential pitfalls.
Then, understand how Agile estimation works to avoid these pitfalls.
|
What are your specific Estimation challenges? |
|---|
|
|
Why would/should you do estimates? |
|---|
|
Source: DZone, 2013.
Why would/should you do estimates? |
|---|
|
2.1 (Optional) Estimate a real PBI
This step involves the following participants:
Outcomes of this step
The average rough order of magnitude estimates for software are off by is up to 400%.
Source: Boehm, 1981
|
66% |
Average cost overrun(1) |
|---|---|
|
33% |
Average schedule overrun (1) |
|
17% |
Average benefits shortfall)1) |
(1) % of software projects with given issue
Source: McKinsey & Company, 2012
All estimates are wrong, but some can be useful (leverage the "wisdom of crowds" to improve your estimation practices).
| Consensus-Building Techniques | ||
|---|---|---|
| Planning Poker |
Most popular by far (stick with one of these unless there is a good reason to consider others) |
This approach uses the Delphi method, where a group collectively estimates the size of a PBI, or user stories, with cards numbered by story points. See our Estimate Software Delivery With Confidence blueprint. |
| T-Shirt Sizing |
This approach involves collaboratively estimating PBIs against a non-numerical system (e.g. small, medium, large). See DZone and C# Corner for more information. |
|
| Dot Voting |
This approach involves giving participants a set number of dot stickers or marks and voting on the PBIs (and options) to deliver. See Dotmocracy and Wikipedia for more information. |
|
| Bucket System |
This approach categorizes PBIs by placing them into defined buckets, which can then be further broken down through dividing and conquering. See Agile Advice and Crisp's Blog for more information. |
|
| Affinity Mapping |
This approach involves the individual sizing and sorting of PBIs, and then the order of these PBIs are collaboratively edited. The grouping is then associated with numerical estimates or buckets if desired. See Getting Agile for more information. |
|
| Ordering Method |
This approach involves randomly ordering items on a scale ranging from low to high. Each member will take turns moving an item one spot lower or higher where it seems appropriate. See Apiumhub, Sheidaei Blog (variant), and SitePoint (Relative Mass Valuation) for more information. |
|
Ready | Done |
|---|---|
|
|
How do you assign a point value to a user story? There is no easy answer outside of leveraging the experience of the team. Sizes are based on relative comparisons to other PBIs or previously developed items. Example: "This user story is 3 points because it is expected to take 3 times more effort than that 1-point user story."Therefore, the measurement of a story point is only defined through the team's experience, as the team matures.
Can you equate a point to a unit of time? First and foremost, for the purposes of backlog prioritization, you don't need to know the time, just its size relative to other PBIs. For sprint planning, release planning, or any scenario where timing is a factor, you will need to have a reasonably accurate sprint capacity determined. Again, this comes down to experience.
Planning poker: This approach uses the Delphi method, where a group collectively estimates the size of a PBI or user story, using cards with story points on them.
Materials: Each participant has deck of cards, containing the numbers of the Fibonacci sequence.
Typical Participants: Product owner, scrum master (usually acts as facilitator), delivery team.
Steps:
Step 1: As a group, select a real epic, feature, or user story from one of your project backlogs which needs to be estimated:
|
PBI to be Estimated: |
As a ____ I want _____ so that ______ |
|---|
Step 2: Select one person in your group to act as the product owner and discuss/question the details of the selected PBI to improve your collective understanding of the requirement (the PO will do their best to explain the PBI and answer any questions).
Step 3: Make your first round of estimates using either T-shirt sizing or the Fibonacci sequence. Be sure to agree on the boundaries for these estimates (e.g. "extra-small" (XS) is any work that can be completed in less than an hour, while "extra-large" (XL) is anything that would take a single person a full sprint to deliver – a similar approach could be used for Fibonacci where a "1" is less than an hour's work, and "21" might be a single person for a full sprint). Don't share your answer until everyone has had a chance to decide on their Estimate value for the PBI.
Step 4: Have everyone share their chosen estimate value and briefly explain their reasoning for the estimate. If most estimate values are the same/similar, allow the group to decide whether they have reached a "collective agreement" on the estimate. If not, repeat step 3 now that everyone has had a chance to explain their initial Estimate.
Step 5: Capture the "collective" estimate for the PBI here:
|
Our collective estimate for this PBI: |
e.g. 8 story points |
|---|
3.1 Guess the number of jelly beans (Round 1) (15 minutes)
3.2 Compare the average of your guesses (15 minutes)
3.3 Guess the number of gumballs (Round 2) (15 minutes)
3.4 Compare your guesses against the actual number
This step involves the following participants:
Outcomes of this step
The exercise is intended to mimic the way Planning Poker is performed in Agile Estimation. Use the exercise to demonstrate the power of the Wisdom of Crowds and how, in circumstances where the exact answer to a question is not known, asking several people for their opinion often produces more accurate results than most/any individual opinion.
Some participants will tend to "shout out an answer" right away, so be sure to tell participants not to share their answers until everyone has had an opportunity to register their guess (this is particularly important in Round 1, where we are trying to get unvarnished guesses from the participants).
In Round 1:
In Round 2:
Download Survey Template: |
|---|
See slide notes for instructions.
See slide notes for instructions.
Download Survey Template: |
|---|
See slide notes for instructions.
4.1 Identify key insights and takeaways
4.2 Perform exit survey and capture results
This step involves the following participants:
Outcomes of this step
What key insights have you gained? | What takeaways have you identified? |
|---|---|
|
|
Download Survey Template: |
|---|
Backlog Management | Scrum Simulation | Estimation | Product Owner | Product Roadmapping |
|---|---|---|---|---|
1: User stories and the art of decomposition 2: Effective backlog management & refinement 3: Identify insights and team feedback | 1: Scrum sprint planning and retrospective simulation 2: Pass the balls – sprint velocity game | 1: Improve product backlog item estimation 2: Agile estimation fundamentals 3: Understand the wisdom of crowds 4: Identify insights and team feedback | 1: Understand product management fundamentals 2: The critical role of the product owner 3: Manage effective product backlogs and roadmaps 4: Identify insights and team feedback | 1: Identify your product roadmapping pains 2: The six "tools" of product roadmapping 3: Product roadmapping exercise |
Organizations often struggle with numerous pain points around Agile delivery.
The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.
Agile modules provide supporting activities:
Each module provides guidance and supporting activities related to a specific Agile Challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
This phase involves the following participants:
1.1 Identify your product owner pains
1.2 What is a "product"? Who are your "consumers"?
1.3 Define your role terminology
This step involves the following participants:
A proper definition of a product recognizes three key facts.
|
What are your specific Product Owner challenges? |
|---|
|
30-60 minutes
The term "product" is used for consistency but would apply to services as well.
"Product" and "Service" are terms that each organization needs to define to fit its culture and customers (internal and external). The most important aspect is consistent use and understanding of:
"A product owner in its most beneficial form acts like an Entrepreneur, like a 'mini-CEO'. The product owner is someone who really 'owns' the product."
– – Robbin Schuurman,
"Tips for Starting Technical Product Managers"
Product owners must translate needs and constraints from their perspective into the language of their audience. Kathy Borneman, Digital Product Owner at SunTrust Bank, noted the challenges of finding a common language between lines of business and IT (e.g. what is a unit?).
Unfortunately, most product owners operate with an incomplete knowledge of the skills and capabilities needed to perform the role. Common gaps include focusing only on product backlogs, acting as a proxy for product decisions, and ignoring the need for key performance indicators (KPIs) and analytics in both planning and value realization.
Start by piloting product families to determine which approaches work best for your organization.
Create a common definition of what a product is and identify products in your inventory.
Use scaling patterns to build operationally aligned product families.
Develop a roadmap strategy to align families and products to enterprise goals and priorities.
Use products and families to evaluate the delivery and organizational design improvements.
Product Portfolio
Groups of product families within an overall value stream or capability grouping.
Product Portfolio Manager
Product Family
A collection of related products. Products can be grouped along architectural, functional, operational, or experiential patterns.
Product Family Manager
Product
Single product composed of one or more applications and services.
Product Owner
Info-Tech Insight
The primary role conflict occurs when the product owner is a proxy for stakeholders or responsible for the delivery team. The product owner owns the product backlog. The delivery team owns the sprint backlog and delivery.
Product management terminology is inconsistent, creating confusion in organizations introducing these roles. Understand the roles, then define terms that work best for you.
Key milestones must be proactively managed. If a project manager is not available, those responsibilities need to be managed by the Product Owner or Scrum Master. Start with responsibility mapping to decide which role will be responsible.
| Term |
Definition |
|---|---|
|
Product Owner |
|
|
Product Manager |
|
2.1 Identify enablers and blockers
2.2 (Optional) Dissect this definition of the product owner role
The critical importance of establishing an effective product owner role (PO) for your Agile projects cannot be overstated.
Many new-to-Agile organizations do not fully appreciate the critical role played by the PO in Scrum, nor the fundamental changes the organization will need to make in support of the PO role. Both mistakes will reduce an organization's chances of successfully adopting Agile and achieving its promised benefits.
The PO role is critical to the proper prioritization of requirements and efficient decision-making during the project.
The PO role helps the organization to avoid "analysis paralysis" challenges often experienced in large command-and-control-style organizations.
A poorly chosen or disengaged product owner will almost certainly stifle your Agile project.
Note that for many organizations, "product owner" is not a formally recognized role, which can create HR issues. Some organizational education on Agile may be needed (especially if your organization is unionized).
Failing to establish effective product owners in your organization can be a "species-killing event" for your Agile transformation.
Available: Assign a PO that can focus full-time on the project. Make sure your PO can dedicate the time needed to fulfill this critical role.
Appropriate: It's best for the PO to have strong subject matter expertise (so-called "super users" are often selected to be POs) as well as strong communication, collaboration, facilitation, and arbitration skills. A good PO will understand how to negotiate the best outcomes for the project, considering all project constraints.
Authoritative: The PO must be empowered by your organization to speak authoritatively about priorities and goals and be able to answer questions from the project team quickly and efficiently. The PO must know when decisions can be made immediately and when they must be made in collaboration with other stakeholders – choosing a PO that is well-known and respected by stakeholders will help to make this more efficient.
It's critical to assign a PO that meets the three A's:
An effective product owner listens to (and effectively balances) the needs and constraints of three different groups:
Organizational needs/constraints represent what is most important to the organization overall, and typically revolve around things like cost, schedule, return on investment, time to market, risk mitigation, conforming to policies and regulations, etc.
Stakeholder needs/constraints represent what is most important to those who will be using the system and typically revolve around the delivery of value, ease of use, better outcomes, making their jobs easier and more efficient, getting what they ask for, etc.
Delivery Team needs/constraints represent what is most important to those who are tasked with delivering the project and cover a broad range that includes tools, skills, capabilities, technology limitations, capacity limits, adequate testing, architectural considerations, sustainable workload, clear direction and requirements, opportunities to innovate, getting sufficient input and feedback, support for clearing roadblocks, dependencies on other teams, etc.
An effective PO will expertly balance the needs of:
* For more, see Understanding Scrum: Why do Product Owners Have Three Ears
Although the PO plays a unique and central role in the success of an Agile project, it doesn't mean they "act alone."
The PO is ultimately responsible for managing and maintaining an effective backlog over the project lifecycle, but many people contribute to maintaining this backlog (on large projects, BA's are often the primary contributors to the backlog).
The PO role also relies heavily on stakeholders (to help define and elaborate user stories, provide input and feedback, answer questions, participate in sprint demos, participate in testing of sprint deliverables, etc.).
The PO role also relies heavily on the delivery team. Some backlog management and story elaboration is done by delivery team members instead of the PO (think: elaborating user story details, creating acceptance criteria, writing test plans for user stories, etc.).
The PO both contributes to these efforts and leads/oversees the efforts of others. The exact mix of "doing" and "leading" can be different on a case-by-case basis and is part of establishing the delivery team's norms.
Given the importance of the role, care must be taken to not overburden the product owner, especially on large projects.
While being ultimately responsible for the product backlog, a PO often relies on others to aid in backlog management and maintenance.
This is particularly true on large projects.
It is always best to assign a product owner "from the business," who will bring subject matter expertise and have established relationships with stakeholders.
When a PO from the business does not have enough time to fulfill the needs of the role completely (e.g. can only be a part-time PO, because they have a day job), assigning a proxy product owner can help to compensate for this.
The proxy PO acts on behalf of the PO in order to reduce the PO's workload or to otherwise support them.
Project participants (e.g. delivery team, stakeholders) should treat the PO and proxy PO as roughly equivalent.
Project managers (PMs) and business analysts (BAs) are often good candidates for the proxy PO role.
NOTE: It's highly advisable for the PO to attend all/most sprint demos in order to observe progress for themselves, and to identify any misalignment with expectations as early as possible (remember that the PO still has ultimate responsibility for the project outcomes).
Although not ideal, assigning a proxy PO can help to compensate for a PO who doesn't meet all three A's of Product Ownership.
It is up to the PO and proxy to decide how they will work together (e.g. establish their norms).
The PO and proxy must:
Sometimes, having multiple product owners makes sense.
It is always best to assign a single product owner to a project. However, under certain circumstances, it can make sense to use multiple POs.
For example, when implementing a large ERP system with many distinct modules (e.g. Finance, HR) it can be difficult to find a single PO who has sufficient subject matter expertise across all modules.
When assigning Multiple POs to a project, be sure to identify a "Lead PO" (who is given ultimate responsibility for the entire project) and have the remaining POs act like Proxy POs.
NOTE: Not surprisingly, it's highly advisable for the Lead PO to attend as many Sprint Demos as possible to observe progress for themselves, and to identify any misalignment with expectations as early as possible (remember that the Lead PO has ultimate responsibility for the project outcomes).
Although not ideal, assigning multiple POs to a project sometimes makes sense.
When needed, be sure to identify a "Lead PO" and have the other PO's act like Proxies.
| Enablers | Blockers | Mitigation |
|---|---|---|
| High business engagement and buy-in | Significant time is required to implement and train resources | Limit the scope for pilot project to allow time to learn |
| Organizational acceptance for change | Geographically distributed resources | Temporarily collocate all resources and acquire virtual communication technology |
| Existing tools can be customized for BRM | Difficulty injecting customers in demos | Educate customer groups on the importance of attendance and 'what's in it for them' |
|
Which aspects of the product owner are "easy" in your organization? |
Which aspects of the product owner are "hard" in your organization? |
|---|---|
3.1 Build a starting checklist of quality filters
This step involves the following participants:
Outcomes of this step
When managed properly, the product backlog is a powerful project management tool that directly contributes to project success.
The product owner's primary responsibility is to ensure this backlog is managed effectively.
A well-formed backlog can be thought of as a DEEP backlog:
(Perforce, 2018)
Each activity is a variation of measuring value and estimating effort to validate and prioritize a PBI.
A PBI meets our definition of done and passes through to the next backlog tier when it meets the appropriate criteria. Quality filters should exist between each tier.
Expand the concepts of defining "ready" and "done" to include the other stages of a PBIs journey through product planning.
Info-Tech Insight: A quality filter ensures quality is met and teams are armed with the right information to work more efficiently and improve throughput.
In Deliver on Your Digital Product Vision, we demonstrate how the product roadmap is core to value realization. The product roadmap is your communicated path, and as a product owner, you use it to align teams and changes to your defined goals while aligning your product to enterprise goals and strategy.
Adapted from: Pichler, "What Is Product Management?"
The quality of your product backlog – and your ability to realize business value from your delivery pipeline – is directly related to the input, content, and prioritization of items in your product roadmap.
Match your roadmap and backlog to the needs of the product.
Product Managers do not have to choose between being tactical or strategic.
– Aha!, 2015
| Audience |
Business/ |
Users/Customers |
Delivery Teams |
|---|---|---|---|
|
Roadmap View |
Portfolio |
Product Family |
Technology |
|
Objectives |
To provide a snapshot |
To visualize and validate product strategy |
To coordinate broad technology and architecture decisions |
|
Artifacts |
Line items or sections of the roadmap are made up of individual products, and an artifact represents a disposition at its highest level. |
Artifacts are generally grouped by product teams and consist of strategic goals and the features that realize |
Artifacts are grouped by |
Business/ | Users/Customers | Delivery Teams |
|---|---|---|
Audience: | Audience: | Audience:
|
Level of Detail/Artifacts: | Level of Detail/Artifacts: | Level of Detail/Artifacts: |
Your product and product family roadmaps should be connected at an artifact level that is common between both. Typically, this is done with capabilities, but it can be done at a more granular level if an understanding of capabilities isn't available.

4.1 Identify key insights and takeaways
4.2 Perform exit survey and capture results
This step involves the following participants:
Outcomes of this step
| What key insights have you gained? | What takeaways have you identified? |
|---|---|
| (e.g. better understanding of Agile mindset, principles, and practices) | (e.g. how you can improve/spread Agile practices in the organization) |
Download Survey Template: |
|---|
Backlog Management | Scrum Simulation | Estimation | Product Owner | Product Roadmapping |
|---|---|---|---|---|
1: User stories and the art of decomposition 2: Effective backlog management & refinement 3: Identify insights and team feedback | 1: Scrum sprint planning and retrospective simulation 2: Pass the balls – sprint velocity game | 1: Improve product backlog item estimation 2: Agile estimation fundamentals 3: Understand the wisdom of crowds 4: Identify insights and team feedback | 1: Understand product management fundamentals 2: The critical role of the product owner 3: Manage effective product backlogs and roadmaps 4: Identify insights and team feedback | 1: Identify your product roadmapping pains 2: The six "tools" of product roadmapping 3: Product roadmapping exercise |
Organizations often struggle with numerous pain points around Agile delivery.
The Common Agile Challenges Survey results will help you identify and prioritize the organization's biggest (most cited) pain points. Treat these pain points like a backlog and address the biggest ones first.
Agile modules provide supporting activities:
Each module provides guidance and supporting activities related to a specific Agile challenge from your survey. These modules can be arranged to meet each organization's or team's needs while providing cohesive and consistent messaging. For additional supporting research, please visit the Agile / DevOps Resource Center.
This phase involves the following participants:
Roadmapping 1.1 Identify your product roadmapping pains
Roadmapping 1.2 The six "tools" of product roadmapping
Roadmapping 1.3 Product roadmapping exercise
| What is product management, and how does it differ from a project orientation? |
|---|
"A temporary endeavor undertaken to create a unique product, service, or result. The temporary nature of projects indicates a beginning and an end to the project work or a phase of the project work. Projects can stand alone or be part of a program or portfolio."
– PMBOK, PMI
"A tangible solution, tool, or service (physical or digital) that enables the long-term and evolving delivery of value to customers and stakeholders based on business and user requirements."
– Deliver on Your Digital Product Vision,
Info-Tech Research Group
Any proper definition of product recognizes that they are long-term endeavors that don't end after the project finishes. Because of this, products need well thought out roadmaps.
Product Portfolio
Groups of product families within an overall value stream or capability grouping.
Product Portfolio Manager
Product Family
A collection of related products. Products can be grouped along architectural, functional, operational, or experiential patterns.
Product Family Manager
Product
Single product composed of one or more applications and services.
Product Owner
Info-Tech Insight
The primary role conflict occurs when the product owner is a proxy for stakeholders or responsible for the delivery team. The product owner owns the product backlog. The delivery team owns the sprint backlog and delivery.
For example,
|
Capture your organization's definition of product: |
|---|
* For more on Product Management see Deliver on Your Digital Product Vision
The six "tools" of product roadmapping
Roadmapping 3.1 Product roadmapping exercise
Roadmapping 3.2 Identify key insights and takeaways
Roadmapping 3.3 Perform an exit survey
The city of Binbetter is a picturesque place that is sadly in decline because local industry jobs are slowly relocating elsewhere. So, the local government has decided to do something to reinvigorate the city. Binbetter City Council has set aside money and a parcel of land they would like to develop into a venue that will attract visitors and generate revenue for the city.
Your team was hired to develop the site, and you have already spent time with city representatives to create a vision, goals and strategy for building out this venue (captured on the following slides). The city doesn't want to wait until the entire venue is completed before it opens to visitors, and so you have been instructed to build it incrementally in order to bring in much needed revenue as soon as possible.
Using the vision, goals, and strategy you have created, your team will need to plan out the build (i.e. create a roadmap and release plan for which parts of the venue to build and in which order). You can assume that visitors will come to the venue after your "Release 1", even while the rest is still under construction. Select one member of your team to be designated as the product owner. The entire team will work together to consider options and agree on a roadmap/release plan, but the product owner will be the ultimate decision-maker.
* Adapted from Rautiainen et al, Toward Agile Product and Portfolio Management, 2015
Vision, Goals, and StrategyProduct Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city |
Vision, Goals, and StrategyProduct Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city
Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter. Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation). |
|
Release 1 (MVP) |
|---|
Vision, Goals, and StrategyProduct Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter. Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).
|
| Release 2 | Release 3 | Release 4 | Release 5 |
|---|---|---|---|
Vision, Goals, and StrategyProduct Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter. Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).
|
Roadmap, Release Plan and Backlog
| Vision, Goals, and StrategyProduct Vision: Create an architecturally significant venue that will attract both locals and tourists while also generating revenue for the city Goals: The venue will include a Château-style Hotel, Gothic-style Cathedral, and a Monument dedicated to the city's founder, Ivy Binbetter. Strategy: Develop the venue incrementally, focusing on the highest value elements first (prioritizing both usages by visitors and revenue generation).
|
| What key insights have you gained? | What takeaways have you identified? |
|---|---|
|
|
Download Survey Template: |
|---|
Implement DevOps Practices That Work
Deliver on Your Digital Product Vision
Deliver Digital Products at Scale
"Agile Estimation Practice." DZone.com, 13 May 2013. Web.
"Announcing DORA 2021 Accelerate State of DevOps Report." Google Cloud Blog. Accessed 8 Nov. 2022.
"Are Your IT Strategy and Business Strategy Aligned?" 5Q Partners, 8 Jan. 2015. Accessed Oct. 2016.
A, Karen. "20 Mental Models for Product Managers." Medium, Product Management Insider, 2 Aug. 2018 . Web.
ADAMS, PAUL. "Product Teams: How to Build & Structure Product Teams for Growth." Inside Intercom, 30 Oct. 2019. Web.
Agile Alliance. "Product Owner." Agile Alliance. n.d. Web.
Ambysoft. "2018 IT Project Success Rates Survey Results." Ambysoft. 2018. Web.
Banfield, Richard, et al. "On-Demand Webinar: Strategies for Scaling Your (Growing) Enterprise Product Team." Pluralsight, 31 Jan. 2018. Web.
Bloch, Michael, Sven Blumberg, and Jurgen Laartz. "Delivering Large-Scale IT Projects on Time, on Budget, and on Value." McKinsey & Company, October 2012.
Blueprint. "10 Ways Requirements Can Sabotage Your Projects Right From the Start." Blueprint. 2012. Web.
Boehm, Barry W. Software Engineering Economics. New Jersey: Prentice Hall, 1981.
Breddels, Dajo, and Paul Kuijten. "Product Owner Value Game." Agile2015 Conference. 2015. Web.
Cagan, Martin. "Behind Every Great Product." Silicon Valley Product Group. 2005. Web.
"Chaos Report 2015." The Standish Group, 2015. Accessed 29 July 2022.
Cohn, Mike. Succeeding With Agile: Software Development Using Scrum. Addison-Wesley. 2010. Web.
Connellan, Thomas K. Inside the Magic Kingdom, Bard Press, 1997. Print.
Dyba, Tore, and Torgeir Dingsøyr. "Empirical Studies of Agile Software Development: A Systematic Review." Elsevier, ScienceDirect. 24 Jan. 2008. Web.
"How do you define a product?" Scrum.org. 4 Apr 2017, Web
EDUCAUSE. "Aligning IT Funding Models to the Pace of Technology Change." EDUCAUSE. 14 Dec. 2015. Web.
Eick, Stephen. "Does Code Decay? Assessing the Evidence from Change Management Data." IEEE Transactions on Software Engineering, vol. 27, no. 1, Jan. 2001, pp. 1-12. Web.
"Enablers." Scaled Agile. n.d. Web.
"Epic." Scaled Agile. n.d. Web.
Eringa, Ron. "Evolution of the Product Owner." RonEringa.com. 12 June 2016. Web.
Fernandes, Thaisa. "Spotify Squad Framework - Part I." Medium.com. 6 Mar. 2017. Web.
Fowler, Martin. "Application Boundary." MartinFowler.com. 11 Sept. 2003. Web. 20 Nov. 2017.
Galen, Robert. "Measuring Technical Product Managership – What Does 'Good' Look Like ...." RGalen Consulting. 5 Aug. 2015. Web.
Hackshall, Robin. "Product Backlog Refinement." Scrum Alliance. 9 Oct. 2014. Web. Feb. 2019.
Halisky, Merland, and Luke Lackrone. "The Product Owner's Universe." Agile Alliance, Agile2016. 2016. Web.
Kamer, Jurriaan. "How to Build Your Own 'Spotify Model'." Medium.com. 9 Feb. 2018. Web.
Karlsson, Johan. "Backlog Grooming: Must-Know Tips for High-Value Products." Perforce. 18 May 2018. Web. Feb. 2019.
Lindstrom, Lowell. "7 Skills You Need to Be a Great Product Owner." Scrum Alliance. n.d. Web.
Lawrence, Richard, and Peter Green. "The Humanizing Work Guide to Splitting User Stories." Humanizing Work, 22 Oct. 2020. Web.
Leffingwell, Dean. "SAFe 5.0." Scaled Agile Inc. 2021. Web. Feb. 2021.
Lucero, Mario. "Product Backlog – Deep Model." Agilelucero. 8 Oct. 2014. Web.
Lukassen, Chris. "The Five Belts Of The Product Owner." Xebia.com. 20 Sept. 2016. Web.
Management 3.0. "Delegation Poker Product Image." Management 3.0. n.d. Web.
McCloskey, Heather. "Scaling Product Management: Secrets to Defeating Common Challenges." Scaling Product Management: Secrets to Defeating Common Challenges, ProductPlan, 12 July 2019 . Web.
McCloskey, Heather. "When and How to Scale Your Product Team." UserVoice Blog, UserVoice, 21 Feb. 2017 . Web.
Medium.com. "Exploring Key Elements of Spotify's Agile Scaling Model." Medium.com. 23 July 2018. Web.
Mironov, Rich. "Scaling Up Product Manager/Owner Teams: - Rich Mironov's Product Bytes." Rich Mironov's Product Bytes, Mironov Consulting, 12 Apr. 2014 . Web.
"Most Agile Transformations Will Fail." Vitality Chicago Inc., 24 Jan. 2019.
Overeem, Barry. "A Product Owner Self-Assessment." Barry Overeem. 6 Mar. 2017. Web.
Overeem, Barry. "Retrospective: Using the Team Radar." Barry Overeem. 27 Feb. 2017. Web.
"PI Planning." Scaled Agile. n.d. Web.
"PI Planning."SAFe. 2020.
Pichler, Roman. "How to Scale the Scrum Product Owner." Roman Pichler, 28 June 2016 . Web.
Pichler, Roman. "Product Management Framework." Pichler Consulting Limited. 2014. Web.
Pichler, Roman. "Sprint Planning Tips for Technical Product Managers." LinkedIn. 4 Sept. 2018. Web.
Pichler, Roman. "What Is Product Management?" Pichler Consulting Limited. 26 Nov. 2014. Web.
Project Management Institute. A Guide to the Project Management Body of Knowledge (PMBOK Guide). 7th ed., Project Management Institute, 2021.
Radigan, Dan. "Putting the 'Flow' Back in Workflow With WIP Limits." Atlassian. n.d. Web.
Royce, Dr. Winston W. "Managing the Development of Large Software Systems." Scf.usc.edu. 1970. Web.
Schuurman, Robbin. "10 Tips for Technical Product Managers on Agile Product Management." Scrum.org. 28 Nov. 2017. Web.
Schuurman, Robbin. "10 Tips for Technical Product Managers on (Business) Value." Scrum.org. 30 Nov. 2017. Web.
Schuurman, Robbin. "10 Tips for Technical Product Managers on Product Backlog Management." Scrum.org. 5 Dec. 2017. Web.
Schuurman, Robbin. "10 Tips for Technical Product Managers on the Product Vision." Scrum.org. 29 Nov. 2017. Web.
Schuurman, Robbin. "Tips for Starting Technical Product Managers." Scrum.org. 27 Nov. 2017. Web.
Sharma, Rohit. "Scaling Product Teams the Structured Way." Monetary Musings, Monetary Musings, 28 Nov. 2016 . Web.
STEINER, ANNE. "Start to Scale Your Product Management: Multiple Teams Working on Single Product." Cprime, Cprime, 6 Aug. 2019 . Web.
Shirazi, Reza. "Betsy Stockdale of Seilevel: Product Managers Are Not Afraid To Be Wrong." Austin VOP #50. 2 Oct. 2018. Web.
Standish Group, The. "The Standish Group 2015 Chaos Report." The Standish Group. 2015. Web.
Theus, Andre. "When Should You Scale the Product Management Team?" When Should You Scale the Product Management Team?, ProductPlan, 7 May 2019 . Web.
Todaro, Dave. "Splitting Epics and User Stories." Ascendle. n.d. Web. Feb. 2019.
Tolonen, Arto. "Scaling Product Management in a Single Product Company." Smartly.io - Digital Advertising Made Easy, Effective, and Enjoyable, Smartly.io, 26 Apr. 2018 . Web.
Ulrich, Catherine. "The 6 Types of Product Managers. Which One Do You Need?" Medium.com. 19 Dec. 2017. Web.
Vähäniitty, J. et al. "Chapter 7: Agile Product Management" in Towards Agile Product and Portfolio Management. Aalto University Software Process Research Group, 2010.
VersionOne. "12th Annual State of Agile Report." VersionOne. 9 April 2018. Web.
Verwijs, Christiaan. "Retrospective: Do The Team Radar." Medium.com. 10 Feb. 2017. Web.
"Why Agile Fails Because of Corporate Culture - DZone Agile." Dzone.Com. Accessed 31 Aug. 2021.
Collaboration
Team members leverage all their experience working towards a common goal.
Iterations
Cycles provide opportunities for more product feedback.
Prioritization
The most important needs are addressed in the current iteration.
Continual Improvement
Self-managing teams continually improve their approach for next iteration.
A well-formed backlog can be thought of as a DEEP backlog:
(Perforce, 2018)
Info-Tech Best Practice
Don't fully elaborate all of your PBIs at the beginning of the project instead, make sure they are elaborated "just in time." (Keep no more than 2 or 3 sprints worth of user stories in the Ready state.)
Scrum: Delivering related or grouped changes in fixed time intervals.
Kanban: Delivering independent items as soon as each is ready.
Delegate and Empower
Decision making must be delegated down within the organization, and all resources must be empowered and supported to make effective decisions.
Define Outcomes
Outcomes and goals must be clearly articulated and understood across the organization to ensure decisions are in line and stay within reasonable boundaries.
Make Risk informed decisions
Integrated risk information must be available with sufficient data to support decision making and design approaches at all levels of the organization.
Embed / Automate
Governance standards and activities need to be embedded in processes and practices. Optimal governance reduces its manual footprint while remaining viable. This also allows for more dynamic adaptation.
Establish standards and behavior
Standards and policies need to be defined as the foundation for embedding governance practices organizationally. These guardrails will create boundaries to reinforce delegated decision making.
Organizations should look to progress in their governance stages. Ad-Hoc, and controlled governance tends to be slow, expensive, and a poor fit for modern practices.
The goal as you progress in your stages is to delegate governance and empower teams to make optimal decisions in real-time, knowing that they are aligned with the understood best interests of the organization.
Automate governance for optimal velocity, while mitigating risks and driving value.
This puts your organization in the best position to be adaptive and able to react effectively to volatility and uncertainty.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
IT leaders who get personally involved in recruitment see better results. Read this section to learn how leader are getting involved, and how to take the first steps.
Heading into 2020, flexible work is table stakes. Read this section to learn what organizations offer and how you can take advantage of opportunities your competitors are missing.
Ethics and transparency are emerging as key considerations for employees. How can you build a culture that supports this? Read this section to learn how.
Your staff is the biggest line item in your budget, but are you using data to make decisions about your people they way you do in other areas of the business? Read this section to learn how analytics can be applied to the workforce no matter what level you are starting at.
With the rapid pace of technological change, it is becoming increasingly harder to hire skilled people for critical roles. Read this section to learn how some IT departments are turning to in-house training to fill the skill gap.
What do an employee's last few days with your company look like? For most organizations, they are filled with writing rushed documentation, hosting last-minute training sessions and finishing up odd jobs. Read this section to understand the crucial opportunity most IT departments are missing when it comes to departing staff.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This phase will help you define a benefits management process to help support effective benefits definition during portfolio intake.
This phase will help you define a process for effective benefits management during project planning and the execution intake phase.
This phase will help you define a process for effectively tracking and reporting on benefits realization post-project.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Assess the current state of benefits management at your organization and establish a realistic target state.
Establish project and portfolio baselines for benefits management.
Set achievable workshop goals and align stakeholder expectations.
Establish a solid foundation for benefits management success.
1.1 Introductions and overview.
1.2 Discuss attendee expectations and goals.
1.3 Complete Info-Tech’s PPM Current State Scorecard.
1.4 Perform right-wrong-confusing-missing analysis.
1.5 Define target state for benefits management.
1.6 Refine project levels.
Info-Tech’s PPM Current State Scorecard report
Right-wrong-confusing-missing analysis
Stakeholder alignment around workshop goals and target state
Info-Tech’s Project Intake Classification Matrix
Establish organizationally specific benefit metrics and KPIs.
Develop clear roles and accountabilities for benefits management.
An articulation of project benefits and measurements.
Clear checkpoints for benefits communication during the project are defined.
2.1 Map the current portfolio intake process.
2.2 Establish project sponsor responsibilities and accountabilities for benefits management.
2.3 Develop organizationally specific benefit metrics and KPIs.
2.4 Integrate intake legitimacy into portfolio intake processes.
Info-Tech’s Project Sponsor Role Description Template
Info-Tech’s Benefits Commitment Form Template
Intake legitimacy process flow and RASCI chart
Intake legitimacy SOP
Develop a customized SOP for benefits management during project planning and execution.
Ensure that all changes to the project have been recorded and benefits have been updated in preparation for deployment.
Updated benefits expectations are included in the final sign-off package.
3.1 Map current project management process and audit project management documentation.
3.2 Identify appropriate benefits control points.
3.3 Customize project management documentation to integrate benefits.
3.4 Develop a deployment legitimacy process flow.
Customized project management toolkit
Info-Tech’s Project Benefits Documentation Workbook
Deployment of legitimacy process flow and RASCI chart
Deployment of legitimacy SOP
Develop a post-project benefits realization process.
Clear project sponsorship accountabilities for post-project benefits tracking and reporting.
A portfolio level benefits tracking tool for reporting on benefits attainment.
4.1 Identify appropriate benefits control points in the post-project process.
4.2 Configure Info-Tech’s Portfolio Benefits Tracking Tool.
4.3 Define a post-project benefits reporting process.
4.4 Formalize protocol for reporting on, and course correcting, benefit lags.
4.5 Develop a post-project legitimacy process flow.
Info-Tech’s Portfolio Benefits Tracking Tool
Post-Project legitimacy process flow and RASCI chart
Post-Project Legitimacy SOP
Info-Tech’s Benefits Legitimacy Handbook
Info-Tech’s Benefits Legitimacy Workflow Template
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Begin strategy development by assigning roles and responsibilities for the team and establishing the initial direction for the strategy.
Create business process maps that incorporate how applications and data are coordinated to support business activities.
Review your integration map to identify improvement opportunities, explore integration solutions, and consolidate activity outputs into a strategy presentation.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discuss the general approach for creating a holistic enterprise integration strategy.
Define the initial direction and drivers.
Strategy development team with responsibilities identified.
Clear initial direction for the strategy based on senior stakeholder input.
1.1 Define the driving statements for your EI strategy.
1.2 Develop a RACI chart.
1.3 Discuss the current state of enterprise integration.
1.4 Establish the initial direction of your strategy by surveying senior stakeholders.
Vision, mission, and values for enterprise integration
RACI chart for strategy development
Documentation of past integration projects
Chief Enterprise Integration Officer job description template
Build a comprehensive map of what integration looks like for your target business processes.
Clear documentation of the integration environment, encompassing process, data, and applications.
2.1 Develop level-0 and level-1 business capability diagrams.
2.2 Identify the business processes of focus, based on relevance to overall corporate drivers.
2.3 Complete process flow diagrams.
2.4 Begin identifying the applications that are involved in each step of your process.
2.5 Detail the connections/interactions between the applications in your business processes.
2.6 Draw a current state diagram for application integration.
2.7 Identify the data elements created, used, and stored throughout the processes, as well as systems of record.
Business capability maps
Business process flow diagrams
Current state integration diagram
Completed integration map
Review the outputs of the integration mapping activities.
Educate strategy team on the potential integration solutions.
Consolidate the findings of the activities into a compelling strategy presentation.
Integration improvement opportunities are identified.
Direction and drivers for enterprise integration are finalized.
Understanding of the benefits and limitations of some integration solutions.
3.1 Discuss the observations/challenges and opportunities for improvement.
3.2 Refine the focus of the strategy by conducting a more detailed stakeholder survey.
3.3 Review the most common integration solutions for process, applications, and data.
3.4 Create a future state integration architecture diagram.
3.5 Define the IT and business critical success factors for EI.
3.6 Articulate the risks with pursuing (and not pursuing) an EI strategy.
3.7 Quantify the monetary benefits of the EI strategy.
3.8 Discuss best practices for presenting the strategy and organize the presentation content.
Critical success factors and risks for enterprise integration
Monetary benefits of enterprise integration
Completed enterprise integration strategy presentation
Leadership has evolved over time. The velocity of change has increased and leadership for the future looks different than the past.
Development of the leadership mind should never stop. This program will help IT leaders continue to craft their leadership competencies to navigate the ever-changing world in which we operate.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Gert Taeymans BV wants to inform you about our cookie notice on the Gert Taeymans BV websites via this document. Please also see the privacy policy which you can find here.
This website is owned by Gert Taeymans BV
Contact details:
Gert Taeymans BV
Koning Albertstraat 136
2070 Burcht
Belgium
Company number: 0685974694
Phone: +32 3 289 41 09
email: gtbvba@gerttaeymans.com
The websites in scope of this notice are:
We differentiate 4 types of cookies
| Name | Contents | Expiration | Reason for the cookie |
| Session cookie (displayed as a long series of numbers and letters) | The active session ID | When you close your broser, clear your cookie's cache in your browser or after 60 minutes of inactivity on the site. The cookie may remain in your machine but is no longer valid after the mentioned tile of inactivity |
The browser cookie is simply a random string of characters to identify the visitor. There are no personally identifable details in the cookie and no real data of use at all. The cookie is marked as a 'session' type of cookie, which means it will expire (be deleted automatically) when the browser is closed or cleaned by the browser after a set period of non-use; for instance, you haven't visited a page on the site that has used the cookie for 1 week. This latter case is useful for people that leave their computer running and never close their browser. The use of a cookie is what gives your website a short-term memory. By providing it with each request, Joomla can look up the history of the current viewing session in the database record below. |
| cookieconsent_status | allow | 1 year | This cookie stores that you have consented to the use of cookies on our site. It is there to avoid that you have to give your consent again at every page load. |
| Site | Name | Contents | Expiration | Reason for the cookie |
| gerttaeymans.consulting | None at this stage | N/A | N/A | N/A |
| tymansgroup.com | None at this stage | N/A | N/A | N/A |
| Site | Name | Contents | Expiration | Reason for the cookie |
| All Scope | _ga | Google Analytics type and account identifier | 2 years | This cookie identifies our domain (gerttaeymans.consulting) and sends visit information to Google. information may include, but not limited to: browser identifiable information, page visited, visit duration, etc. This information does not contain user identifiable information |
| All Scope | _gat_gtag_UA_140807308_3 | Google Analytics type and account identifier | 2 years | This cookie also identifies our domain (gerttaeymans.consulting) and sends visit information to Google. information may include, but not limited to: browser identifiable information, page visited, visit duration, etc. This information does not contain user identifiable information |
| All Scope | _gid | Google Analytics type and account identifier | 1 day | This cookie also identifies our domain (gerttaeymans.consulting) and sends visit information to Google. information may include, but not limited to: browser identifiable information, page visited, visit duration, etc. This information does not contain user identifiable information |
| Name | Contents | Expiration | Reason for the cookie |
| None at this stage | N/A | N/A | N/A |
You are not required to accept any cookies . Our cookies toolbar allows you to fine tune which cookies you accespt or want to revoke consent for. The resulting experience may however be affected by your decision not to accept cookies.
Eg. not accepting or revoking consent for the “Necessary” category cookies will result in your inability to log into the site, even if you have previously accepted the cookies and paid for service.
Not accepting or revoking consent for “Preference” category cookies may impede on your ability to watch instructional videos on our site, even if you have previously accepted the cookies and paid for service.
Not accepting or revoking consent for ‘Statistical” category cookies will result in us not seeing where visitors stay longer or shorter on our site. While the immediate experience will not degrade for you, it may impede us in better understanding where we need to improve our service, thereby denying you a potentially improved experience in the future.
Not accepting or revoking consent for “Marketing” category cookies may result in you seeing irrelevant ads, if we make the decision to allow carefully selected partners to offer their services through our site.
You can delete all cookies that are already on your device by clearing the browsing history of your browser. This will remove all cookies from all websites you have visited.
Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).
For more detailed control over site-specific cookies, check the privacy and cookie settings in your preferred browser
You can set most modern browsers to prevent any cookies being placed on your device, but you may then have to manually adjust some preferences every time you visit a site/page. And some services and functionalities may not work properly at all (e.g. profile logging-in).
The Business Impact Analysis (BIA) is easily one of the most misunderstood processes in the modern enterprise. For many, the term conjures images of dusty binders filled with disaster recovery plans. A compliance checkbox exercise focused solely on what to do when the servers are smoking or the building is flooded. This view, while not entirely incorrect, is dangerously incomplete. It relegates the BIA to a reactive, insurance-policy mindset when it should be a proactive, strategic intelligence tool.
Yes, I got that text from AI. So recognizable. But you know what? There is a kernel of truth in this.
A modern BIA is about understanding and protecting value more than just about planning for disaster. That is the one thing we must keep in mind at all times. The BIA really is a deep dive into the DNA of the organization. It maps the connections between information assets, operational processes, and business outcomes. It answers the critical question, “What matters? And why ? And what is the escalating cost of its absence?”
To answer “what matters,” the process must begin at the highest level: with senior management and, ideally, the board. Defining the organization's core mission and priorities is a foundational governance task, a principle now embedded in European regulations like DORA.
The process begins at the highest level with senior management. I would say, the board. They need to decide what the business is all about. (This is in line with the DORA rules in Europe.) The core business units or departments of the organization are ranked based on their contribution to the company's mission. This ranking is frequently based on revenue generation, but it can also factor in strategic importance, market position, or essential support functions. For example, the “Production” and “Sales” units might be ranked higher than “Internal HR Administration.” This initial ranking provides the foundational context for all subsequent decisions.
I want to make something crystal clear: this ranking is merely a practical assessment. Obviously the HR and well being departments play a pivotal role in the value delivery of the company. Happy employees make for happy customers.
But, being a bit Wall-Streety about it, the sales department generating the biggest returns is probably only surpassed by the business unit producing the product for those sales. And with that I just said that the person holding the wrench, who knows your critical production machine, is your most valuable HR asset. Just saying.
With the business units prioritized, the next step is to drill down into each one and identify its critical operational functions. The focus here is on processes, not technology. For the top-ranked “Sales” unit, critical functions might include:
SF-01: Processing New Customer Orders
SF-02: Managing the Customer Relationship Management (CRM) System
SF-03: Generating Sales Quotes
These functions are then rated against each other within the business unit to create a prioritized list of what truly matters for that unit to achieve its goals.
And here I'm going to give you some food for thought. There will be a superficial geographical difference in importance. If you value continuity then new business may not be the top critical department. I can imagine this is completely counter intuitive. But remember that it is cheaper to keep and upsell an existing client than it is to acquire a new one.
With a clear map of what the business does, the next logical step is to identify what it uses to get it done. This brings us to the non-negotiable foundation of resilience: comprehensive information asset classification.
Without knowing what you have, where it is, and what it's worth, any attempt at risk management is simply guesswork. You risk spending millions protecting low/mid-value data while leaving the crown jewels exposed (I guess your Ciso will have said something 😊). In this article, we will explore how foundational asset classification can evolve into a mature, value-driven impact analysis, offering a blueprint for transforming the BIA from a tactical chore into a strategic imperative.
Before you can determine the effect of losing an asset, you must first understand the asset itself. Information asset classification is the systematic process of inventorying, categorizing, and assigning business value to your organization's data. Now that we have terabyte-scale data on servers, cloud environments, and countless SaaS applications, you have your work cut out for you. It is, however, a most critical investment in the risk management lifecycle.
Classification forces an organization to look beyond the raw data and evaluate it through two primary lenses: criticality and sensitivity.
Criticality is a measure of importance. It answers the question: “How much damage would the business suffer if this asset were unavailable or corrupted?” This is directly tied to the operational functions that depend on the asset. The criticality of a customer database, for instance, is determined by the impact on the sales, marketing, and support functions that would grind to a halt without it. This translates to the availability rating.
Sensitivity is a measure of secrecy. It answers the question: “What is the potential harm if this asset were disclosed to unauthorized parties?” This considers reputational damage, competitive disadvantage, legal penalties, and customer privacy violations. This translates to the confidentiality rating.
Without this dual understanding, it's impossible to implement a proportional and cost-effective security program. The alternative is a one-size-fits-all approach, which invariably leads to one of two expensive failures:
Overprotection: Applying the highest level of security controls to all information is prohibitively expensive and creates unnecessary operational friction. It's like putting a bank vault door on a broom closet.
Underprotection: Applying a baseline level of security to all assets leaves your most critical and sensitive information dangerously vulnerable. It exposes your organization to unacceptable risk. Remember assigning an A2 rating to all your infra because it cannot be related to specific business processes? The “we'll take care of it at the higher levels” approach leads to exactly this issue.
By understanding the criticality and sensitivity of assets, organizations can ensure that security efforts are directly tied to business objectives, making the investment in protection proportional to the asset's value. Proportionality is also embedded in new European legislation.
While the concept is straightforward, the execution can be complex. A successful classification program requires a methodical framework that moves from high-level policy to granular implementation. in this first stage, we're going to talk about data.
The first step is to establish a simple, intuitive classification scheme. When you complicate it, you lose your people. Most organizations find success with a three- or four-tiered model, which is easy for employees to understand and apply. For example:
Public: Information intended for public consumption with no negative impact from disclosure (e.g., marketing materials, press releases).
Internal: Information for use within the organization but not overly sensitive. Its disclosure would be inconvenient but not damaging (e.g., internal memos on non-sensitive topics, general project plans).
Confidential: Sensitive business information that, if disclosed, could cause measurable damage to the organization's finances, operations, or reputation (e.g., business plans, financial forecasts, customer lists).
Restricted or secret: The most sensitive data that could cause severe financial or legal damage if compromised. Access is strictly limited on a need-to-know basis (e.g., trade secrets, source code, PII, M&A details).
This is often the most challenging phase: identifying and locating all information assets. You must create a comprehensive inventory and detail not just the data itself but its entire context:
Data Owners: The business leader accountable for the data and for determining its classification.
Data Custodians: The IT or operational teams responsible for implementing and managing the security controls on the data.
Location: Where does the data live? Is it in a specific database, a cloud storage bucket, a third-party application, or a physical filing cabinet?
External Dependencies: Crucially, this inventory must extend beyond the company's walls. Which third-party vendors (payroll processors, cloud hosting providers, marketing agencies) handle, store, or transport your data? Their security posture is now part of your risk surface. In Europe, this is now a foundation of your data management through GDPR, DORA, the AI Act and other legislation.
Information isn't static. Its value and handling requirements can change over its lifecycle. Your classification process must define clear rules for each stage:
Creation: How is data classified when it's first created? How is it marked (e.g., digital watermarks, document headers)?
Storage & Use: What security controls apply to each classification level at rest and in transit (e.g., encryption standards, access control rules)? What about legislative initiatives?
Archiving & Retention: How long must the data be kept to meet business needs and legal requirements? What about external storage?
Destruction: What are the approved methods for securely destroying the data (e.g., cryptographic erasure, physical shredding) once it's no longer required?
Without clear, consistent handling standards for each level, the classification labels themselves are meaningless. The classification directly dictates the required security measures.
This dual (business processes and asset classification) top-down approach to determining criticality is often referred to as the 'hierarchy of importance,' which helps in systematically prioritizing assets based on their business value.
Once assets are inventoried, the next step is to systematically determine their criticality. Randomly assigning importance to thousands of assets is futile. A far more effective method is a top-down, hierarchical approach that mirrors the structure of the business itself. This method creates a clear “chain of criticality,” where the importance of a technical asset is directly derived from the value of the business function it supports.
Only now, once you have clearly defined the critical business functions and prioritized them, can you finally map the specific assets and resources they depend on. These are the people, technology, and facilities that enable the function. For the critical function “Processing New Customer Orders,” the supporting assets might include:
Application: SAP ERP System (Module SD)
Database: Oracle Customer Order Database
Hardware: Primary ERP Server Cluster
Personnel: Sales team and Order Entry team
The criticality of the “Oracle Customer Order Database” is now clear. It is clearly integrated into the business; it is critically important because it is an essential asset for a top-priority function (SF-01) within a top-ranked business unit (“Sales”). This top-down structure provides a clear, business-justified view of risk that management can easily understand. It allows you to see precisely how a technical risk (e.g., a vulnerability in the Oracle database) can bubble up to impact a core business operation.
With a clear understanding of what's indispensable, the BIA can now finally move to its core purpose: analyzing the tangible and intangible impacts of a disruption over time. A robust impact analysis prevents “impact inflation,” which is the common tendency to focus solely on unrealistic scenarios or self-importance assurances, as this just causes management to discount your findings. That just causes management to discount your findings. A more credible approach uses a range of outcomes that paint a realistic picture of escalating damage over time.
Your analysis should assess the loss of the four core pillars of information security:
Loss of Confidentiality: The unauthorized disclosure of sensitive information. The impact can range from legal fines for a data breach to the loss of competitive advantage from a leaked product design.
Loss of Integrity: The unauthorized or improper modification of data. This can lead to flawed decision-making based on corrupted reports, financial fraud, or a complete loss of trust in the system.
Loss of Availability: The inability to access a system or process. This is the most common focus of traditional BIA, leading to lost productivity, missed sales, and an inability to deliver services.
This brings us to the CIAA rating, which encompasses Confidentiality, Integrity, Availability, and Authenticity, providing a comprehensive framework for assessing information security impacts.
Impacts can be measured in two ways, and the most effective BIAs use a combination of both:
Qualitative Analysis: This uses descriptive scales (e.g., High, Medium, Low) to assess impacts that are difficult to assign a specific monetary value to. This is ideal for measuring things like reputational damage, loss of customer confidence, or employee morale. Its main advantage is prioritizing risks quickly, but it lacks the financial precision needed for a cost-benefit analysis.
Quantitative Analysis: This assigns a specific monetary value ($) to the impact. This is used for measurable losses like lost revenue per hour, regulatory fines, or the cost of manual workarounds. The major advantage is that it provides clear financial data to justify security investments. For example, “This outage will cost us $100,000 per hour in lost sales” is a powerful statement when requesting funding for a high-availability solution.
A mature analysis might involve scenario modeling—where we walk through a small set of plausible disruption scenarios with business stakeholders to define a range of outcomes (minimum, maximum, and most likely). This provides a far more nuanced and credible dataset that aligns with how management views other business risks.
To elevate the BIA from an internal exercise to a truly strategic tool, we can apply one more lens: the Customer Value Chain Contribution (CVCC)©. This approach reframes the impact analysis to focus explicitly on the customer. Instead of just asking, “What is the impact on our business?” we ask, “What is the impact on our customer's experience and our ability to deliver value to them?”
The CVCC method involves mapping your critical processes and assets to specific stages of the customer journey. For example:
Awareness/Acquisition: A disruption to the company website or marketing automation platform directly impacts your ability to attract new customers.
Conversion/Sale: An outage of the e-commerce platform or CRM system prevents customers from making purchases, directly impacting revenue and frustrating users at a key moment.
Service Delivery/Fulfillment: A failure in the warehouse management or logistics system means orders can't be fulfilled, breaking promises made to the customer.
Support/Retention: If the customer support ticketing system is down, customers with problems can't get help, leading to immense frustration and potential churn.
By analyzing impact through the CVCC lens, the consequences become far more vivid and compelling. “Loss of the CRM system” becomes “a complete inability to process new sales leads or support existing customers, causing direct revenue loss and significant reputational damage.” This framing aligns the BIA directly with the goal of any business: creating and retaining satisfied customers. It transforms the discussion from technical risk to the preservation of the customer relationship and the value chain that supports it.
When you build your BIA on this framework, meaning that it is rooted in sound asset classification, structured by the correct top-down criticality analysis, and enriched by the customer-centric view of impact, then it is no longer a static document. It becomes the dynamic, strategic blueprint for organizational resilience.
These insights generate business decisions:
Prioritized risk mitigation: they show exactly where to focus security efforts and resources for the greatest return on investment.
Justified security spending: they provide the quantitative and qualitative data needed to make a compelling business case for new security controls, technologies, and processes.
Informed recovery planning: they establish clear, business-justified Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) that form the foundation of any effective business continuity and disaster recovery plan.
I'm convinced that this expanded vision of the business impact analysis embeds the right analytical understanding of value and risk into the fabric of the organization. I want you to move beyond the fear of disaster and toward a confident, proactive posture of resilience. Like that, you ensure that in a world of constant change and disruption, the things that truly matter are always understood, always protected, and always available.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Acquire the right hire.
Ensure an effective and seamless interview process.
Be an effective interviewer.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand basic machine learning concepts used in endpoint security.
Determine feature requirements to evaluate vendors.
The project isn’t over if the new product or system isn’t being used. How do you ensure that what you’ve put in place isn’t going to be ignored or only partially adopted? People are more complicated than any new system and managing them through the change needs careful planning.
Cultivating a herd mentality, where people adopt new technology merely because everyone else is, is an important goal in getting the bulk of users using the new product or system. The herd needs to gather momentum though and this can be done by using the more tech-able and enthused to lead the rest on the journey. Identifying and engaging these key resources early in the process will greatly assist in starting the flow.
While communication is key throughout, involving staff in proof-of-concept activities and contests and using the train-the-trainer techniques and technology champions will all start the momentum toward technology adoption. Group activities will address the bulk of users, but laggards may need special attention.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This document will help you to ensure that newly implemented systems and technologies are correctly adopted by the intended recipients.
The project is over. The new technology is implemented. Now how do we make sure it's used?
Technology endlessly changes and evolves. Similarly, business directions and requirements change, and these changes need to be supported by technology. Improved functionality and evolvement of systems, along with systems becoming redundant or unsupported, means that maintaining a static environment is virtually impossible.
Enormous amounts of IT budget are allocated to these changes each year. But once the project is over, how do you manage that change and ensure the systems are being used? Planning your technology adoption is vital.
The obstacles to technology adoption can be many and various, covering a broad spectrum of areas including:
Start by identifying, understanding, categorizing, and defining barriers and put in place a system to:
For every IT initiative that will be directly used by users, consider the question, “Will the final product be readily accepted by those who are going to use it?” There is no point in implementing a product that no one is prepared to use. Gaining user acceptance is much more than just ticking a box in a project plan once UAT is complete.
Prosci specializes in change. Its ADKAR model outlines what’s required to bring individuals along on the change journey.
The project is seen as complete. Significant investments have been made, but the technology either isn’t being used or is only partially in use.
Even worse. The failure to adopt the new technology by some means that the older systems are still being used. There are now two systems that fail to interact; business processes are being affected and there is widespread confusion.
Benefits promised to the business are not being realized. Projected revenue increases, savings, or efficiencies that were forecast are now starting to be seen as under threat.
The project should be over, but the fact that the technology is not being used has created a perception that the implementation is not complete and the project needs to continue.
People are far more complicated than any technology being implemented.
Consider carefully your approach.
There isn’t always adequate communications about what’s changing in the workplace.
Fear of change is natural and often not rational. Whether the fear is about job loss or not being able to adapt to change; it needs to be managed.
Training can be insufficient or ineffective and when this happens people are left feeling like they don’t have the skills to make the change.
A lack of executive support for change means the change is seen as less important.
The excitement the project team and business feels about the change is not necessarily shared throughout the business. Some may just see the change as more work, changing something that already works, or a reason to reduce staff levels.
Whether it’s a lack of confidence generally with technology or concern about a new or changing tool, a lack of confidence is a huge barrier.
There is a cost with managing people during a change, and budget must be allocated to allow for it.
Since Sigmund Freud there has been endless work to understand people’s minds.
Don’t underestimate the effect that people’s reactions to change can have on your project.
Communication plans are designed to properly manage change. Managing change can be easier when we have the right tools and information to adapt to new circumstances. The Kubler-Ross change curve illustrates the expected steps on the path to acceptance of change. With the proper communications strategy, each can be managed appropriately
The rapidly changing technology landscape in our world has always meant that an enthusiasm or willingness to embrace change has been advantageous. Many of us have seen how the older generation has struggled with that change and been left behind.
In the work environment, the events of the past two years have increased pressure on those slow to adopt as in many cases they couldn't perform their tasks without new tools. Previously, for example, those who may have been reluctant to use digital tools and would instead opt for face-to-face meetings, suddenly found themselves without an option as physical meetings were no longer possible. Similarly, digital collaboration tools that had been present in the market for some time were suddenly more heavily used so everyone could continue to work together in the “online world.”
At this stage no one is sure what the "new normal" will be in the post-pandemic world, but what has been clearly revealed is that people are prepared to change given the right motivation.
“Technology adoption is about the psychology of change.”
Bryan Tutor – Executive Counsellor, Info-Tech
Consider your staff and industry when looking at the Everett Rogers curve. A technology organization may have less laggards than a traditional manufacturing one.
In Everett Rogers’ book Diffusion of Innovations 5th Edition (Free Press, 2005), Rogers places adopters of innovations into five different categories.
Innovators are technology enthusiasts. Technology is a central interest of theirs, either at work, at home, or both. They tend to aggressively pursue new products and technologies and are likely to want to be involved in any new technology being implemented as soon as possible, even before the product is ready to be released.
For people like this the completeness of the new technology or the performance can often be secondary because of their drive to get new technology as soon as possible. They are trailblazers and are not only happy to step out of their comfort zone but also actively seek to do so.
Although they only make up about 2.5% of the total, their enthusiasm, and hopefully endorsement of new technology, offers reassurance to others.
Innovators can be very useful for testing before implementation but are generally more interested in the technology itself rather than the value the technology will add to the business.
Whereas Innovators tend to be technologists, Early Adopters are visionaries that like to be on board with new technologies very early in the lifecycle. Because they are visionaries, they tend to be looking for more than just improvement – a revolutionary breakthrough. They are prepared to take high risks to try something new and although they are very demanding as far as product features and performance are concerned, they are less price-sensitive than other groups.
Early Adopters are often motivated by personal success. They are willing to serve as references to other adopter groups. They are influential, seen as trendsetters, and are of utmost importance to win over.
Early adopters are key. Their enthusiasm for technology, personal drive, and influence make them a powerful tool in driving adoption.
This group is comprised of pragmatists. The first two adopter groups belong to early adoption, but for a product to be fully adopted the mainstream needs to be won over, starting with the Early Majority.
The Early Majority share some of the Early Adopters’ ability to relate to technology. However, they are driven by a strong sense of practicality. They know that new products aren’t always successful. Consequently, they are content to wait and see how others fare with the technology before investing in it themselves. They want to see well-established references before adopting the technology and to be shown there is no risk.
Because there are so many people in this segment (roughly 34%), winning these people over is essential for the technology to be adopted.
The Late Majority are the conservatives. This group is generally about the same size as the Early Majority. They share all the concerns of the Early Majority; however, they are more resistant to change and are more content with the status quo than eager to progress to new technology. People in the Early Majority group are comfortable with their ability to handle new technology. People in the Late Majority are not.
As a result, these conservatives prefer to wait until something has become an established standard and take part only at the end of the adoption period. Even then, they want to see lots of support and ensure that there is proof there is no risk in them adopting it.
This group is made up of the skeptics and constitutes 16% of the total. These people want nothing to do with new technology and are generally only content with technological change when it is invisible to them. These skeptics have a strong belief that disruptive new technologies rarely deliver the value promised and are almost always worried about unintended consequences.
Laggards need to be dealt with carefully as their criticism can be damaging and without them it is difficult for a product to become fully adopted. Unfortunately, the effort required for this to happen is often disproportional to the size of the group.
People aren’t born laggards. Technology projects that have failed in the past can alter people’s attitudes, especially if there was a negative impact on their working lives. Use empathy when dealing with people and respect their hesitancy.
Technology adoption is all about people; and therefore, the techniques required to drive that adoption need to be people oriented.
The following techniques are carefully selected with the intention of being impactful on all the different categories described previously.
There are multitudes of different methods to get people to adopt new technology, but which is the most appropriate for your situation? Generally, it’s a combination.
Use your staff to get your message across.
This technique involves training key members of staff so they can train others. It is important that those selected are strong communicators, are well respected by others, and have some expertise in technology.
Marketing should be continuous throughout the change to encourage familiarity.
Communication is key as people are comfortable with what is familiar to them. Marketing is an important tool for convincing adopters that the new product is mainstream, widely adopted and successful.
Tailored for individuals.
One-on-one training sometimes is the only way to train if you have staff with special needs or who are performing unique tasks.
It is generally highly effective but inefficient as it only addresses individuals.
Similar roles, attitudes, and abilities.
Group training is one of the most common methods to start people on their journey toward new technology. Its effectiveness with the two largest groups, Early Majority and Late Majority, make it a primary tool in technology adoption.
The last resort.
The transition can’t go on forever.
At some point the new technology needs to be fully adopted and if necessary, force may have to be used.
Contests can generate excitement and create an explorative approach to new technology. People should not feel pressured. It should be enjoyable and not compulsory.
Incentives don’t have to be large.
For some staff, merely taking management’s lead is not enough. Using “Nudge” techniques to give that extra incentive is quite effective. Incentivizing staff either financially or through rewards, recognition, or promotion is a successful adoption technique for some.
Encouragement to adopt from receiving tangible benefit
Draws more attention to the new technology
Additional expense to business or project
Possible poor precedent for subsequent changes
Early Adopter: Desire for personal success makes incentives enticing.
Early Majority: Prepared to change, but extra incentive will assist.
Late Majority: Conservative attitude means incentive may need to be larger.
Innovator: Enthusiasm for new technology means incentive not necessary.
Laggard: Sceptical about change. Only a large incentive likely to make a difference.
Strong internal advocates for your new technology are very powerful.
Champions take on new technology and then use their influence to promote it in the organization. Using managers as champions to actively and vigorously promote the change is particularly effective.
Follow the crowd.
Herd behavior is when people discount their own information and follow others. Ideally all adopters would understand the reason and advantages in adopting new technology, but practically, the result is most important.
Gain early input and encourage buy-in.
Proof of concept projects give early indications of the viability of a new initiative. Involving the end users in these projects can be beneficial in gaining their support
Involve adopters early on
Valuable feedback and indications of future issues
If POC isn’t fully successful, it may leave lingering negativity
Usually, involvement from small selection of staff
What works for who?
Engage your technology enthusiasts early to help refine your product, train other staff, and act as champions. A combination of marketing and group training will develop a herd mentality. Finally, don’t neglect the laggards as they can prevent project completion.

Although there are different size categories, none can be ignored. Consider your budget when dealing with smaller groups, but also consider their impact.
We don’t want people to revert.
Don’t assume that because your staff have been trained and have access to the new technology that they will keep using it in the way they were trained. Or that they won’t revert back to their old methods or system.
Put in place methods to remove completely or remove access to old systems. Schedule refresh training or skill enhancement sessions and stay vigilant.

Principal Research Advisor, Info-Tech Research Group
With over 30 years in the IT industry, Paul brings to his work his experience as a Strategic Planner, Consultant, Enterprise Architect, IT Business Owner, Technologist, and Manager. Paul has worked with both small and large companies, local and international, and has had senior roles in government and the finance industry.
Principal Research Advisor, Info-Tech Research Group
Scott Young is a Director of Infrastructure Research at Info-Tech Research Group. Scott has worked in the technology field for over 17 years, with a strong focus on telecommunications and enterprise infrastructure architecture. He brings extensive practical experience in these areas of specialization, including IP networks, server hardware and OS, storage, and virtualization.
Use Info-Tech’s workbook to gather information about user groups, business processes, and day-to-day tasks to gain familiarity with your adopters.
Governance and Management of Enterprise Software Implementation
Use our research to engage users and receive timely feedback through demonstrations. Our iterative methodology with a task list focused on the business’ must-have functionality allows staff to return to their daily work sooner.
Quality Management User Satisfaction Survey
This IT satisfaction survey will assist you with early information to use for categorizing your users.
Master Organizational Change Management Practices
Using a soft, empathetic approach to change management is something that all PMOs should understand. Use our research to ensure you have an effective OCM plan that will ensure project success.
Beylis, Guillermo. “COVID-19 accelerates technology adoption and deepens inequality among workers in Latin America and the Caribbean.” World Bank Blogs, 4 March 2021. Web.
Cleland, Kelley. “Successful User Adoption Strategies.” Insight Voices, 25 Apr. 2017. Web.
Hiatt, Jeff. “The Prosci ADKAR ® Model.” PROSCI, 1994. Web.
Malik, Priyanka. “The Kübler Ross Change Curve in the Workplace.” whatfix, 24 Feb. 2022. Web.
Medhaugir, Tore. “6 Ways to Encourage Software Adoption.” XAIT, 9 March 2021. Web.
Narayanan, Vishy. “What PwC Australia learned about fast tracking tech adoption during COVID-19” PWC, 13 Oct. 2020. Web.
Sridharan, Mithun. “Crossing the Chasm: Technology Adoption Lifecycle.” Think Insights, 28 Jun 2022. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Assess current state and plan the scope of the SAM program, team, and budget.
Define processes for software requests, procurement, receiving, and deployment.
Define processes for software inventory, maintenance, harvest and redeployment, and retirement.
Build processes for audits and plan the implementation.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Assess current state and plan the scope of the SAM program, team, and budget.
Current state assessment
Defined roles and responsibilities
SAM budget plan
1.1 Outline SAM challenges and objectives.
1.2 Assess current state.
1.3 Identify roles and responsibilities for SAM team.
1.4 Identify metrics and reports.
1.5 Identify SAM functions to centralize vs. decentralize.
1.6 Plan SAM budget process.
Current State Assessment
RACI Chart
Defined metrics and reports
SAM Budget Workbook
Define processes for software requests, procurement, receiving, and deployment.
Defined standards for software procurement
Documented processes for software receiving and deployment
2.1 Determine software standards.
2.2 Define procurement process for new contracts.
2.3 Define process for contract renewals and additional procurement scenarios.
2.4 Design process for receiving software.
2.5 Design deployment workflow.
2.6 Define process for non-standard software requests.
Software standards
Standard Operating Procedures
SAM Process Workflows
Define processes for software inventory, maintenance, harvest and redeployment, and retirement.
Defined process for conducting software inventory
Maintenance and patch policy
Documented workflows for software harvest and redeployment as well as retirement
3.1 Define process for conducting software inventory.
3.2 Define policies for software maintenance and patches.
3.3 Map software license harvest and reallocation process.
3.4 Define policy for retiring software.
Standard Operating Procedures
Patch management policy
SAM Process Workflows
Build processes for audits, identify tool requirements, and plan the implementation.
Defined process for internal and external audits
Tool requirements
Communication and implementation plan
4.1 Define and document the internal audit process.
4.2 Define and document the external audit process.
4.3 Document tool requirements.
4.4 Develop a communication plan.
4.5 Prepare an FAQ list.
4.6 Identify SAM policies.
4.7 Develop a SAM roadmap to plan your implementation.
Audit response templates
Tool requirements
Communication plan
End-user FAQ list
Software Asset Management Policy
Implementation roadmap
“Organizations often conflate software asset management (SAM) with license tracking. SAM is not merely knowing how many licenses you require to be in compliance; it’s asking the deeper budgetary questions to right-size your software spend.
Software audits are a growing concern for businesses, but proactive reporting and decision making supported by quality data will mitigate audit risks. Value is left on the table through underused or poor-quality data, so active data management must be in play. A dedicated ITAM tool can assist with extracting value from your license data.
Achieving an optimized SAM program is a transformative effort, but the people, processes, and technology need to be in place before that can happen.” (Sandi Conrad, Senior Director, Infrastructure & Operations Practice, Info-Tech Research Group)
A strong SAM program will benefit all aspects of the business.
Data and reports gained through SAM will enable data-driven decision making for all areas of the business.
Don’t just track licenses; manage them to create value from data.
Gathering and monitoring license data is just the beginning. What you do with that data is the real test.
Win the audit battle without fighting.
Conduct internal audits to minimize surprises when external audits are requested.
You can estimate the return even without tools or data.
| Benefit | Calculate the return |
|---|---|
| Compliance
How many audits did you have in the past three years? How much time did you spend in audit response? |
Suppose you had two audits each year for the last three years, each with an average $250,000 in settlements.
A team of four with an average salary of $75,000 each took six months to respond each year, allocating 20% of their work time to the audit. You could argue annual audits cost on average $530,000. Increasing ITAM maturity stands to reduce that cost significantly. |
| Efficiency
How much do you spend on software and maintenance by supplier? |
Suppose you spent $1M on software last year. What if you could reduce the spend by just 10% through better practices?
SAM can help reduce the annual spend by simplifying support, renegotiating contracts based on asset data, reducing redundancy, and reducing spend. |
54% — A study by 1E found that only 54% of organizations believe they can identify all unused software in their organization.
28% — On average, 28% of deployed software is unused, with a wasted cost of $224 per PC on unused software (1E, 2014).
53% — Express Metrix found that 53% of organizations had been audited within the past two years. Of those, 72% had been audited within the last 12 months.
Manage risk. If licensing terms are not properly observed, the organization is at risk of legal and financial exposure, including illegal software installation, loss of proof of licenses purchased, or breached terms and conditions.
Control and predict spend. Unexpected problems related to software assets and licenses can significantly impact cash flow.
Less operational interruptions. Poor software asset management processes could lead to failed deployments, software update interruptions, viruses, or a shutdown of unlicensed applications.
Avoid security breaches. If data is not secure through software patches and security, confidential information may be disclosed.
More informed decisions. More accurate data on software assets improves transparency and informs decision making.
Improved contract management. Automated tools can alert you to when contracts are up for renewal to allow time to plan and negotiate, then purchase the right amount of licenses.
Avoid penalties. Conduct internal audits and track compliance to avoid fees or penalties if an external audit occurs.
Reduced IT support. Employees should require less support from the service desk with proper, up to date, licensed software, freeing up time for IT Operations to focus on other work.
Enhanced productivity. By rationalizing and standardizing software offerings, more staff should be using the same software with the same versioning, allowing for better communication and collaboration.
|
Configuration Management
76% more effective |
|
Service Catalog
74% more effective |
|
Quality Management
63% more effective |
|
Data Quality
62% more effective |
|
Performance Measurement
61% more effective |
|
Organizational Change Management
60% more effective |
|
Portfolio Management
59% more effective |
|
Enterprise Architecture
58% more effective |
Why? Good SAM processes are integral to both service management and configuration management
(Source: Info-Tech Research Group, IT Management and Governance Diagnostic; N=972 organizations) (High asset management effectiveness was defined as those organizations with an effectiveness score of 8 or above.)Focus on software asset management essentials
| Phase 1 Assess & Plan |
Phase 2 Procure, Receive & Deploy |
Phase 3 Manage, Redeploy & Retire |
Phase 4 Build supporting processes |
||||
1.1 |
Assess current state |
2.1 |
Request & procure |
3.1 |
Manage & maintain contracts |
4.1 |
Compliance & audits |
1.2 |
Build team and define metrics |
2.2 |
Receive & deploy |
3.2 |
Harvest or retire |
4.2 |
Communicate & build roadmap |
1.3 |
Plan & budget | ||||||
| Deliverables | |||||||
| Standard Operating Procedures (SOP) | |||||||
| SAM maturity assessment | Process workflows | Process workflows | Audit response templates | ||||
| RACI chart | Software standards | Patch management policy | Communication plan & FAQ template | ||||
| SAM metrics | SAM policies | ||||||
| SAM budget workbook | |||||||
Visa, Inc. is the largest payment processing company in the world, with a network that can handle over 40,000 transactions every minute.
In 2006, Visa launched a formal IT asset management program, but it was not until 2011 that it initiated a focus on SAM. Joe Birdsong, the SAM director, first addressed four major enterprise license agreements (ELAs) and compliance issues. The SAM team implemented a few dedicated SAM tools in conjunction with an aggressive approach to training.
The proactive approach taken by Visa used a three-pronged strategy: people, process, and tools. The process included ELA negotiations, audit responses, and software license rationalization exercises.
According to Birdsong, “In the past three years, SAM has been credited with saving Visa over $200 million.”
SAM Standard Operating Procedures (SOP) |
SAM Maturity Assessment |
SAM Visio Process Workflows |
SAM Budget Workbook |
Additional SAM Policy Templates |
Software Asset Management Policy |
SAM Communication Plan |
SAM FAQ Template |
| GI | Measured Value (Assuming 260 workdays in a year) |
|---|---|
| Phase 1: Assess & Plan |
|
| Phase 2: Procure, Receive & Deploy |
|
| Phase 3: Manage, Redeploy & Retire |
|
| Phase 4: Build Supporting Processes and Tools |
|
| Total savings | $330,325 |
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
| Phase 1: Assess & plan | Phase 2: Procure, receive & deploy | Phase 3: Manage, redeploy & retire | Phase 4: Build supporting processes | |
|---|---|---|---|---|
Best-Practice Toolkit
|
Step 1.1: Assess current state Step 1.2: Build team and define metrics Step 1.3: Plan and budget |
Step 2.1: Request and procure Step 2.2: Receive and deploy |
Step 3.1: Manage and maintain contracts Step 3.2: Harvest, redeploy, or retire |
Step 4.1: Compliance and audits Step 4.2: Communicate and build roadmap |
| Guided Implementations |
|
|
|
|
Onsite Workshop
|
Module 1:
Assess & Plan |
Module 2:
Map Core Processes: Procure, Receive & Deploy |
Module 3:
Map Core Processes: Manage, Redeploy & Retire |
Module 4:
Prepare for audit, build roadmap and communications |
Contact your account representative or email Workshops@InfoTech.com for more information.
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | |
|---|---|---|---|---|
| Activities |
Assess & Plan1.1 Outline SAM challenges and objectives 1.2 Assess current state 1.3 Identify roles and responsibilities for SAM team 1.4 Identify metrics and reports 1.5 Identify SAM functions to centralize vs. decentralize 1.6 Plan SAM budget process |
Map Core Processes: Procure, Receive & Deploy2.1 Determine software standards 2.2 Define procurement process for new contracts 2.3 Define process for contract renewals and additional procurement scenarios 2.4 Design process for receiving software 2.5 Design deployment workflow 2.6 Define process for non-standard software requests |
Map Core Processes: Manage, Redeploy & Retire3.1 Define process for conducting software inventory 3.2 Define policies for software maintenance and patches 3.3 Map software license harvest and reallocation process 3.4 Define policy for retiring software |
Build Supporting Processes4.1 Define and document the internal audit process 4.2 Define and document the external audit process 4.3 Develop a communication plan 4.4 Prepare an FAQ list 4.5 Identify SAM policies 4.6 Develop a SAM roadmap to plan your implementation |
| Deliverables |
|
|
|
|
Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.
This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.
This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.
Visa implemented an IT asset management program in 2006. After years of software audit teams from large firms visiting and leaving expensive software compliance bills, the world’s leading payment processing company decided it was time for a change.
Upper management recognized that it needed to combat audits. It had the infrastructure in place and the budget to purchase SAM tools that could run discovery and tracking functions, but it was lacking the people and processes necessary for a mature SAM program.
Visa decided to fight fire with fire. It initially contracted the same third-party audit teams to help build out its SAM processes. Eventually, Visa formed a new SAM team that was led by a group of former auditors.
The former auditors recognized that their role was not technology based, so a group of technical individuals were hired to help roll out various SAM tools.
The team rolled out tools like BDNA Discover and Normalize, Flexera FlexNet Manager, and Microsoft SCCM.
To establish an effective SAM team, diverse talent is key. Visa focused on employees that were consultative but also technical. Their team needed to build relationships with teams within the organization and externally with vendors.
Most importantly, the leaders of the team needed to think like auditors to better prepare for audits. According to Joe Birdsong, SAM Director at Visa, “we want to be viewed as a team that can go in and help right-size their environment and better understand licensing to help teams make better decisions.”
The SAM team was only the beginning.
| Phase 1: Assess & Plan | This step will walk you through the following activities: | This step involves the following participants: | |
1.1 | Assess current state |
|
|
1.2 | Build team and define metrics | ||
1.3 | Plan & budget | ||
Participants: CIO/CFO, IT Director, Asset Manager, Purchasing, Service Desk Manager, Security (optional), Operations (optional)
| Drivers of effective SAM | Results of effective SAM | |
| Contracts and vendor licensing programs are complex and challenging to administer without data related to assets and their environment. | → | Improved access to accurate data on contracts, licensing, warranties, installed software for new contracts, renewals, and audit requests. |
| Increased need to meet compliance requires a formal approach to tracking and managing assets. | → | Encryption, software application controls, and change notifications all contribute to better asset controls and data security. |
| Cost cutting is on the agenda, and management is looking to reduce overall IT spend in the organization in any possible way. | → | Reduction of software spend through data for better forecasting, planning, and licensing rationalization and harvesting. |
| Audits are time consuming, disruptive to project timelines and productivity, and costly. | → | Respond to audits with a formalized process, accurate data, and minimal disruption using always-available reporting. |
Participants: CIO/CFO, IT Director, Asset Manager, Service Manager (optional)
Document: Document in the Standard Operating Procedures.
By improving how you manage your licenses and audit requests, you will not only provide benefits through a mature SAM program, you will also improve your service desk and disaster recovery functions.
| Maturity | People & Policies | Processes | Technology |
|---|---|---|---|
| Chaos |
|
|
|
| Reactive |
|
|
|
| Controlled |
|
|
|
| Proactive |
|
|
|
| Optimized |
|
|
|
| Phase 1: Assess & Plan | This step will walk you through the following activities: | This step involves the following participants: | |
1.1 | Assess current state |
|
|
1.2 | Build team and define metrics | ||
1.3 | Plan & budget | ||
Roles and responsibilities should be adapted to fit specific organizational requirements based on its size, structure, and distribution and the scope of the program. Not all roles are necessary and in small organizations, one or two people may fulfill multiple roles.
Senior Management Sponsor – Ensures visibility and support for the program.
IT Asset Manager – Responsible for management of all assets and maintaining asset database.
Software Asset Manager – Responsible for management of all software assets (a subset of the overall responsibility of the IT Asset Manager).
SAM Process Owner – Responsible for overall effectiveness and efficiency of SAM processes.
Asset Analyst – Maintains up-to-date records of all IT assets, including software version control.
Many organizations simply do not have a large enough staff to hire a full-time software asset manager. The role will need to be championed by an internal employee.
Avoid filling this position with a temporary contract; one of the most difficult operational factors in SAM implementation and continuity is constant turnover and organizational shifts. Hiring a software asset manager on contract might get the project going faster, but without the knowledge gained by doing the processes, the program won’t have enough momentum to sustain itself.
Make sure your SAM team is diverse. The SAM team will need to be skilled at achieving compliance, but there is also a need for technically skilled individuals to maximize the function of the SAM tool(s) at your organization.
1.2.1 Complete a RACI chart for your organization
Participants: CIO/CFO, IT Director, SAM Manager, SAM Team, Service Desk Manager
Document: Document in the Standard Operating Procedures.
Determine the roles and responsibilities for your SAM program. Record the results in a RACI (responsible, accountable, consulted, informed) chart such as the example below.
| SAM Processes and Tasks | CIO | CFO | SAM Manager | IT Director | Service Management Team | IT Ops | Security | Finance | Legal | Project Manager |
|---|---|---|---|---|---|---|---|---|---|---|
| Policies/Governance | A | C | R | R | I | I | C | I | R | I |
| Strategy | A | C | R | R | I | I | I | I | C | |
| Risk Management/Asset Security | A | C | R | R | C | R | C | C | C | |
| Data Entry/Quality | I | I | A | R | R | |||||
| Compliance Auditing | R | C | A | R | I | I | I | I | ||
| Education & Training | R | I | A | C | I | I | ||||
| Contract Lifecycle Management | R | R | A | R | C | C | C | C | R | C |
| Workflows | R | C | A | R | I | I | I | R | I | C/I |
| Budgeting | R | R | R | A | C | R | ||||
| Software Acquisition | R | I | A | R | I | C | R | C | C | |
| Controls/Reporting | R | I | A | R | I | I | C | I | ||
| Optimize License Harvesting | I | I | A | R | I | C | C |
Trying to achieve goals without metrics is like trying to cook without measuring your ingredients. You might succeed, but you’ll have no idea how to replicate it.
The metrics you track depend on your maturity level. As your organization shifts in maturity, the metrics you prioritize for tracking will shift to reflect that change. Example:
| Metric category | Low maturity metric | High maturity metric |
|---|---|---|
| Compliance | % of software installed that is unauthorized | % of vendors in effective licensing position (ELP) report |
| Quantity | % of licenses documented in ITAM tool | % of requests made through unauthorized channels |
CSF = Goal, or what success looks like
KPI = How achievement of goal will be defined
Metric = Numerical measure to determine if KPI has been achieved
| CSF/Goal | KPI | Metrics |
|---|---|---|
| Improve accuracy of software budget and forecasting |
|
|
| Avoid over purchasing software licenses and optimize use of existing licenses |
|
|
| Improve accuracy of data |
|
|
| Improved service delivery |
|
|
1.2.2 Brainstorm metrics and KPIs
Participants: CIO, IT Director, SAM Manager, SAM Team
Document: Document in the Standard Operating Procedures.
Use the table below as an example.
| Goal/CSF | KPI | Metric |
|---|---|---|
| Improve license visibility | Increase accuracy and completeness of SAM data |
|
| Reduce software costs | Reduce number of unused software licenses by 20% |
|
| Reduce shadow IT | Reduce number of unauthorized software purchases and installations by 10% |
|
Asset managers require data to manage how licenses are distributed throughout the organization. Are there multiple versions of the same application deployed? What proportion of licenses deployed are assigned to employees who are no longer at the organization? What are the usage patterns for applications?
Service desk technicians need real-time data on licenses currently available to deploy to machines that need to be imaged/updated, otherwise there is a risk of breaching a vendor agreement.
Business managers and executives need reports to make strategic decisions. The reports created for business stakeholders need to help them align business projects or business processes with SAM metrics. To determine which reports will provide the most value, start by looking at business goals and determining the tactical data that will help inform and support these goals and their progress.
1.2.3 Identify reports and metrics to track regularly
Participants: CIO, IT Director, SAM Manager, SAM Team
Document: Document in the Standard Operating Procedures.
Example:
| Stakeholder | Purpose | Report | Frequency |
|---|---|---|---|
| Asset Manager |
|
Operational budget spent to date | Monthly |
| Capital budget spent to date | Monthly | ||
| Contracts coming due for renewal | Quarterly | ||
| Software harvested for redeployment | Quarterly | ||
| Number of single applications being managed | Annually | ||
| CFO |
|
Software purchased, operational & capital | Monthly |
| Software accrued for future purchases | Monthly | ||
Contracts coming due for renewal
|
Quarterly | ||
| CIO |
|
Software deployments and redeployments | Monthly |
| Software rollouts planned | Quarterly | ||
| % of applications patched | Quarterly | ||
| Money saved | Annually | ||
| Number of contracts & apps managed | Quarterly |
| Phase 1: Assess & Plan | This step will walk you through the following activities: | This step involves the following participants: | |
1.1 | Assess current state |
|
|
1.2 | Build team and define metrics | ||
1.3 | Plan & budget | ||
Many infrastructure managers and business managers are unaware of how software licensing can impact projects. For example, changes in core infrastructure configuration can have big impacts from a software licensing perspective.
1.3.1 Identify functions for centralization
Participants: CIO, IT Director, SAM Manager, SAM Team
Document: Document in the Standard Operating Procedures.
Example:
Centralized Functions
|
Decentralized functions
|
After employee salaries (38%), the four next largest spend buckets have historically been infrastructure related. Adding salaries and external services, the average annual infrastructure and operations spend is over 50% of all IT spend.
The largest portion of that spend is on software license and maintenance. As of 2016, software accounted for the roughly the same budget total as voice communications, data communications, and hardware combined. Managing software contracts is a crucial part of any mature budgeting process.
A sophisticated software asset management program will be able to uncover hidden costs, identify opportunities for rationalization, save money through reharvesting unused licenses, and improve forecasting of software usage to help control IT spending.
While some asset managers may not have experience managing budgets, there are several advantages to the ITAM function owning the budget:
Finance needs to be involved. Their questions may cover:
The SAM Budget Workbook is designed to assist in developing and justifying the budget for software assets for the upcoming year.
|
|
1.1.3 |
|
Determine the maturity of your SAM program
Using the SAM Maturity Assessment Tool, fill out a series of questions in a survey to assess the maturity of your current SAM program. The survey assesses seven categories that will allow you to align your strategy to your results. |
1.2.3 |
|
Define SAM reports to track metrics
Identify key stakeholders with reporting needs, metrics to track to fulfill reporting requirements, and a frequency for producing reports. |
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 1.1: Assess current state | Step 1.2: Build team and define metrics | Step 1.3: Plan and budget |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
With these tools & templates:
|
Visa formed a SAM team in 2011 to combat costly software audits.
The team’s first task was to use the available SAM data and reconcile licenses deployed throughout the organization.
Organizations as large as Visa constantly run into issues where they are grossly over or under licensed, causing huge financial risk.
Data collection and analysis were used as part of the license rationalization process. Using a variety of tools combined with a strong team allowed Visa to perform the necessary steps to gather license data and analyze usage.
One of the key exercises was uniting procurement and deployment data and the teams responsible for each.
End-to-end visibility allowed the data to be uniform. As a result, better decisions about license rationalization can be made.
By improving its measurement of SAM data, Visa was able to dedicate more time to analyze and reconcile its licenses. This led to improved license management and negotiations that reflected actual usage.
By improving license usage through rationalization, Visa reduced the cost of supporting additional titles.
The SAM team also performed license reclamation to harvest and redistribute licenses to further improve usage. The team’s final task was to optimize audit responses.
| Phase 2: Procure, Receive & Deploy | This step will walk you through the following activities: | This step involves the following participants: | |
2.1 | Request & Procure |
|
|
2.2 | Receive & Deploy | ||
Procurement and SAM must collaborate on software purchases to ensure software purchases meet business requirements and take into account all data on existing software and licenses to optimize the purchase and contract. Failure to work together can lead to unnecessary software purchases, overspending on purchases, and undesirable contract terms.
SAM managers must collaborate with Procurement when purchasing software.
SAM managers should:
|
|
Procurement must commit to be involved in the asset management process.
Procurement should:
|
Centralized negotiation and purchasing of software can ensure that the SAM team has visibility and control over the procurement process to help prevent overspending and uncontrolled agreements.
It may be necessary to procure some software locally if organizations have multiple locations, but try to centrally procure and manage the biggest contracts from vendors that are likely to audit the organization. Even with a decentralized model, ensure all teams communicate and that contracts remain visible centrally even if managed locally.
One of the major challenges involved in implementing SAM is uniting multiple datasets and data sources across the enterprise. A conversation with each major business unit will help with the creation of software procurement standards that are acceptable to all.
2.1.1 Identify central standard enterprise offerings
Participants: CIO, IT Director, SAM Manager, SAM Team
Document: Document in the Standard Operating Procedures.
Standard enterprise offerings
|
Localized or non-standard software |
The more prestigious the asset tier, the higher the degree of data capture, support, and maintenance required.
E.g. An enterprise application that needs to be available 24/7, such as a learning management system, should be classified as a gold tier to ensure it has 24/7 support.
2.1.2 Identify standard software images for your organization
Participants: Asset Manager, Purchasing, Service Desk Manager, Operations (optional)
Document: Document in the Standard Operating Procedures.
Not everyone is ready to embrace the cloud for all solutions; make sure to align cloud strategy to business requirements. Work closely with IT executives to determine appropriate contract terms, licensing options, and tracking processes.
Vendors make changes to bundles and online services terms on a regular basis. Ensure you document your agreed upon terms to save your required functionality as vendor standard offerings change.
Download the Own the Cloud: Strategy and Action Plan blueprint for more guidance
| Licensed | Open Source | Shareware | |
|---|---|---|---|
| License Structure | A software supplier is paid for the permission to use their software. | The software is provided free of charge, but is still licensed. | The software is provided free of charge, but is still licensed. Usage may be on a trial basis, with full usage granted after purchase. |
| Source Code | The source code is still owned by the supplier. | Source code is provided, allowing users to change and share the software to suit their needs. | Source code is property of the original developer/supplier. |
| Technical Support | Technical support is included in the price of the contract. | Technical support may be provided, often in a community-based format from other developers of the open-source software in question. | Support may be limited during trial of software, but upgraded once a purchase is made. |
Open-source software should be managed in the same manner as commercial software to understand licensing requirements and be aware of any changes to these agreements, such as commercialization of such products, as well as any rules surrounding source code.
2.1.3 Define procurement policy
Participants: Asset Manager, Purchasing, Service Desk Manager, Operations (optional)
Document: Document in the Standard Operating Procedures.
Define and document policies that will apply to IT software purchases, including policies around:
Use the example below as guidance and document in the SOP.
2.1.4 Identify financial thresholds for approvals and requests
Participants: Asset Manager, Purchasing, CIO, CFO, IT Director
Document: Document in the Standard Operating Procedures.
Identify and classify financial thresholds for contracts requiring approval. For each category of contract value, identify who needs to authorize the request. Discuss and document any other approvals necessary. An example is provided below.
Example:
Requests for authorization will need to be directed based on the following financial thresholds:
| Contract value | Authorization |
|---|---|
| <$50,000 | IT Director |
| $50,000 to $250,000 | CIO |
| $250,000 to $500,000 | CIO and CFO |
| >$500,000 | Legal review |
A poorly defined software procurement workflow can result in overspending on unnecessary software licensing throughout the year. This can impact budgeting and any potential software refreshes, as businesses will often rely on purchasing what they can afford, not what they need.
The procurement workflow may involve the Service Desk, procurement team, and asset manager.
The following elements should be accounted for:
2.1.5 Build new contract procurement workflow
Participants: Asset Manager, Purchasing, Service Desk Manager, Operations (optional)
Document: Document in the Standard Operating Procedures.
Additionally, information regarding what licenses are being used for certain services may yield insight into potential redundancies. For example, two separate departments may have each have a different application deployed that supports the same service. This presents an opportunity for savings based on bulk licensing agreements, not to mention a simplified support environment by reducing the number of titles deployed in your environment.
Participants: IT Director/CIO, Asset Manager, Purchasing, Service Desk Manager, Operations (optional)
Document: Document in the Standard Operating Procedures.
2.1.6 Build additional procurement workflows
Participants: Asset Manager, Purchasing, Service Desk Manager, Operations (optional)
Document: Document in the Standard Operating Procedures.
Build procurement workflows and define policies and procedures for additional purchasing scenarios beyond new contracts.
This may include:
Use the sample workflows in the Standard Operating Procedures as a guide.
Contract negotiations too often come down to a question of price. While you want to avoid overpaying for licenses, a worse offense is getting a steep discount for a bundle of applications where the majority will go unused.
| Vendors will try to sell a full stack of software at a steep discount to give the illusion of value. Often organizations bite off more than they can chew. | → | When auditors come knocking, the business may be in compliance, but being over-licensed is a dangerous state to be in. | → | Organizations end up over-licensed and in possession of numerous “shelfware” apps that sit on the proverbial shelf collecting dust while drawing expensive maintenance and licensing fees from the business. |
Leverage Info-Tech’s research, Master Contract Review and Negotiation for Software Agreements, to review your software contracts to leverage your unique position during negotiations and find substantial cost savings.
| Phase 2: Procure, Receive & Deploy | This step will walk you through the following activities: | This step involves the following participants: | |
2.1 | Request & Procure |
|
|
2.2 | Receive & Deploy | ||
While most software will be received through email and download, in some cases physical software may be received through courier or mail. Ensure processes and procedures are defined for both cases.
All licenses, documentation, and digital media for authorized and supported software should be collected and stored in a central, secure location to minimize risk of theft, loss, or unauthorized installation or duplication of software.
The ITAM database should contain an up-to-date record of all software assets, including their associated:
The database allows you to view software that is installed and associated licenses.
A definitive media library (DML) is a single logical storage area, which may consist of one or more locations in which definitive authorized versions of all software configuration items are securely stored and protected.
The DML consists of file storage as well as physical storage of CDs and DVDs and must be continually updated to contain the latest information about each configuration item.
The DML is used to organize content and link to automated deployment to easily install software.
The DML will usually contain the most up-to-date versions to minimize errors created by having unauthorized, old, or problematic software releases being deployed into the live IT environment. The DML can be used for both full-packed product (FPP) software and in-house developed software, providing formalized data around releases of in-house software.
Your DML should have a way to separate archived, new, and current software to allow for optimal organization of files and code, to ensure the correct software is installed, and to prepare for automated deployment through the service catalog.
New software hasn’t been tested yet. Make it available for testing, but not widely available.
Keep a record for archived software, but do not make it available for install.
Current software is regularly used and should be available for install.
2.2.1 Identify software storage locations
Participants: Asset Manager, IT Director
Document: Document in the Standard Operating Procedures.
2.2.2 Design the workflow for receiving software
Participants: Asset Manager, Purchasing, Service Desk Manager, Operations (optional)
Document: Document in the Standard Operating Procedures.
Releases: A collection of authorized changes to an IT service. Releases are divided into:
Define the process for deploying software to users.
Include the following in your workflow:
Rollouts or upgrades of large quantities of software will likely be managed as projects.
These projects should include project plans, including resources, timelines, and detailed procedures.
Define the process for large-scale deployment if it will differ from the regular deployment process.
2.2.3 Document deployment workflows for desktop and large-scale deployment
Participants: Asset Manager, Service Desk Manager, Release & Deployment Manager
Document: Document in the Standard Operating Procedures.
Software should be approved and deployed based on approved standards to minimize over-deployed software and manage costs appropriately. A list of standard software improves the efficiency of the software approval process.
Additionally, create a list of unauthorized software including titles not to be installed under any circumstances. This list should be designed with feedback from your end users and technical support staff. Front-line knowledge is crucial to identifying which titles are causing major problems.
2.2.4 Determine software categories for deployment
Participants: IT Director, Asset Manager, Purchasing (optional), Service Desk Manager (optional), Release & Deployment Manager (optional)
Document: Document in the Standard Operating Procedures.
| Category | Definition | Software titles |
|---|---|---|
| Pre-approved/standard |
|
|
| Approved by role |
|
|
| Unapproved/requires review |
|
|
| Unauthorized |
|
|
Software requiring review will need to be managed on a case-by-case basis, with approval dependent on software evaluation and business need.
The evaluation and approval process may require input from several parties, including business analysts, Security, technical team, Finance, Procurement, and the manager of the requestor’s department.
2.2.5 Document process for non-standard software requests
Participants: Asset Manager, Service Desk Manager, Release & Deployment Manager
Document: Document in the Standard Operating Procedures.
Define the review and approval process for non-standard software requests.
Use the workflow on the previous slide as a guide to map your own workflow process and document the steps in the Standard Operating Procedures.
The following assessments may need to be included in the process:
BMW is a large German automotive manufacturer that employs over 100,000 people. It has over 7,000 software products deployed across 106,000 clients and servers in over 150 countries.
When the global recession hit in 2008, the threat of costly audits increased, so BMW decided to boost its SAM program to cut licensing costs. It sought to centralize inventory data from operations across the globe.
A new SAM office was established in 2009 in Germany. The SAM team at BMW began by processing all the accumulated license and installation data from operations in Germany, Austria, and the UK. Within six months, the team had full visibility of all licenses and software assets.
Compliance was also a priority. The team successfully identified where they could make substantial reductions in support and maintenance costs as well as remove surplus costs associated with duplicate licensing.
BMW overcame a massive data centralization project to achieve 100% visibility of its global licensing estate, an incredible achievement given the scope of the operation.
BMW experienced efficiency gains due to transparency and centralized management of licenses through the new SAM office.
Additionally, internal investment in training and technical knowledge has helped BMW continuously improve the program. This has resulted in ongoing cost reductions for the manufacturer.
|
|
2.1.5 |
|
Build software procurement workflow for new contracts
Use the sample workflow to document your own process for procurement of new software contracts. |
2.2.4 |
|
Create a list of pre-approved, approved, and unapproved software titles
Build definitions of software categories to inform software standards and brainstorm examples of each category. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 2.1: Request and procure | Step 2.2: Receive and deploy |
Start with an analyst kick-off call:
| Review findings with analyst:
|
Then complete these activities…
| Then complete these activities…
|
With these tools & templates:
| With these tools & templates:
|
| Phase 3: Manage, Redeploy & Retire | This step will walk you through the following activities: | This step involves the following participants: | |
3.1 | Manage & Maintain Software |
|
|
3.2 | Harvest, Redeploy, or Retire | ||
Many organizations fail to track their software inventory effectively; the focus often remains on hardware due to its more tangible nature. However, annual software purchases often account for a higher IT spend than annual hardware purchases, so it’s important to track both.
Have and maintain a list of supported software to guide what new software will be approved for purchase and what current software should be retained on the desktops, servers, and other processing devices.
A baseline inventory tells you exactly what software you have deployed and where it is being used. This can help to determine how to best optimize software and license usage.
A software inventory will allow you to:
Take preventive action to avoid unauthorized software usage through regular software inventory and license management:
3.1.1 Define process for regular software inventory
Participants: IT Director, Asset Manager
Document: Document in the Standard Operating Procedures.
While maintenance efforts are typically focused around hardware, software maintenance – including upgrades and patches – must be built into the software asset management process to ensure software remains compliant with security and regulatory requirements.
The integration between patch management and asset management is incredibly valuable from a technology point of view. IT asset management (ITAM) tools create reports on the characteristics of deployed software. By combining these reports with a generalized software updater, you can automate most simple patches to save your team’s efforts for more-critical incidents. Usage reports can also help determine which applications should be reviewed and removed from the environment.
3.1.2 Define software maintenance and patching policies
Participants: IT Director, Asset Manager, Release Manager (optional), Security (optional)
Document: Document in the Standard Operating Procedures.
Review the software maintenance guidelines in this section and in the SOP template. Discuss each policy and revise and document in accordance with your policies.
Discuss and document patch management policies:
The patch management policy helps to ensure company computers are properly patched with the latest appropriate updates to reduce system vulnerability and to enhance repair application functionality. The policy aids in establishing procedures for the identification of vulnerabilities and potential areas of functionality enhancements, as well as the safe and timely installation of patches. The patch management policy is key to identifying and mitigating any system vulnerabilities and establishing standard patch management practices.
Use Info-Tech’s Patch Management Policy template to get started.
| Phase 3: Manage, Redeploy & Retire | This step will walk you through the following activities: | This step involves the following participants: | |
3.1 | Manage & Maintain Software |
|
|
3.2 | Harvest, Redeploy, or Retire | ||
Unused software licenses are present in nearly every organization and result in wasted resources and software spend. Recycling and reharvesting licenses is a critical process within software asset management to save your organization money.
When computers are no longer in use and retired, the software licenses installed on the machines may be able to be reused.
License recycling involves reusing these licenses on machines that are still in use or for new employees.
License harvesting involves more actively identifying machines with licenses that are either not in use or under utilized, and recovering them to be used elsewhere, thus reducing overall software spend on new licenses.
Know the stipulations of your end-user license agreement (EULA) before harvesting and reallocating licenses. There may be restrictions on how often a license can be recycled in your agreement.
Define a standard reharvest timeline. For example, every 90 days, your SAM team can perform an internal audit using your SAM tool to gather data on software usage. If a user has not used a title in that time period, your team can remove that title from that user’s machine. Depending on the terms and conditions of the contract, the license can either be retired or harvested and reallocated.
Ensure you have exception rules built in for software that’s cyclical in its usage. For example, Finance may only use tax software during tax season, so there’s no reason to lump it under the same process as other titles.
It’s important to note that in addition to this process, you will need a software usage policy that supports your license harvest process.
3.2.1 Build license harvest and reallocation workflow
Participants: IT Director, Asset Manager, Service Desk Manager
Document: Document in the Standard Operating Procedures.
“Time and time again, I keep hearing stories from schools on how IT budgets are constantly being squeezed, but when I dig a little deeper, little or no effort is being made on accounting for software that might be on the kit we are taking away.” (Phil Goldsmith, Managing Director – ScrumpyMacs)
3.2.2 Document process for software retirement
Participants: IT Director, Asset Manager, Operations
Document: Document in the Standard Operating Procedures.
![]() |
|
3.1.2 |
|
Define policies for software maintenance and patches
Discuss best practices and define policies for conducting regular software maintenance and patching. |
3.2.1 |
|
Map your software license harvest and reallocation process
Build a process workflow for harvesting and reallocating unused software licenses. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 3.1: Manage and maintain software | Step 3.2: Harvest, redeploy, or retire |
Start with an analyst kick-off call:
| Review findings with analyst:
|
Then complete these activities…
| Then complete these activities…
|
With these tools & templates:
| With these tools & templates:
|
The overarching goal of any SAM program is compliance to prevent costly audit fines. The SAM team at Visa was made up of many individuals who were former auditors.
To deal with audit requests from vendors, “understand how auditors do things and understand their approach,” states Joe Birdsong, SAM Director at Visa.
Vendors are always on the lookout for telltale signs of a lucrative audit. For Visa, the key was to understand these processes and learn how to prepare for them.
Vendors typically look for the following when evaluating an organization for audit:
Ultimately, an audit is an attack on the relationship between the vendor and organization. According to Birdsong: “Maybe they haven’t really touched base with your teams and had good contact and relationship with them, and they don’t really know what’s going on in your enterprise.”
By understanding the motivations behind potential audits, Visa was able to form a strategy to increase transparency with the vendor.
Regular data collection, almost real-time reporting, and open, quick communication with the vendor surrounding audits made Visa a low-risk client for vendors.
Buy-in from management is also important, and the creation of an official SAM strategy helps maintain support. Thanks to its proactive SAM program, Visa saved $200 million in just three years.
| Phase 4: Build supporting processes & tools | This step will walk you through the following activities: | This step involves the following participants: | |
4.1 | Compliance & audits |
|
|
4.2 | Communicate & build roadmap | ||
By improving your software asset management program’s maturity, you will drive savings for the business that go beyond the negotiating table.
Recognize the classic signs of each stage of audit response maturity to identify where your organization currently stands and where it can go.
Being prepared for an audit is critical. Internal preparation will not only help your organization reduce the risk associated with an audit but will also improve daily operations through focusing on diligent documentation and data collection.
Conducting routine internal audits will help prepare your organization for the real deal and may even prevent the audit from happening altogether. Hundreds of thousands of dollars can be saved through a proactive audit strategy with routine documentation in place.
“You want to get [the] environment to a level where you’re comfortable sharing information with [a] vendor. Inviting them in to have a chat and exposing numbers means there’s no relationship there where they’re coming to audit you. They only come to audit you when they know there’s a gain to be had, otherwise what’s the point of auditing?
I want customers to get comfortable with licensing and what they’re spending, and then there’s no problem exposing that to vendors. Vendors actually appreciate that.” (Ben Brand, SAM Practice Manager, Insight)
“The supreme art of war is to subdue the enemy without fighting.” – Sun Tzu
Performing routine checks on your license compliance will drastically reduce the risk that your organization gets hit with a costly fine. Maintaining transparency and demonstrating compliance will fend off audit-hungry vendors.
4.1.1 Document process and procedures for internal audits
Participants: CIO and/or IT Director, Asset Manager, IT Managers
Document: Document in the Standard Operating Procedures.
Define and document a process for conducting internal software audits.
Include the following:
Example:
Being prepared for an audit is critical. Internal preparation will not only help your organization reduce the risk associated with an audit but will also improve daily operations through focusing on diligent documentation and data collection.
Certain triggers exist that indicate a higher risk of an audit occurring. It is important to recognize these warning signs so you can prepare accordingly.
Health of organization
If your organization is putting out fires and a vendor can sense it, they’ll see an audit as a highly lucrative exercise.
Decrease in customer spend
A decrease in spend means that an organization has a high chance of being under-licensed.
License complexity
The more complex the license, the harder it is to remain in compliance. Some vendors are infamous for their complex licensing agreements.
Taking these due diligence steps will pay dividends downstream, reducing the risk of negative results such as release of confidential information.
Even if you cannot get a third-party NDA signed, the negotiation process should delay the overall audit process by at least a month, buying your organization valuable time to gather license data.
4.1.2 Define external audit process
Participants: CIO and/or IT Director, Asset Manager, IT Managers
Document: Document in the Standard Operating Procedures.
Define and document a process for responding to external software audit requests.
Include the following:
Use the Software Audit Scoping Email Template to create an email directed at your external (or internal) auditors. Send the audit scoping email several weeks before an audit to determine the audit’s scope and objectives. The email should include:
The email will help focus your preparation efforts and initiate your relationship with the auditors.
Approximately a week before the audit, you should email the internal leadership to communicate information about the start of the audit. Use the Software Audit Launch Email Template to create this email, including:
For more guidance on preparing for a software audit, see Info-Tech’s blueprint: Prepare and Defend Against a Software Audit.
A large American financial institution with 1,300 banking centers in 12 states, 28,000 end users, and 108,000 assets needed to improve its asset management program.
The bank had employed numerous ITAM tools, but IT staff identified that its asset data was still fragmented. There was still incomplete insight into what assets the banked owned, the precise value of those assets, their location, and what they’re being used for.
The bank decided to establish an asset management program that involved internal audits to gather more-complete data sets.
With the help of a vendor, the bank implemented cradle-to-grave asset tracking and lifecycle management, which provided discovery of almost $80 million in assets.
The bank also assembled an ITAM team and a dedicated ITAM manager to ensure that routine internal audits were performed.
The team was instrumental in establishing standardization of IT policies, hardware configuration, and service requirements.
| Phase 4: Build supporting processes & tools | This step will walk you through the following activities: | This step involves the following participants: | |
4.1 | Compliance & audits |
|
|
4.2 | Communicate & build roadmap | ||
Communication is crucial to the integration and overall implementation of your SAM program. If staff and users do not understand the purpose of processes and policies, they will fail to provide the desired value.
An effective communication plan will:
Why:
|
|
When:
|
Participants: CIO, IT Director, Asset Manager, Service Desk Manager
Document: Document in the SAM Communication Plan.
| Group | Benefits | Impact | Method | Timeline |
|---|---|---|---|---|
| Executives |
|
|
||
| End Users |
|
|
||
| IT |
|
|
Document: Document FAQ questions and answers in the SAM FAQ Template.
ITAM imposes changes to end users throughout the business and it’s normal to expect questions about the new program. Prepare your team ahead of time by creating a list of FAQs.
Use policy templates to jumpstart your policy development and ensure policies are comprehensive, but be sure to modify and adapt policies to suit your corporate culture or they will not gain buy-in from employees. For a policy to be successful, it must be a living document and have participation and involvement from the committees and departments to whom it will pertain.
Use Info-Tech’s Software Asset Management Policy template to define and document the purpose, scope, objectives, and roles and responsibilities for your organization's software asset management program.
The template allows you to customize policy requirements for:
…as well as consequences for non-compliance.
|
Asset Security Policy
End-User Devices Acceptable Use Policy
Purchasing Policy
Release Management Policy
Internet Acceptable Use Policy
|
|
One of the most difficult decisions to make when implementing a SAM program is: “where do we start?”
It’s not necessary to deploy a comprehensive SAM program to start. Build on the essentials to become more mature as you grow.
To integrate SAM effectively, a clear implementation roadmap needs to be designed. Prioritize “quick wins” to demonstrate success to the business early and to gain buy-in from your team. Short-term gains should be designed to support long-term goals of your SAM program.
| Q1 | Q2 | Q3 | Q4 |
|
|
|
|
Advertising the increased revenue that is gained from good SAM practices is a powerful way to gain project buy-in.
Reflect on the outcomes of implementing SAM to target areas for improvement and share knowledge gained within and beyond the SAM team. Some questions to consider include:
|
|
4.2.1 |
|
Develop a communication plan to convey the right messages
Identify stakeholders requiring communication and formulate a message and delivery method for each. |
4.2.5 |
|
Develop a SAM roadmap to plan your implementation
Outline the tasks necessary for the implementation of this project and prioritize to build a project roadmap. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 4.1: Compliance & audits | Step 4.2: Communicate & build roadmap |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
2013 Software Audit Industry Report.” Express Metrix, 2013. Web.
7 Vital Trends Disrupting Today’s Workplace: Results and Data from 2013 TINYpulse Employee Engagement Survey.” TINYpulse, 2013. Web.
Beaupoil, Christof. “How to measure data quality and protect against software audits.” Network World, 6 June 2011.
Begg, Daniel. “Effective Licence Position (ELP) – What is it really worth?” LinkedIn, 19 January 2016.
Boehler, Bernhard. “Advanced License Optimization: Go Beyond Compliance for Maximum Cost Savings.” The ITAM Review, 24 November 2014.
Bruce, Warren. “SAM Baseline – process & best practice.” Microsoft. 2013 Australia Partner Conference.
Case Study Top 20 U.S. Bank Tackles Asset Management.” Pomeroy, 2012. Web.
Cherwell Software Software Audit Industry Report.” Cherwell Software, 2015. Web.
Conrad, Sandi. “SAM starter kit: everything you need to get started with software asset management. Conrad & Associates, 2010.
Corstens, Jan, and Diederik Van der Sijpe. “Contract risk & compliance software asset management (SAM).” Deloitte, 2012.
Deas, A., T. Markowitzm and E. Black. “Software asset management: high risk, high reward.” Deloitte, 2014.
Doig, Chris. “Why you should always estimate ROI before buying enterprise software” CIO, 13 August 2015.
Fried, Chuck. “America Needs An Education On Software Asset Management (SAM).” LinkedIn. 16 June 2015.
Lyons, Gwen. “Understanding the Drivers Behind Application Rationalization Critical to Success.” Flexera Software Blog, 31 October 2012.
Metrics to Measure SAM Success: eight ways to prove your SAM program is delivering business benefits.” Snow Software White Paper, 2015.
Microsoft. “The SAM Optimization Model.” Microsoft Corporation White Paper, 2010.
Miller, D. and M. Oliver. “Engaging Stakeholders for Project Success.” Project Management Institute White Paper, 2015.
Morrison, Dan. “5 Common Misconceptions of Software Asset Management.” SoftwareOne. 12 May 2015.
O’Neill, Leslie T. “Visa Case Study: SAM in the 21st Century.” International Business Software Managers Association (IBSMA), 30 July 2014.
Reducing Hidden Operating Costs Through IT Asset Discovery.” NetSupport Inc., 2011.
SAM Summit 2014, 23-25 June 2014, University of Chicago Gleacher Center Conference Facilities, Chicago, MI.
Saxby, Heather. “20 Things Every CIO Needs to Know about Software Asset Management.” Crayon Software Experts, 13 May 2015.
The 2016 State of IT: Managing the money monsters for the coming year.” Spiceworks, 2016.
The Hidden Cost of Unused Software.” A 1E Report, 1E.com: 2014. Web.
What does it take to achieve software license optimization?” Flexera White Paper, 2013.
|
Michael Dean
Director, User Support Services Des Moines University |
Simon Leuty
Co-Founder Livingstone Tech |
|
|
Clare Walsh
PR Consultant Adesso Tech Ltd. |
Alex Monaghan
Director, Presales EMEA Product Support Solutions |
|
|
Ben Brand
SAM Practice Manager Insight |
Michael Swanson
President ISAM |
|
|
Bruce Aboudara
SVP, Marketing & Business Development Scalable Software |
Will Degener
Senior Solutions Consultant Scalable Software |
|
|
Peter Gregorowicz
Associate Director, Network & Client Services Vancouver Community College |
Peter Schnitzler
Operations Team Lead Toyota Canada |
|
|
David Maughan
Head of Service Transition Mott MacDonald Ltd. |
Brian Bernard
Infrastructure & Operations Manager Lee County Clerk of Court |
|
|
Leticia Sobrado
IT Data Governance & Compliance Manager Intercept Pharmaceuticals |
Algorithms are becoming more advanced, data is now richer and easier to collect, and hardware is cheaper and more powerful. All of this is true and contributes to the excitement around enterprise AI applications, but the biggest difference today is that enterprises are redesigning their processes around AI, rather than simply adding AI to their existing processes.
This report outlines six emerging ways AI is being used in the enterprise, with four future scenarios outlining their possible trajectories. These are designed to guide strategic decision making and facilitate future-focused ideation.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This report outlines six emerging ways AI is being used in the enterprise, with four future scenarios outlining their possible trajectories. These are designed to guide strategic decision making and facilitate future-focused ideation.
The service desk is a major function within IT. Small enterprises with constrained resources need to look at designing a service desk that enables consistency in supporting the business and finds the right balance of documentation.
Determining the right level of documentation to provide backup and getting the right level of data for good reporting may seem like a waste of time when the team is small, but this is key to knowing when to invest in more people, upgraded technology, and whether your efforts to improve service are successful.
It’s easy to lose sight of the client experience when working as a small team supporting a variety of end users. Changing from a help desk to a service desk requires a focus on what it means to be a customer centric service desk and a change to the way the technicians think about providing support.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This blueprint provides a framework to quickly identify a plan for service desk improvements. It also provides references to build out additional skills and functionality as a continual improvement initiative.
The maturity assessment will provide a baseline and identify areas of focus based on level of current and target maturity.
The SOP provides an excellent guide to quickly inform new team members or contractors of your support approach.
The categorization scheme template provides examples of asset-based categories, resolution codes and status.
This template provides a starting point for building your communications on planned improvements.
The service desk is a major function within IT. Small enterprises with constrained resources need to look at designing a service desk that enables consistency in supporting the business and finds the right balance of documentation.
Evaluate documentation to ensure there is always redundancy built in to cover absences. Determining coverage will be an important factor, especially if vendors will be brought into the organization to assist during shortages. They will not have the same level of knowledge as teammates and may have different requirements for documentation.
It is important to be customer centric, thinking about how services are delivered and communicated with a focus on providing self-serve at the appropriate level for your users and determining what information the business needs for expectation-setting and service level agreements, as well as communications on incidents and changes.
And finally, don’t discount the value of good reporting. There are many reasons to document issues besides just knowing the volume of workload and may become more important as the organization evolves or grows. Stakeholder reporting, regulatory reporting, trend spotting, and staff increases are all good reasons to ensure minimum documentation standards are defined and in use.
![]() |
Sandi Conrad
Principal Research Director Info-Tech Research Group |
| Title | Page | Title | Page |
| Blueprint benefits | 6 | Incident management | 25 |
| Start / Stop / Continue exercise | 10 | Prioritization scheme | 27 |
| Complete a maturity assessment | 11 | Define SLAs | 29 |
| Select an ITSM tool | 13 | Communications | 30 |
| Define roles & responsibilities | 15 | Reporting | 32 |
| Queue management | 17 | What can you do to improve? | 33 |
| Ticket handling best practices | 18 | Staffing | 34 |
| Customer satisfaction surveys | 19 | Knowledge base & self-serve | 35 |
| Categorization | 20 | Customer service | 36 |
| Separate ticket types | 22 | Ticket analysis | 37 |
| Service requests | 23 | Problem management | 38 |
| Roadmap | 39 |
Make the best use of the team
|
Build cross-training into your culture
|
Don’t discount the benefit of good tools
|
Standard Operating Procedures![]() |
Maturity Assessment![]() |
Categorization scheme![]() |
Improvement Initiative![]() |
| Create a standard operating procedure to ensure the support team has a consistent understanding of how they need to engage with the business. | |||
IT benefits
|
Business benefits
|
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is six to ten calls over the course of three to four months.
The current state discussion will determine the path.
What does a typical GI on this topic look like?Current State & Vision |
Best Practices |
Service Requests & Incidents |
Communications |
Next Steps & Roadmap |
| Call #1: Discuss current state & create a vision
Call #2: Document roles & responsibilities |
Call #3:Review and define best practices for ticket handling | Call #4: Review categorization
Call #5: Discuss service requests & self-serve Call #6: Assess incident management processes |
Call #7: Assess and document reporting and metrics
Call #8: Discuss communications methods |
Call #9: Review next steps
Call #10: Build roadmap for updates |
| For a workshop on this topic, see the blueprint Standardize the Service Desk | ||||
Executive Brief Case StudySouthwest CARE Center |
![]() |
INDUSTRY |
Service Desk ProjectAfter relying on a managed service provider (MSP) for a number of years, the business hired Kevin to repatriate IT. As part of that mandate, his first strategic initiative was to build a service desk. SCC engaged Info-Tech Research Group to select and build a structure; assign roles and responsibilities; implement incident management, request fulfilment, and knowledge management processes; and integrate a recently purchased ITSM tool. Over the course of a four-day onsite engagement, SCC’s IT team worked with two Info-Tech analysts to create and document workflows, establish ticket handling guidelines, and review their technological requirements. ResultsThe team developed a service desk standard operating procedure and an implementation roadmap with clear service level agreements. |
Southwest CARE Center (SCC) is a leading specialty healthcare provider in New Mexico. They offer a variety of high-quality services with a focus on compassionate, patient-centered healthcare.
“Info-Tech helped me to successfully rebrand from an MSP help desk to an IT service desk. Sandi and Michel provided me with a customized service desk framework and SOP that quickly built trust within the organization. By not having to tweak and recalibrate my service desk processes through trial and error, I was able to save a year’s worth of work, resulting in cost savings of $30,000 to $40,000.” (Kevin Vigil, Director of Information Technology, Southwest CARE Center) |
|
N=63, small enterprise organizations from the End-User Satisfaction Diagnostic, at December 2021 Dissatisfied was classified as those organizations with an average score less than 7. Satisfied was classified as those organizations with an average score greater or equal to 8. |
|
STOP |
|
START |
|
CONTINUE |
|
| The Service Desk Maturity Assessment tool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.
The tool will help guide improvement efforts and measure your progress.
|
![]() |
Consider service improvements and how those changes can be perceived by the organization. For example, offering multiple platforms, such as adding Macs to end-user devices, could translate to “Providing the right IT solutions for the way our employees want to work.”
To support new platforms, you might need to look at the following steps to get there:
|
Info-Tech InsightIdentify some high-level opportunities and plan out how these changes will impact the way you provide support today. Document steps you’ll need to follow to make it happen. This may include new offerings and product sourcing, training, and research. |
| You don’t need to spend a fortune. Many solutions are free or low-cost for a small number of users, and you don’t necessarily have to give up functionality to save money.
Encourage users to submit requests through email or self-serve to keep organized. Ensure that reporting will provide you with the basics without effort, but ensure report creation is easy enough if you need to add more. Consider tools that do more than just store tickets. ITSM tools for small enterprises can also assist with:
|
|
||||||||||||||||
| Consider engaging a partner for the installation and setup as they will have the expertise to troubleshoot and get you to value quickly.
Even with a partner, don’t rely on them to set up categories, prioritizations, and workflows. If you have unique requirements, you will need to bring your design work to the table to avoid getting a “standard install” that will need to be modified later. When we look at what makes a strong and happy product launch, it boils down to a few key elements:
|
To prepare for a quick time to value in setting up the new ITSM tool, prioritize in this order:
|
|
Note roles in the Incident Management and Service Desk – Standard Operating Procedure Template |
If ticket volume is too high or too dispersed to effectively have teams self-select tickets, assign a queue manager to review tickets throughout the day to ensure they’re assigned and on the technician’s schedule. This is particularly important for technicians who don’t regularly work out of the ticketing system. Follow up on approaching or missed SLAs.
Make sure your queue manager has an accurate escalation list and has the authority to assign tickets and engage with the technical team to manage SLAs; otherwise, SLAs will never be consistently managed.
Accurate data leads to good decisions. If working toward adding staff members, reducing recurring incidents, gaining access to better tools, or demonstrating value to the business, tickets will enable reporting and dashboards to manage your day-to-day business and provide reports to stakeholders.
|
Ticket templates (or quick tickets) for common incidents can lead to fast creation, data input, and categorizations. Templates can reduce the time it takes to create tickets from two minutes to 30 seconds.
![]() |
Review tickets and talk to the team to find out the most frequent requests and the most frequent incidents that could be solved by the end user if there were clear instructions. Check with your user community to see what they would like to see in the portal.
| A portal is only as attractive as it is useful. Enabling ticket creation and review is the bare minimum and may not entice users to the portal if email is just as easy to use for ticket creation. Consider opening the portal to groups other than IT. HR, finance, and others may have information they want to share or forms to fill in or download where an employee portal rather than an IT portal could be helpful. Work with other departments to see if they would find value. Make sure your solution is easy to use when adding content. Low-code options are useful for this. Portals could be built in the ITSM solution or SharePoint/Teams and should include:
Info-Tech InsightConsider using video capture software to create short how-to videos for common questions. Vendors such as TechSmith Snagit , Vimeo Screen Recorder, Screencast-O-Matic Video Recording, and Movavi Screen Recording may be quick and easy to learn. | 49%49% of employees have trouble finding information at work 35%Employees can cut time spent looking for information by 35% with quality intranet (Source: Liferay) |
Transactional surveys are tied to specific interactions and provide a means of communication to help users communicate satisfaction or dissatisfaction with single interactions.
|
Relationship surveys can be run annually to obtain feedback on the overall customer experience.
Inform yourself of how well you are doing or where you need improvement in the broad services provided. Provide a high-level perspective on the relationship between the business and IT. Help with strategic improvement decisions.
|
Too many options can cause confusion; too few options provide little value. Try to avoid using “miscellaneous” – it’s not useful information. Test your tickets against your new scheme to make sure it works for you. Effective classification schemes are concise, easy to use correctly, and easy to maintain.
Build out the categories with these questions:
Create resolution codes to further modify the data for deeper reporting. This is typically a separate field, as you could use the same code for many categories. Keep it simple, but make sure it’s descriptive enough to understand the type of work happening in IT. Create and define simple status fields to quickly review tickets and know what needs to be actioned. Don’t stop the clock for any status changes unless you’re waiting on users. The elapsed time is important to measure from a customer satisfaction perspective. Info-Tech InsightThink about how you will use the data to determine which components need to be included in reports. If components won’t be used for reporting, routing, or warranty, reporting down to the component level adds little value. | ![]() |
Input: Existing tickets
Output: Categorization scheme
Materials: Whiteboard/Flip charts, Markers, Sample categorization scheme
Participants: CIO, Service desk manager, Technicians
Discuss:
Draft:
Download the Incident Management and Service Desk – Standard Operating Procedure Template
INCIDENTS |
SERVICE REQUESTS |
||
PRIORITIZATION |
Incidents will be prioritized based on urgency and impact to the organization. | Service requests will be scheduled and only increase in prioritization if there is an issue with the request process (e.g. new hire start). | |
SLAs |
Did incidents get resolved according to prioritization rules? REPONSE & RESOLUTION | Did service requests get completed on time? SCHEDULING & FULFILMENT | |
TRIAGE & ROOT CAUSE ANALYSIS |
Incidents will typically need triage at the service desk unless something is set up to go directly to a specialist. | Service requests don’t need triage and can be routed automatically for approvals and fulfillment. |
“For me, the first key question is, is this keeping you from doing business? Is this a service request? Is it actually something that's broken? Well, okay. Now let's have the conversation about what's broken and keeping you from doing business.” (Anonymous CIO)

Service requests are not as urgent as incidents and should be scheduled.
Set the SLA based on time to fulfill, plus a buffer to schedule around more urgent service requests.
2-3 hours
Input: Ticket data, Existing workflow diagrams
Output: Workflow diagrams
Materials: Whiteboard/Flip charts, Markers, Visio
Participants: CIO, Service desk manager, Technicians
Identify:
Download the Incident Management and Service Desk – Standard Operating Procedure Template
| Critical incidents and normal incidents
Even with a small team, it’s important to define a priority for response and resolution time for SLA and uptime reporting and extracting insights for continual improvement efforts.
|
Go to incident management for SE
Super-specialization of knowledge is also a common factor in smaller teams and is caused by complex architectures. While helpful, if that knowledge isn’t documented, it can walk out the door with the resource and the rest of the team is left scrambling. Lessons learned may be gathered for critical incidents but often are not propagated, which impacts the ability to solve recurring incidents. Over time, repeated incidents can have a negative impact on the customer’s perception that the service desk is a credible and essential service to the business. |
1 hour
Input: Ticket data, Business continuity plan
Output: Service desk SOP
Materials: Whiteboard/Flip charts, Markers
Participants: CIO, Service desk manager, Technicians
Discuss and document:
Download the Incident Runbook Prioritization Tool
|
![]() |
Depending on the size of the team, escalations may be mostly to internal technical colleagues or could be primarily to vendors.
![]() |
||||
| User doesn’t know who will fix the issue but expects to see it done in a reasonable time. | If issue cannot be resolved right away, set expectations for resolution time.
|
|
|
Validate user is happy with the experience |
Improving communications is the most effective way to improve customer service
|
Keep messaging simple
|
PROACTIVE, PLANNED CHANGES |
From: Service Desk
Messaging provided by engineer or director, sent to all employees; proactive planning with business unit leaders. |
|
OUTAGES & UPDATES |
From: Service Desk
Use templates to send out concise messaging and updates hourly, with input from technical team working on restoring services to all; director to liaise with business stakeholders. |
|
UPDATES TO SERVICES, SELF-SERVE |
From: Director
Send announcements no more than monthly about new services and processes. |
|
REGULAR STAKEHOLDER COMMUNICATIONS |
From: Director
Monthly reporting to business and IT stakeholders on strategic and project goals, manage escalations. |
2 hours
Input: Sample past communications
Output: Communications templates
Materials: Whiteboard/flip charts, Markers
Participants: CIO, Service desk manager, Technicians
Determine where templates are needed to ensure quick and consistent communications. Review sample templates and modify to suit your needs:
Download the communications templates
Create reports that are useful and actionableReporting serves two purposes:
To determine what reports are needed, ask yourself:
|
Determine which metrics will be most useful to suit your strategic and operational goals
|
|||||||||
Be agile in your approach to serviceIt’s easy for small teams to get overwhelmed when covering for vacations, illness, or leave. Determine where priorities may be adjusted during busy or short-staffed times.
|
Staff the service desk to meet demand
|
Create and manage a knowledge baseWith a small team, it may seem redundant to create a knowledge base, but without key system and process workflows and runbooks, an organization is still at risk of bottlenecks and knowledge failure.
Info-Tech InsightAppeal to a broad audience. Use non-technical language whenever possible to help less technical readers. Identify error messages and use screenshots where it makes sense. Take advantage of social features like voting buttons to increase use. | Optimize the service desk with a shift-left strategy
|
Customer service isn’t just about friendlinessYour team will all need to deal with end users at some point, and that may occur in times of high stress. Ensure the team has the skills they need to actively listen, stay positive, and de-escalate. Info-Tech’s customer service program is a modular approach to improve skills one area at a time. Delivering good customer service means being effective in these areas:
|
Deliver a customer service training program to your IT department
|
Improve your ticket analysisOnce you’ve got great data coming into the ticketing system, it’s important to rethink your metrics and determine if there are more insights to be found. Analyzing ticket data involves:
|
Analyze your service desk ticket dataProperly analyzing ticket data is challenging for the following reasons:
|
Start doing problem managementProactively focusing on root cause analysis will reduce the most disruptive incidents to the organization.
|
Problem managementProblem management can be challenging because it requires skills and knowledge to go deep into a problem and troubleshoot the root cause of an issue, but it also requires uninterrupted time.
|
Determine what tasks and projects need to be completed to meet your improvement goals. Create a high-level project plan and balance with existing resources.

Taylor, Sharon and Ivor Macfarlane. ITIL Small Scale Implementation. Office of Government Commerce, 2005.
“Share, Collaborate, and Communicate on One Consistent Platform.” Liferay, n.d. Accessed 19 July 2022.
Rodela, Jimmy. “A Beginner’s Guide to Customer Self-Service.” The Ascent, 18 May 2022. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Develop goals and KPIs to measure your progress.
Learn how to present different types of metrics.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Create a prioritized list of goals to improve the security program’s current state.
Insight into the current program and the direct it needs to head in.
1.1 Discuss current state and existing approach to metrics.
1.2 Review contract metrics already in place (or available).
1.3 Determine security areas that should be measured.
1.4 Determine what stakeholders are involved.
1.5 Review current initiatives to address those risks (security strategy, if in place).
1.6 Begin developing SMART goals for your initiative roadmap.
Gap analysis results
SMART goals
Develop unique KPIs to measure progress against your security goals.
Learn how to develop KPIs
Prioritized list of security goals
2.1 Continue SMART goal development.
2.2 Sort goals into types.
2.3 Rephrase goals as KPIs and list associated metric(s).
2.4 Continue KPI development.
KPI Evolution Worksheet
Determine which metrics will be included in the initial program launch.
A set of realistic and manageable goals-based metrics.
3.1 Lay out prioritization criteria.
3.2 Determine priority metrics (implementation).
3.3 Determine priority metrics (improvement & organizational trend).
Prioritized metrics
Tool for tracking and presentation
Strategize presentation based around metric type to indicate organization’s risk posture.
Develop versatile reporting techniques
4.1 Review metric types and discuss reporting strategies for each.
4.2 Develop a story about risk.
4.3 Discuss the use of KPXs and how to scale for less mature programs.
Key Performance Index Tool and presentation materials
"Metrics programs tend to fall into two groups: non-existent and unhelpful.
The reason so many security professionals struggle to develop a meaningful metrics program is because they are unsure of what to measure or why.
The truth is, for metrics to be useful, they need to be tied to something you care about – a state you are trying to achieve. In other words, some kind of goal. Used this way, metrics act as the scoreboard, letting you know if you’re making progress towards your goals, and thus, boosting your overall maturity."
– Logan Rohde, Research Analyst, Security Practice Info-Tech Research Group
Info-Tech Insight
Governance
Management
While business leaders are now taking a greater interest in cybersecurity, alignment between the two groups still has room for improvement.
5% of public companies feel very confident that they are properly secured against a cyberattack.
41% of boards take on cybersecurity directly rather than allocating it to another body (e.g. audit committee).
19% of private companies do not discuss cybersecurity with the board.
(ISACA, 2018)
Info-Tech Insight
Metrics help to level the playing field
Poor alignment between security and the business often stems from difficulties with explaining how security objectives support business goals, which is ultimately a communication problem.
However, metrics help to facilitate these conversations, as long as the metrics are expressed in practical, relatable terms.
Security professionals have the perception that metrics programs are difficult to create. However, this attitude usually stems from one of the following myths. In reality, security metrics are much simpler than they seem at first, and they usually help resolve existing challenges rather than create new ones.
| Myth | Truth | |
|---|---|---|
| 1 | There are certain metrics that are important to all organizations, based on maturity, industry, etc. | Metrics are indications of change; for a metric to be useful it needs to be tied to a goal, which helps you understand the change you're seeing as either a positive or a negative. Industry and maturity have little bearing here. |
| 2 | Metrics are only worthwhile once a certain maturity level is reached | Metrics are a tool to help an organization along the maturity scale. Metrics help organizations measure progress of their goals by helping them see which tactics are and are not working. |
| 3 | Security metrics should focus on specific, technical details (e.g. of systems) | Metrics are usually a means of demonstrating, objectively, the state of a security program. That is, they are a means of communicating something. For this reason, it is better that metrics be phrased in easily digestible, non-technical terms (even if they are informed by technical security statistics). |
Specific
Measurable
Achievable
Realistic
Timebound
Achievable: What is an achievable metric?
When we say that a metric is “achievable,” we imply that it is tied to a goal of some kind – the thing we want to achieve.
How do we set a goal?
Start:
Review current state and decide on priorities.
Set a SMART goal for improvement.
Develop an appropriate KPI.
Use KPI to monitor program improvement.
Present metrics to the board.
Revise metrics if necessary.
A security strategy is ultimately a large goal-setting exercise. You begin by determining your current maturity and how mature you need to be across all areas of information security, i.e. completing a gap analysis.
As such, linking your metrics program to your security strategy is a great way to get your metrics program up and running – but it’s not the only way.
Short term: Streamline your program. Based on your organization’s specific requirements and risk profile, figure out which metrics are best for now while also planning for future metrics as your organization matures.
Long term: Once the program is in place, improvements will come with increased visibility into operations. Investments in security will be encouraged when more evidence is available to executives, contributing to overall improved security posture. Potential opportunities for eventual cost savings also exist as there is more informed security spending and fewer incidents.
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked-off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| 1. Link Security Metrics to Goals to Boost Maturity | 2. Adapt Your Reporting Strategy for Various Metric Types | |
|---|---|---|
| Best-Practice Toolkit |
1.1 Review current state and set your goals 1.2 Develop KPIs and prioritize your goals 1.3 Implement and monitor the KPI to track goal progress |
2.1 Review best practices for presenting metrics 2.2 Strategize your presentation based on metric type 2.3 Tailor presentation to your audience 2.4 Use your metrics to create a story about risk 2.5 Revise your metrics |
| Guided Implementations |
|
|
| Onsite Workshop | Module 1: Current State, Initiatives, Goals, and KPIs | Module 2: Metrics Reporting |
|
Phase 1 Outcome:
|
Phase 2 Outcome:
|
Contact your account representative or email Workshops@InfoTech.com for more information.
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | Workshop Day 5 | |
|---|---|---|---|---|---|
| Activities |
Current State, Initiatives, and Goals
|
KPI Development
|
Metrics Prioritization
|
Metrics Reporting
|
Offsite Finalization
|
| Deliverables |
|
|
|
|
|
1.1 Review current state and set your goals
1.2 Develop KPIs and prioritize your goals
1.3 Implement and monitor KPIs
Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of two to three advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 2-4 weeks
Start with an analyst kick-off call:
Then complete these activities…
Review findings with analyst:
Then complete these activities…
With these tools & templates:
120 minutes
Before program improvement can take place, it is necessary to look at where things are at presently (in terms of maturity) and where we need to get them to.
In other words, we need to perform a security program gap analysis.
Info-Tech Best Practice
The most thorough way of performing this gap analysis is by completing Info-Tech’s Build an Information Security Strategy blueprint, as it will provide you with a prioritized list of initiatives to boost your security program maturity.
Use the Capability Maturity Model Integration (CMMI) scale below to help you understand your current level of maturity across the various areas of your security program.
(Adapted from the “CMMI Institute Maturity Model”)
The most effective metrics programs are personalized to reflect the goals of the security team and the business they work for. Using goals-based metrics allows you to make incremental improvements that can be measured and reported on, which makes program maturation a natural process.
Info-Tech Best Practice
Before setting a SMART goal, take a moment to consider your maturity for each security area, and which metric type you need to collect first, before moving to more ambitious goals.
Security Areas
| Metric Type | Description |
|---|---|
| Initial Probe | Determines what can be known (i.e. what sources for metrics exist?). |
| Baseline Testing | Establishes organization’s normal state based on current metrics. |
| Implementation | Focuses on setting up a series of related processes to increase organizational security (i.e. roll out MFA). |
| Improvement | Sets a target to be met and then maintained based on organizational risk tolerance. |
| Organizational Trends | Culls together several metrics to track (sometimes predict) how various trends affect the organization’s overall security. Usually focuses on large-scale issues (e.g. likelihood of a data breach). |
Specific
Measurable
Achievable
Realistic
Timebound
Examples of possible goals for various maturity levels:
1.1 Security Metrics Determination and Tracking Tool
To increase visibility into the cost, effort, and value of any given goal, assess them using the following criteria:
Use the calculated Cost/Effort Rating, Benefit Rating, and Difference Score later in this project to help with goal prioritization.
Info-Tech Best Practice
If you have already completed a security strategy with Info-Tech resources, this work may likely have already been done. Consult your Information Security Program Gap Analysis Tool from the Build an Information Security Strategy research.
At this time, it is necessary to evaluate the priorities of your security program.
Option 1: Progress to KPI Development
Option 2: Progress to Prioritization of Goals
Terms like “key performance indicator” may make this development practice seem more complicated than it really is. A KPI is just a single metric used to measure success towards a goal. In relational terms (i.e. as a percentage, ratio, etc.) to give it context (e.g. % of improvement over last quarter).
KPI development is about answering the question: what would indicate that I have achieved my goal?
KPIs differ from goal to goal, but their forms follow certain trends
| Metric Type | KPI Form |
|---|---|
| Initial Probe | Progress of probe (e.g. % of systems checked to see if they can supply metrics). |
| Baseline Testing | What current data shows (e.g. % of systems needing attention). |
| Implementation | Progress of the implementation (e.g. % of complete vulnerability management program implementation). |
| Improvement | The threshold or target to be achieved and maintained (e.g. % of incidents responded to within target window). |
| Organizational Trends | The interplay of several KPIs and how they affect the organization’s risk posture (e.g. assessing the likelihood for a data breach). |
1. Initial Probe
Focused on determining how many sources for metrics exist.
2. Baseline Testing
Focused on gaining initial insights about the state of your security program (what are the measurements?).
Info-Tech Insight
Don't lose hope if you lack resources to move beyond these initial steps. Even if you are struggling to pull data, you can still draw meaningful metrics. The percent or ratio of processes or systems you lack insight into can be very valuable, as it provides a basis to initiate a risk-based discussion with management about the organization's security blind spots.
3. Program Implementation
Focused on developing a basic program to establish basic maturity (e.g. implement an awareness and training program).
4. Improvement
Focused on attaining operational targets to lower organizational risk.
Info-Tech Insight
Don't overthink your KPI. In many cases it will simply be your goal rephrased to express a percentage or ratio. In others, like the example above, it makes sense for them to be identical.
5. Organizational Impact
Focused on studying several related KPIs (Key Performance Index, or KPX) in an attempt to predict risks.
Let’s take a look at KPI development in action.
Meet Maria, the new CISO at a large hospital that desperately needs security program improvements. Maria’s first move was to learn the true state of the organization’s security. She quickly learned that there was no metrics program in place and that her staff were unaware what, if any, sources were available to pull security metrics from.
After completing her initial probe into available metrics and then investigating the baseline readings, she determined that her areas of greatest concern were around vulnerability and access management. But she also decided it was time to get a security training and awareness program up and running to help mitigate risks in other areas she can’t deal with right away.
See examples of Maria’s KPI development on the next four slides...
Info-Tech Insight
There is very little variation in the kinds of goals people have around initial probes and baseline testing. Metrics in these areas are virtually always about determining what data sources are available to you and what that data actually shows. The real decisions start in determining what you want to do based on the measures you’re seeing.
Metric development example: Vulnerability Management
See examples of Maria’s KPI development on the next four slides...
Goal: Implement vulnerability management program
KPI: % increase of insight into existing vulnerabilities
Associated Metric: # of vulnerability detection methods
Goal: Improve deployment time for patches
KPI: % of critical patches fully deployed within target window
Goal: Implement MFA for privileged accounts
KPI: % of privileged accounts with MFA applied
Associated Metric: # of privileged accounts
Goal: Remove all unnecessary privileged accounts
KPI: % of accounts with unnecessary privileges
Goal: Implement training and awareness program
KPI: % of organization trained
Associated Metric: # of departments trained
Goal: Improve time to report phishing
KPI: % of phishing cases reported within target window
Goal: Predict Data Breach Likelihood
1.2 120 minutes
Follow the example of the CISO in the previous slides and try developing KPIs for the SMART goals set in step 1.1.
1.2 Security Metrics Determination and Tracking Tool
Tab “3. Identify Goal KPIs” allows you to record each KPI and its accompanying metadata:
Optionally, each KPI can be mapped to goals defined on tab “2. Identify Security Goals.”
Info-Tech Best Practice
Ensure your metadata is comprehensive, complete, and realistic. A different employee should be able to use only the information outlined in the metadata to continue collecting measurements for the program.
1.2 KPI Development Worksheet
Follow the examples contained in this slide deck and practice creating KPIs for:
As well as drafting associated metrics to inform the KPIs you create.
Info-Tech Best Practice
Keep your metrics program manageable. This exercise may produce more goals, metrics, and KPIs than you deal with all at once. But that doesn’t mean you can’t save some for future use.
1.2 120 minutes
An effort map visualizes a cost and benefit analysis. It is a quadrant output that visually shows how your SMART goals were assessed. Use the calculated Cost/Effort Rating and Benefit Rating values from tab “2. Identify Security Goals” of the Security Metrics Determination and Tracking Tool to aid this exercise.
Now that you’ve developed KPIs to monitor progress on your goals, it’s time to use them to drive security program maturation by following these steps:
The term key risk indicator (KRI) gets used in a few different ways. However, in most cases, KRIs are closely associated with KPIs.
1.3 Security Metrics Determination and Tracking Tool
Tracking metric data in Info-Tech's tool provides the following data visualizations:
Info-Tech Best Practice
Be diligent about measuring and tracking your metrics. Record any potential measurement biases or comments on measurement values to ensure you have a comprehensive record for future use. In the tool, this can be done by adding a comment to a cell with a metric measurement.
Workshops offer an easy way to accelerate your project. While onsite, our analysts will work with you and your team to facilitate the activities outlined in the blueprint.
Getting key stakeholders together to formalize the program, while getting started on data discovery and classification, allows you to kickstart the overall program.
In addition, leverage over-the-phone support through Guided Implementations included in advisory memberships to ensure the continuous improvement of the classification program even after the workshop.
Logan Rohde
Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Ian Mulholland
Senior Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Call 1-888-670-8889 for more information.
2.1 Review best practices for presenting metrics
2.2 Strategize your presentation based on metric type
2.3 Tailor your presentation to your audience
2.4 Use your metrics to create a story about risk
2.5 Revise Metrics
This phase will walk you through the following activities:
This phase involves the following participants:
Outcomes of this phase
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of two to three advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 2-4 weeks
Start with an analyst kick-off call:
Then complete these activities…
Review findings with analyst:
Then complete these activities…
With these tools & templates:
Phase 2 Results & Insights:
Avoid technical details (i.e. raw data) by focusing on the KPI.
Put things in terms of risk; it's the language you both understand.
Explain why you’re monitoring metrics in terms of the goals you’re hoping to achieve.
Choose between KPI or KRI as the presentation format.
Match presentation with the audience.
Read between the lines.
Read the news if you’re stuck for content.
Present your metrics as a story.
Metric Type: Initial Probe
Scenario: Implementing your first metrics program.
Decisions: Do you have sufficient insight into the program? (i.e. do you need to acquire additional tools to collect metrics?)
Strategy: If there are no barriers to this (e.g. budget), then focus your presentation on the fact that you are addressing the risk of not knowing what your organization's baseline state is and what potential issues exist but are unknown. This is likely the first phase of an improvement plan, so sketching the overall plan is a good idea too.
Possible KPIs:
Metric Type: Baseline Testing
Scenario: You've taken the metrics to determine what your organization’s normal state is and you're now looking towards addressing your gaps or problem areas.
Decisions: What needs to be prioritized first and why? Are additional resources required to make this happen?
Strategy: Explain your impression of the organization's normal state and what you plan to do about it. In other words, what goals are you prioritizing and why? Be sure to note any challenges that may occur along the way (e.g. staffing).
Possible KPIs:
Metric Type: Implementation
Scenario: You are now implementing solutions to address your security priorities.
Decisions: What, to you, would establish the basis of a program?
Strategy: Focus on what you're doing to implement a certain security need, why, and what still needs to be done when you’re finished.
Possible KPIs:
Metric Type: Improvement
Scenario: Now that a basic program has been established, you are looking to develop its maturity to boost overall performance (i.e. setting a new development goal).
Decisions: What is a reasonable target, given the organization's risk tolerance and current state?
Strategy: Explain that you're now working to tighten up the security program. Note that although things are improving, risk will always remain, so we need to keep it within a threshold that’s proportionate with our risk tolerance.
Possible KPIs:
Metric Type: Organizational Trends
Scenario: You've reached a mature state and now how several KPIs being tracked. You begin to look at several KPIs together (i.e. a KPX) to assess the organization's exposure for certain broad risk trends.
Decisions: Which KPIs can be used together to look at broader risks?
Strategy: Focus on the overall likelihood of a certain risk and why you've chosen to assess it with your chosen KPIs. Spend some time discussing what factors affect the movement of these KPIs, demonstrating how smaller behaviors create a ripple effect that affects the organization’s exposure to large-scale risks.
Possible KPX: Insider Threat Risk
Even challenges can elicit useful metrics.
Not every security program is capable of progressing smoothly through the various metric types. In some cases, it is impossible to move towards goals and metrics for implementation, improvement, or organizational trends because the security program lacks resources.
Info-Tech Insight
When your business is suffering from a lack of resources, acquiring these resources automatically becomes the goal that your metrics should be addressing. To do this, focus on what risks are being created because something is missing.
When your security program is lacking a critical resource, such as staff or technology, your metrics should focus on what security processes are suffering due to this lack. In other words, what critical activities are not getting done?
KPI Examples:
1. Raw Data
2. Management-Level
3. Board-Level
As a general rule, security metrics should become decreasingly technical and increasingly behavior-based as they are presented up the organizational hierarchy.
"The higher you travel up the corporate chain, the more challenging it becomes to create meaningful security metrics. Security metrics are intimately tied to their underlying technologies, but the last thing the CEO cares about is technical details." – Ben Rothke, Senior Information Security Specialist, Tapad.
Reporting metrics is not just another presentation. Rather, it is an opportunity to demonstrate and explain the value of security.
It is also a chance to correct any misconceptions about what security does or how it works.
Use the tips on the right to help make your presentation as relatable as possible.
Info-Tech Insight
There is a difference between data manipulation and strategic presentation: the goal is not to bend the truth, but to present it in a way that allows you to show the board what they need to see and to explain it in terms familiar to them.
Avoid jargon; speak in practical terms
Address compliance
Have solid answers
Security is about managing risk. This is also its primary value to the organization. As such, risk should be the theme of the story you tell.
"Build a cohesive story that people can understand . . . Raw metrics are valuable from an operations standpoint, but at the executive level, it's about a cohesive story that helps executives understand the value of the security program and keeps the company moving forward. "– Adam Ely, CSO and Co-Founder, Bluebox Security, qtd. by Tenable, 2016
The following model encapsulates the basic trajectory of all story development.
Use this model to help you put together your story about risk.
Introduction: Overall assessment of security program.
Initial Incident: Determination of the problems and associated risks.
Rising Action: Creation of goals and metrics to measure progress.
Climax: Major development indicated by metrics.
Falling Action: New insights gained about organization’s risks.
Resolution: Recommendations based on observations.
Info-Tech Best Practice
Follow this model to ensure that your metrics presentation follows a coherent storyline that explains how you assessed the problem, why you chose to address it the way you did, what you learned in doing so, and finally what should be done next to boost the security program’s maturity.
Board-Level KPI
Mgmt.-Level KPI
Raw Data
Think of your lower-level metrics as evidence to back up the story you are telling.
When you’re asked how you arrived at a given conclusion, you know it’s time to go down a level and to explain those results.
Think of this like showing your work.
Info-Tech Insight
This approach is built into the KPX reporting format, but can be used for all metric types by drawing from your associated metrics and goals already achieved.
2.4 Security Metrics Determination and Tracking Tool
Info-Tech provides two options for metric dashboards to meet the varying needs of our members.
If you’re just starting out, you’ll likely be inclined towards the dashboard within the Security Metrics Determination and Tracking Tool (seen here).
But if you’ve already got several KPIs to report on, you may prefer the Security Metrics KPX Dashboard Tool, featured on the following slides.
Info-Tech Best Practice
Not all graphs will be needed in all cases. When presenting, consider taking screenshots of the most relevant data and displaying them in Info-Tech’s Board-Level Security Metrics Presentation Template.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
"An important key to remember is to be consistent and stick to one framework once you've chosen it. As you meet with the same audiences repeatedly, having the same framework for reference will ensure that your communications become smoother over time." – Caroline Wong, Chief Strategy Officer, Cobalt.io
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
This tool helps you convert your KPIs into the language of risk by assessing frequency and severity, which helps to make the risk relatable for senior leadership. However, it is still useful to track fluctuations in terms of percentage. To do this, track changes in the frequency, severity, and trend scores from quarter to quarter.
2.4 Board-Level Security Metrics Presentation Template
Use the Board-Level Security Metrics Presentation Template deck to help structure and deliver your metrics presentation to the board.
To make the dashboard slide, simply copy and paste the charts from the dashboard tool and arrange the images as needed.
Adapt the status report and business alignment slides to reflect the story about risk that you are telling.
Now that you’ve made it through your metrics presentation, it’s important to reassess your goals with feedback from your audience in mind. Use the following workflow.
Workshops offer an easy way to accelerate your project. While onsite, our analysts will work with you and your team to facilitate the activities outlined in the blueprint.
Getting key stakeholders together to formalize the program, while getting started on data discovery and classification, allows you to kickstart the overall program.
In addition, leverage over-the-phone support through Guided Implementations included in advisory memberships to ensure the continuous improvement of the classification program even after the workshop.
Logan Rohde
Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Ian Mulholland
Senior Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Call 1-888-670-8889 for more information.
Mike Creaney, Senior Security Engineer at Federal Home Loan Bank of Chicago
Peter Chestna, Director, Enterprise Head of Application Security at BMO Financial Group
Zane Lackey, Co-Founder / Chief Security Officer at Signal Sciences
Ben Rothke, Senior Information Security Specialist at Tapad
Caroline Wong, Chief Strategy Officer at Cobalt.io
2 anonymous contributors
Build an Information Security Strategy
Tailor best practices to effectively manage information security.
Implement a Security Governance and Management Program
Align security and business objectives to get the greatest benefit from both.
Capability Maturity Model Integration (CMMI). ISACA. Carnegie Mellon University.
Ely, Adam. “Choose Security Metrics That Tell a Story.” Using Security Metrics to Drive Action: 33 Experts Share How to Communicate Security Program Effectiveness to Business Executives and the Board Eds. 2016. Web.
https://www.ciosummits.com/Online_Assets_Tenable_eBook-_Using_Security_Metrics_to_Drive_Action.pdf
ISACA. “Board Director Concerns about Cyber and Technology Risk.” CSX. 11 Sep. 2018. Web.
Rothke, Ben. “CEOs Require Security Metrics with a High-Level Focus.” Using Security Metrics to Drive Action: 33 Experts Share How to Communicate Security Program Effectiveness to Business Executives and the Board Eds. 2016. Web.
https://www.ciosummits.com/Online_Assets_Tenable_eBook-_Using_Security_Metrics_to_Drive_Action.pdf
Wong, Caroline. Security Metrics: A Beginner’s Guide. McGraw Hill: New York, 2012.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Create your minimum viable business architecture.
If there are a handful of capabilities that your business needs to focus on right now, what are they?
Identify business opportunities.
Enrich your capability model.
Neglecting to maintain the brand architecture can have the following consequences:
Brand architecture is the way a company organizes and manages its portfolio of brands to achieve strategic goals. It encompasses the relationships between brands, from sub-brands to endorsed brands to independent brands, and how they interact with each other and with the master brand. With a clear brand architecture, businesses can optimize their portfolio, enhance their competitive position, and achieve sustainable growth and success in the long run.
Establishing and upholding a well-defined brand architecture is critical to achieve:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
We recommend a two-step approach that involves defining or reimagining the brand architecture. This means choosing the right strategy by analyzing the current brand portfolio, identifying the core brand elements, and determining and developing the structure that fits with the brand and business goals. A well-thought-out brand architecture also facilitates the integration of new brands and new product launches.
Create a brand identity that helps you launch new products and services, prepare for acquisitions, and modify your brand strategy. Allocate resources more effectively and identify new opportunities for growth. A brand architecture can provide insights into how different brands fit together and contribute to the overall brand strategy.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
The brand mind mapping workshop is an exercise that helps with visualizing brand architecture and improving coherence and effectiveness in brand portfolio management.
This exercise can help businesses:
Allocate their resources more effectively.
Identify new opportunities for growth.
Gain a competitive advantage in their market.
1.1 Brand Mind Mapping
Visual representation of the brand architecture and its various components

Nathalie Vezina
Marketing Research Director
SoftwareReviews Advisory
This blueprint highlights common brand issues faced by companies, such as inconsistencies in branding and sub-branding due to absent or inadequate planning and documentation or non-compliance with the brand architecture. It emphasizes the importance of aligning or modifying the company's brand strategy with the existing architecture to create a consistent brand when launching new products, services, or divisions or preparing for acquisitions.
Changing the brand architecture can be challenging, as it often requires significant resources, time, and effort. Additionally, there may be resistance from stakeholders who have become attached to the existing brand architecture and may not see the value in making changes. However, it's important for companies to address suboptimal brand architecture to ensure consistency and clarity in brand messaging and support business growth and success.
This blueprint guides brand leaders on building and updating their brand architecture for optimal clarity, consistency, adaptability, and efficiency.
| Your Challenge | Common Obstacles | SoftwareReviews’ Approach |
A company's brand architecture can help brand managers build a stronger brand that supports
the company's goals and increases brand value. Failing to maintain the brand architecture can have the following consequences:
|
Establishing and maintaining a clear brand architecture can pose significant issues for brand leaders. Despite these obstacles, defining the brand architecture can yield substantial benefits for businesses. Common constraints are:
|
With focused and effective efforts and guidance, brand leaders can define or reimagine their brand architecture. Developing and maintaining a clear and consistent brand architecture involves:
|
"[B]rand architecture is like a blueprint for a house...the foundation that holds all the pieces together, making sure everything fits and works seamlessly."
Source: Verge Marketing
Brand architecture is the hierarchical organization and its interrelationships. This includes shaping the brand strategy and structuring the company's product and service portfolio.
A well-designed brand architecture helps buyers navigate a company's product offerings and creates a strong brand image and loyalty.
A company's brand architecture typically includes three levels:
Choosing the right architecture depends on business strategy, products and services, and target audience. It should be reviewed periodically as the brand evolves, new products and services are launched, or new brands are acquired.
"A brand architecture is the logical, strategic, and relational structure for your brands, or put another way, it is the entity's 'family tree' of brands, sub-brands, and named products."
Source: Branding Strategy Insider
Align brand architecture with business goals
A well-defined brand architecture aligned with business objectives contributes to building brand recognition, facilitating brand extension, and streamlining brand portfolio management. In addition, it improves marketing effectiveness and customer experience.
With a clear and consistent brand architecture, companies can strengthen their brand equity, increase awareness and loyalty, and grow in their competitive environment.
Effectively engage with the desired buyers
A clear and consistent brand architecture enables companies to align their brand identity and value proposition with the needs and preferences of their target audience, resulting in increased customer loyalty and satisfaction.
Establishing a unique market position and reinforcing brand messaging and positioning allows companies to create a more personalized and engaging customer experience, driving business growth.
Maintain a competitive edge
An effective brand architecture allows companies to differentiate themselves from their competitors by establishing their unique position in the market. It also provides a structured framework for introducing new products or services under the same brand, leveraging the existing one.
By aligning their brand architecture with their business objectives, companies can achieve sustainable growth and outperform their competitors in the marketplace.
"A well-defined brand architecture provides clarity and consistency in how a brand is perceived by its audience. It helps to create a logical framework that aligns with a brand's overall vision and objectives."
Source: LinkedIn
Deficient brand architecture can manifest in various ways.
Here are some common symptoms:
Brand architecture helps to ensure that your company's brands are aligned with your business goals and objectives, and that they work together to create a cohesive and consistent brand image.
Lack of stakeholder buy-in > Resistance to change
Siloed teams > Inconsistent execution
Limited resources > Lack of education and communication
Brand architecture is a framework that encompasses three distinct levels, each comprising a different type of branding strategy.


The brand architecture impacts the cohesiveness, effectiveness, and market reach. Defining or redefining organization changes is crucial for company performance.
| Branded House | Endorsed Brands | House of Brands | |
|---|---|---|---|
| Other Designations |
|
|
|
| Description |
|
|
|
| Marketing & Comms |
|
|
|
| Impact on Sales |
|
|
|
| Cost Effectiveness |
|
|
|
| Reputation and Image |
|
|
|
| Consistency |
|
|
|
To ensure a chosen name is effective and legally/ethically sound, consider the ease of pronunciation/spelling, the availability for registration of brand/domain name, any negative connotations/associations in any language/culture, and potential legal/ethical issues.

To ensure a chosen name is effective and legally/ethically sound, consider the ease of pronunciation/spelling, the availability for registration of brand/domain name, any negative connotations/associations in any language/culture, and potential legal/ethical issues.
Clear offering
Adaptability
Consistent branding
Competitive differentiation
Operational efficiency
Strong brand identity
Customer loyalty
Business success
"Responding to external influences, all brands must adapt and change over time. A clear system can aid in managing the process, ensuring that necessary changes are implemented effectively and efficiently."
Source: The Branding Journal
| Develop and Implement a Robust Brand Architecture | |
|---|---|
|
Phase Steps |
Step 1 Research and Analysis 1.1 Define brand architecture strategy 1.2 Brand audit 1.3 Identify brand core elements Step 2 Development and Implementation |
| Phase Outcomes |
|
Brand Architecture: Organize and manage your portfolio of brands
Brand architecture is the way a company organizes and manages its portfolio of brands to achieve strategic goals. It encompasses the relationships between brands, from sub-brands to endorsed brands to independent brands, and how they interact with each other and with the master brand. With a clear brand architecture, businesses can optimize their portfolio, enhance their competitive position, and achieve sustainable growth and success in the long run.
Aligning brand architecture to business strategy
Effective brand architecture aligns with the company's business strategy, marketing objectives, and customer needs. It provides clarity and coherence to the brand portfolio, helps customers navigate product offerings, and maximizes overall equity of the brand.
Choosing between three types of brand architecture
A company's choice of brand architecture depends on factors like product range, target markets, and strategic objectives. Each approach, Branded House, Endorsed, or House of Brands, has its own pros and cons, and the proper option relies on the company's goals, resources, and constraints.
A logical brand hierarchy for more clarity
The order of importance of brands in the portfolio, including the relationships between the master and sub-brands, and the positioning of each in the market is fundamental. A clear and logical hierarchy helps customers understand the value proposition of each brand and reduces confusion.
A win-win approach
Clear brand architecture can help customers easily navigate and understand the product offering, reinforce the brand identity and values, and improve customer loyalty and retention. Additionally, it can help companies optimize their marketing strategies, streamline their product development and production processes, and maximize their revenue and profitability.
Brand architecture, an ongoing process
Brand architecture is not a one-time decision but an ongoing process that requires regular review and adjustment. As business conditions change, companies may need to revise their brand portfolio, brand hierarchy, or brand extension and acquisition strategies to remain competitive and meet customer needs.
Brand Architecture Toolkit
This kit includes a Brand Architecture Mini-Audit, a Brand Architecture template, and templates for Brand Matrix, Ecosystem, and Development Strategy.
Use this kit to develop a strong brand architecture that aligns with your business goals, clarifies your brand portfolio, and enhances overall brand equity.

"A brand architecture is the logical, strategic, and relational structure for your brands, or put another way, it is the entity's 'family tree' of brands, sub-brands, and named products."
Source: Branding Strategy Insider
Consequences of Neglected Brand Guidelines
When a company neglects its brand architecture and guidelines, it can result in a number of negative consequences, such as:
Benefits of SoftwareReviews' Methodology
By following SoftwareReviews' methodology to develop and maintain a brand architecture, businesses can:
Marq, formerly Lucidpress, surveyed over 400 brand management experts and found that "if the brand was consistent, revenue would increase by 10-20%."

This research is designed for:
This research will also assist:
This research will help you:
This research will help them:
| DIY Toolkit "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." |
Guided Implementation "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." |
Workshop "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." |
Consulting "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
| Included Within Advisory Membership | Optional Add-Ons | ||
|---|---|---|---|
| Research & Analysis | |||
|---|---|---|---|
| Call #1: Discuss brand architecture strategy (define objectives, scope and stakeholders). | Call #3: Identify core brand components and ensure they align with the brand strategy. | Call #5: Develop or update brand guidelines. | Optional Calls:
|
| Call #2: Conduct a brand audit. | Call #4: Define and document the brand hierarchy. | Call #6: Roll out the brand architecture and monitoring. | |
A Guided Implementation (GI) is a series of calls with a SoftwareReviews Marketing Analyst to help implement our best practices in your organization.
Your engagement managers will work with you to schedule analyst calls.
Total duration: 3-4 hours
Activities
Visually map out the different elements of your brand portfolio, including corporate brands, sub-brands, product brands, and their relationships with each other.
The workshop also aims to explore additional elements, such as brand expansions, acquisitions, and extensions, and brand attributes and positioning.
Deliverables
Get a mind map that represents the brand architecture and its various components, which can be used to evaluate and improve the overall coherence and effectiveness of the brand portfolio. The mind map can also provide insights into how different brands fit together and contribute to the overall brand strategy.
Participants
Tools

Contact your account representative for more information
workshops@infotech.com | 1-888-670-8889
Develop and Implement a Robust Brand Architecture
Step 1 Research and Analysis
1.1 Define architecture strategy
1.2 Perform brand audit
1.3 Identify brand core elements
Step 2 Development and Implementation
2.1 Determine brand hierarchy
2.2 Develop or update brand guidelines
2.3 Roll out brand architecture
Phase Outcome
Total duration: 2.5-4.5 hours
Objective
Define brand objectives (hierarchy, acquired brand inclusion, product distinction), scope, and stakeholders. Analyze the brand portfolio to identify gaps or inconsistencies. Identify brand components (name, logo, tagline, personality) and align them with the brand and business strategy.
Output
By completing these steps, you will assess your current brand portfolio and evaluate its consistency and alignment with the overall brand strategy.
Participants
Tools
1.1 Define Brand Architecture Strategy
(60-120 min.)
Define
Define brand objectives (hierarchy, inclusion of an acquired brand, product distinction), scope, and stakeholders.
1.2 Conduct Brand Audit
(30-60 min.)
Assess
Assess the state of your brand architecture using the "Brand architecture mini-audit checklist," slide 9 of the Brand Architecture Strategy Template. Check the boxes that correspond to the state of your brand architecture. Those left unchecked represent areas for improvement.
For a more in-depth analysis of your brand performance, follow the instructions and use the tools provided in the Diagnose Brand Health to Improve Business Growth blueprint (optional).
1.3 Identify Core Brand Elements
(60-90 min.)
Identify
Define brand components (name, logo, tagline, personality). Align usage with strategy. You can develop your brand strategy, if not already existing, using the Brand Awareness Strategy Template (optional).
Tip!
Continuously monitor and adjust your brand architecture - it's not static and should evolve over time. You can also adapt your brand strategy as needed to stay relevant and competitive.
Total duration: 3.5-5.5 hours
Objective
Define your brand structure and clarify the role and market position of each. Create concise brand expression guidelines, implement them across all touchpoints and assets, and adjust as needed to stay aligned with your business goals.
Output
This exercise will help you establish and apply your brand structure, with a plan for ongoing updates and adjustments to maintain consistency and relevance.
Participants
Tools
2.1 Determine Brand Hierarchy
(30-60 min.)
Analyze & Document
In the Brand Architecture Strategy Template, complete the brand matrix, ecosystem, development strategy matrix, mind mapping, and architecture, to develop a strong brand architecture that aligns with your business goals and clarifies your brand portfolio and market position.
2.2 Develop/Update Brand Guidelines
(120-180 min.)
Develop/Update
Develop (or update existing) clear, concise, and actionable brand expression guidelines using the Brand Voice Guidelines and Brand Messaging Template.
2.2 Rollout Brand Architecture
Preparation (60-90 min.)
Create & Implement
Use the Asset Creation and Management List Template to implement brand architecture across touchpoints and assets.
Monitor and Adjust
Use slide 8, "Brand Strategy Development Matrix," of the Brand Architecture Strategy Template to identify potential and future brand development strategies to build or enhance your brand based on your current brand positioning and business goals. Monitor, and adjust as needed, for relevance to the brand and business strategy.
Tip!
Make your brand architecture clear and simple for your target audience, employees, and stakeholders. This will avoid confusion and help your audience understand your brand structure.
Prioritizing clarity and simplicity will communicate your brand's value proposition effectively and create a strong brand that resonates with your audience and supports your business goals.
Diagnose Brand Health to Improve Business Growth
Have a significant and well-targeted impact on business success and growth by knowing how your brand performs, identifying areas of improvement, and making data-driven decisions to fix them.
Accelerate Business Growth and Valuation by Building Brand Awareness
Successfully build awareness and help the business grow. Stand out from the competition and continue to grow in a sustainable way.
"Brand Architecture: Definition, Types, Strategies, and Examples." The Branding Journal, 2022.
"Brand Architecture: What It Is and How to Build Your Brand's Framework." HubSpot, 2021.
"Brand Architecture Framework." Verge Marketing, 2021.
"Brand consistency-the competitive advantage and how to achieve it." Marq/Lucidpress, 2021.
"Building brands for growth: A fresh perspective." McKinsey & Company. Accessed on 31 March 2023.
Daye, Derrick. "Brand Architecture Strategy Guide." Branding Strategy Insider, The Blake Project, 13 May 2021.
Todoran, Adrian. "Choosing the Perfect Brand Architecture Strategy for Your Business." LinkedIn, 2023.
Learn and explore the technology and practice initiatives in this report to determine which initiatives should be prioritized in your application strategy and align to your business organizational objectives:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
In this report, we explore five priorities for emerging and leading-edge technologies and practices that can improve on capabilities needed to meet the ambitions of your organization.
Economic, social, and regulatory conditions have changed livelihoods, businesses, and marketplaces. Modern tools and technologies have acted as lifelines by minimizing operating and delivery costs, and in the process, establishing a strong foundation for growth and maturity.
As organizations continue to strengthen business continuity, disaster recovery, and system resilience, activities to simply "keep the lights on" are not enough. Be pragmatic in the prioritization and planning of your applications initiatives, and use your technologies as a foundation for your growth.
Your applications must meet the top business goals of your CXOs
Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022, n=568.
Applications are critical components in any business strategic plan. They can directly influence an organization's internal and external brand and reputation, such as their:
Therefore, business leaders are continuously looking for innovative ways to better position their application portfolios to satisfy their goals and objectives, i.e. applications priorities. Given the scope and costs often involved, these priorities must be carefully crafted to clearly state achievable business outcomes that satisfy
the different needs of very different customers, stakeholders, and users.
Today's business applications are good but leave room for improvement
72%
Average business application satisfaction score among IT leadership in 1582 organizations.
Source: CIO Business Vision, August 2021 to July 2022, N=190.
In this report, we explore five priorities for emerging and leading-edge technologies and practices that can improve on capabilities needed to meet the Ambitions of your organization.
Easily attainable and insightful measurements to gauge the progress of meeting strategic objectives and goals (KPIs), and the performance of individual teams, practices and processes (metrics).
Gain an accurate understanding and interpretation of stakeholder, end-user, and customer expectations and priorities. These define the success of business products and services considering the priorities of individual business units and teams.
Software delivery and support roles, processes, and tools are collaborative, well equipped and resourced, and optimized to meet changing stakeholder expectations.
Ensuring data is continuously reliable and trustworthy. Data structure and integrations are defined, governed, and monitored.
Complete inventory and rationalization of the product and service portfolio, prioritized backlogs, roadmaps, and clear product and service ownership with good governance. This helps ensure this portfolio is optimized to meet its goals and objectives.
Manage the adoption of new and modified processes and technologies considering reputational, human, and operational concerns.
Continuous monitoring and upkeep of products and services to assure business continuity, and system reliability, robustness and disaster recovery.
A set of principles and standards that guides the consistent, sustainable and scalable growth of enterprise technologies. Changes to the architecture are made in collaboration with affected parties, such as security and infrastructure.
The measures, controls, and tactics at the application layer that prevent vulnerabilities against external and internal threats and ensure compliance to industry and regulatory security frameworks and standards.
Expectations on your applications team have increased, while the gap between how stakeholders and applications teams perceive effectiveness remains wide. This points to a need to clarify the requirements to deliver valuable and quality applications and address the pressures challenging your teams.
CIOs agree that at least some improvement is needed across key IT activities
Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022, n=568.
Recent environmental pressures impacted traditional working arrangements and showed more workplace flexibility is often possible. At the same time, many employees' expectations about how, when, and where they choose to work have also evolved. Recruitment and retention are reflections of different sides of the same employee value proposition coin. Organizations that fail to reinvent their approach to attracting and retaining talent by focusing on candidate and employee experience risk turnover, vacancies, and lost opportunities that can negatively impact the bottom line.
While workplace flexibility comes with many benefits, longer work hours jeopardize wellbeing.
62% of organizations reported increased working hours, while 80% reported an increase in flexibility.
Source: McLean & Company, 2022; n=394.
Be strategic in how you fill and train key IT skills and capabilities
Source: Harvey Nash Group, 2021; n=2120.
Recent environmental pressures impacted traditional working arrangements and showed more workplace flexibility is often possible. At the same time, many employees' expectations about how, when, and where they choose to work have also evolved. Recruitment and retention are reflections of different sides of the same employee value proposition coin. Organizations that fail to reinvent their approach to attracting and retaining talent by focusing on candidate and employee experience risk turnover, vacancies, and lost opportunities that can negatively impact the bottom line.
Only 64% of applications were identified as effective by end users.
Effective applications are identified as at least highly important and have high feature and usability satisfaction.
Source: Application Portfolio Assessment, August 2021 to July 2022; N=315.
"Regardless of the many definitions of modernization floating around, the one characteristic that we should be striving for is to ensure our applications do an outstanding job of supporting the users and the business in the most effective and efficient manner possible."
Source: looksoftware.
"Going digital" reshapes how the business operates and drives value by optimizing how digital and traditional technologies and tactics work together. This shift often presents significant business and technical risks to business processes, enterprise data, applications, and systems which stakeholders and teams are not aware of or prepared to accommodate.
The shift to digital processes is starting, but slowly.
62% of respondents indicated that 1-20% of their processes were digitized during the past year.
Source: Tech Trends and Priorities 2023; N=500
Resistance to change and time/budget constraints are top barriers preventing companies from modernizing their applications.
Source: Konveyor, 2022; n=600.
Enterprise products and services are not used, operated, or branded in isolation. The various parties involved may have competing priorities, which often leads to disagreements on when certain business and technology changes should be made and how resources, budget, and other assets should be allocated. Without a broader product vision, portfolio vision, and roadmap, the various dependent or related products and services will not deliver the same level of value as if they were managed collectively.
55% of CXOs stated some improvement is necessary in activities to understand business goals.
Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.
CXOs are moderately satisfied with IT's performance as a business partner (average score of 69% among all CXOs). This sentiment is similarly felt among CIOs (64%).
Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568.
Culture impacts business results, including bottom-line revenue and productivity metrics. Leaders appreciate the impact culture can have on applications initiatives and wish to leverage this. How culture translates from an abstract concept to something that is measurable and actionable is not straightforward. Executives need to clarify how the desired culture will help achieve their applications strategy and need to focus on the items that will have the most impact.
Agile does not solve team culture challenges.
43% of organizations cited organizational culture as a significant barrier to adopting and scaling Agile practices.
Source: Digital.ai, 2021.
"Providing a great employee experience" as the second priority (after recruiting) highlights the emphasis organizations are placing on helping employees adjust after having been forced to change the way work gets done.
Source: McLean & Company, 2022; N=826.
| Applications Priorities | |||||
|---|---|---|---|---|---|
| Digital Experience (DX) | Intelligent Automation | Proactive Application Management | Multisource Systems | Digital Organization as a Platform | |
| Attracting and Retaining Talent | Enhance the employee experience | Be transparent and support role changes | Shift focus from maintenance to innovation | Enable business-managed applications | Promote and showcase achievements and successes |
| Maximizing the Return on Technology | Modernize or extend the use of existing investments | Automate applications across multiple business functions | Improve the reliability of mission-critical applications | Enhance the functionality of existing applications | Increase visibility of underused applications |
| Confidently Shifting to Digital | Prioritize DX in your shift to digital | Select the capabilities that will benefit most from automation | Prepare applications to support digital tools and technologies | Use best-of-breed tools to meet specific digital needs | Bring all applications up to a common digital standard |
| Addressing Competing Priorities | Ground your digital vision, goals, and objectives | Recognize and evaluate the architectural impact | Rationalize the health of the applications | Agree on a common philosophy on system composition | Map to a holistic platform vision, goals, and objectives |
| Fostering a Collaborative Culture | Involve all perspectives in defining and delivering DX | Involve the end user in the delivery and testing of the automated process | Include the technical perspective in the viability of future applications plans | Discuss how applications can work together better in an ecosystem | Ensure the platform is configured to meet the individual needs of the users |
| Creating High-Throughput Teams | Establish delivery principles centered on DX | Remove manual, error-prone, and mundane tasks | Simplify applications to ease delivery and maintenance | Alleviate delivery bottlenecks and issues | Abstract the enterprise system to expedite delivery |
Delivering valuable digital experiences requires the adoption of good management, governance, and operational practices to accommodate stakeholder, employee, customer, and end-user expectations of digital experiences (e.g. product management, automation, and iterative delivery). Technologies are chosen based on what best enables, delivers, and supports these expectations.
Digital transformation is not just about new tools and technologies. It is also about delivering a valuable digital experience
Digital experience (DX) refers to the interaction between a user and an organization through digital products and services. Digital products and services are tools, systems, devices, and resources that gather, store, and process data; are continuously modernized; and embody eight key attributes that are described on the following slide. DX is broken down into four distinct perspectives*:
| Digital Products and Services | |||
|---|---|---|---|
| Customer Experience | Brand Experience | Employee Experience | End-User Experience |
Digital transformation is not just about new tools and technologies. It is also about delivering a valuable digital experience
A good DX has become a key differentiator that gives organizations an advantage over their competition and peers. Shifts in working environments; employee, customer, and stakeholder expectations; and the advancements in modern technologies have raised the importance of adopting and transitioning to digital processes and tools to stay relevant and responsive to changing business and technology conditions.
Applications teams are critical to ensuring the successful delivery and operation of these digital processes and tools. However, they are often under-resourced and challenged to meet their DX goals.
|
of organizations stated that at least 1% of processes were shifted from being manually completed to digitally completed in the last year. 29% of organizations stated at least 21% were shifted. Source: Tech Trends and Priorities 2023; N=500. |
|
of organizations recognized digital transformation is important for competitive advantage. 94% stated it is important to enhance customer experience, and 91% stated it will have a positive impact on revenue. Source: Cyara, 2021. |
Customers are swayed by the innovations and advancements in digital technologies and expect your applications team to deliver and support them. Your leaders recognize the importance of these expectations and are integrating them into their business strategy and brand (how the organization presents itself to its customers, employees and the public). They hope that their actions will improve and shape the company's reputation (public perception of the company) as effective, customer-focused, and forward-thinking.
As you evolve and adopt more complex tools and technology, your stakeholders will expect more from business units and IT teams. Unfortunately, teams employing manual processes and legacy systems will struggle to meet these expectations. Digital products and services promote the simplification of complex operations and applications and help the business and your teams better align operational practices with strategic goals and deliver valuable DX.
Legacy processes, systems, and ways of working are no longer suitable for meeting the strategic digital objectives and DX needs stakeholders expect. They drive up operational costs without increased benefits, impede business growth and innovation, and consume scarce budgets that could be used for other priorities. Shifting to digital tools and technologies will bring these challenges to light and demonstrate how modernization is an integral part of DX success.
Employees and customers can choose how they want to access, modify, and consume digital products and services. They can be tailored to meet the specific functional needs, behaviors, and habits of the end user.
The customer, end user, brand, and employee drive selection, design, and delivery of digital products and services. Even the most advanced technologies will fail if key roles do not see the value in their use.
Digital products and services are delivered with technical quality built into them, ensuring they meet the industry, regulatory, and company standards throughout their lifespan and in various conditions.
Some stakeholders may not be willing to change due to their familiarity and comfort of business practices.
Competing and conflicting priorities of strategic products and services undermine digital transformation and broader modernization efforts.
Business processes are often burdened by wasteful activities. Digital products and services are only as valuable as the processes they support.
The performance and support of your digital products and services are hampered due to unmanageable technical debt because of a deliberate decision to bypass or omit quality good practices.
Success can be dependent on your ability to address your pressure points.
| Attracting and Retaining Talent |
Enhance the employee experience.Design the digital processes, tools, and technologies to meet the individual needs of the employee. |
|---|---|
| Maximizing the Return on Technology |
Modernize or extend the use of existing investments.Drive higher adoption of applications and higher user value and productivity by implementing digital capabilities to the applications that will gain the most. |
| Confidently Shifting to Digital |
Prioritize DX in your shift to digital. Include DX as part of your definition of success.Your products and services are not valuable if users, customers, and employees do not use them. |
| Addressing Competing Priorities |
Ground your digital vision, goals, and objectivesEstablish clear ownership of DX and digital products and services with a cross-functional prioritization framework. |
| Fostering a Collaborative Culture |
Involve all perspectives in defining and delivering DX.Maintain a committee of owners, stakeholders, and delivery teams to ensure consensus and discuss how to address cross-functional opportunities and risks. |
| Creating High-Throughput Teams |
Establish delivery principles centered on DX.Enforce guiding principles to streamline and simplify DX delivery, such as plug-and-play architecture and quality standards. |
A digital business strategy clearly articulates the goals and ambitions of the business to adopt digital practices, tools, and technologies. This document:
Related Research:
Related Research:
User, customer, employee, and brand are integral perspectives on the software development lifecycle (SDLC) and the management and governance practices supporting digital products and services. It ensures quality standards and controls are consistently upheld while maintaining alignment with various needs and priorities. The goal is to come to a consensus on a universal definition and approach to embed quality and DX-thinking throughout the delivery process.
Related Research:
Today's rapidly scaling and increasingly complex digital products and services create mounting pressure on delivery teams to release new features and changes quickly and with sufficient quality. This pressure is further compounded by the competing priorities of individual stakeholders and the nuances among different personas of digital products and services.
A collaborative delivery practice sets the activities, channels, and relationships needed to deliver a valuable and quality product or service with cross-functional awareness, accountability, and agreement.
Related Research:
Today's modern digital products and services are tomorrow's shelfware. They gradually lose their value, and the supporting technologies will become obsolete. Modernization is a continuous need.
Data-driven insights help decision makers decide which products and services to retire, upgrade, retrain on, or maintain to meet the demands of the business.
Enhancements focusing on critical business capabilities strengthen the case for investment and build trust with all stakeholders.
Related Research:
Chief Marketing Officer M.V. Rajamannar (Raja) wanted to change Mastercard's iconic "Priceless" ad campaign (with the slogan "There are some things money can't buy. For everything else there's Mastercard."). The main reasons were that the campaign relied on one-way communication and targeted end customers, even though Mastercard doesn't issue cards directly to customers; partner banks do. To drive the change in campaign, Raja and his team created a digital engine that leveraged digital and social media. Digital engine is a seven-step process based on insights gleaned from data and real-time optimization.
Source: Harvard Business Review Press
Focus on the customer journey
The Mastercard case highlights important lessons on how to engage customers:
AI and ML are rapidly growing. Organizations see the value of machines intelligently executing high-performance and dynamic tasks such as driving cars and detecting fraud. Senior leaders see AI and ML as opportunities to extend their business process automation investments.
Intelligent automation is the next step in your business process automation journey
Intelligent automation (IA) is the combination of traditional automation technologies, such as business process management (BPM) and robotic process automation (RPA), with AI and ML. The goal is to further streamline and scale decision making across various business processes by:
"For IA to succeed, employees must be involved in the transformation journey so they can experience firsthand the benefits of a new way of working and creating business value," (Cognizant).
"Hyperautomation is the act of automating everything in an organization that can be automated. The intent is to streamline processes across an organization using intelligent automation, which includes AI, RPA and other technologies, to run without human intervention. … Hyperautomation is a business-driven, disciplined approach that organizations use to rapidly identify, vet, and automate as many business and IT processes as possible" (IBM, 2021).
Note that hyperautomation often enables IA, but teams solely adopting IA do not need to abide to its automation-first principles.
Process automation is an executive priority and requires organizational buy-in
Stakeholders recognize the importance of business process automation and AI and are looking for ways to deliver more value using these technologies.
However, the advertised benefits to vendors of enabling these desired automations may not be easily achievable because of:
|
of CXOs stated staff sufficiency, skill and engagement issues as a minor IT pain point compared to 51% of CIOs stated this issue as a major pain point. Source: CEO-CIO Alignment Diagnostics, August 2021 to July 2022; n=568. |
|
of organizations have already invested in AI or machine learning. Source: Tech Trends and Priorities 2023; N=662 |
Products and services delivered through an undefined and manual process risk the creation of preventable and catchable defects, security flaws and holes, missing information, and other quality issues. IA solutions consistently reinforce quality standards the same way across all products and services while tailoring outputs to meet an individual's specific needs. Success is dependent on the accurate interpretation and application of quality standards and the user's expectations.
IA removes the tedious, routine, and mundane tasks that distract and restrict employees from doing more valuable, impactful, and cognitively focused activities. Practical insights can also be generated through IA tools that help employees make data-driven decisions, evaluate problems from different angles, and improve the usability and value of the products and services they produce.
Automation magnifies existing inefficiencies of a business process management practice, such as unclear and outdated process documentation and incorrect assumptions. IA reinforces the importance of good business process optimization practices, such as removing waste and inefficiencies in a thoughtful way, choosing the most appropriate automation solution, and configuring the process in the right way to maximize the solution's value.
All business processes must be mapped and documented to be automated, including business rules, data entities, applications, and control points.
IA can be configured and orchestrated to automatically execute when certain business, process, or technology conditions are met in an unattended or attended manner.
IA is applicable in use cases beyond traditional business processes, such as automated testing, quality control, audit, website scraping, integration platform, customer service, and data transfer.
The accuracy and relevance of the decisions IA makes are dependent on the overall quality of the data
used to train it.
Some decisions can have significant reputational, moral, and ethical impacts if made incorrectly.
The question is whether it is appropriate for a non-human to make that decision.
IA is composed of technologies that can be compromised or fail. Without the proper monitoring, controls,
and recovery protocols, impacted IA will generate significant business and IT costs and can potentially harm customers, employees, and the organization.
Low- and no-code capabilities ease and streamline IA development, which makes it susceptible to becoming unmanageable. Discipline is needed to ensure IA owners are aware of the size and health of the IA portfolio.
Success can be dependent on your ability to address your pressure points.
| Attracting and Retaining Talent |
Be transparent and support role changes.Plan to address the human sentiment with automation (e.g. job security) and the transition of the role to other activities. |
|---|---|
| Maximizing the Return on Technology |
Automate applications across multiple business functions.Recognize the value opportunities of improving and automating the integration of cross-functional processes. |
| Confidently Shifting to Digital |
Maximize the learning of automation fit.Select the right capabilities to demonstrate the value of IA while using lessons learned to establish the appropriate support. |
| Addressing Competing Priorities |
Recognize automation opportunities with capability maps.Use a capability diagram to align strategic IA objectives with tactical and technical IA initiatives. |
| Fostering a Collaborative Culture |
Involve the user in the delivery process.Maximize automation adoption by ensuring the user finds value in its use before deployment. |
| Creating High-Throughput Teams |
Remove manual, error-prone, and mundane tasks.Look for ways to improve team throughput by removing wasteful activities, enforcing quality, and automating away tasks driving down productivity. |
Formalize your business process automation practice with a good toolkit and a repeatable set of tactics and techniques.
Related Research:
Each IA tool will address a different problem. Which tool to choose is dependent on a variety of factors, such as functional suitability, technology suitability, delivery and support capabilities, alignment to strategic business goals, and the value it is designed to deliver.
Related Research:
Despite the many promises of AI, organizations are struggling to fully realize its potential. The reasons boil down to a lack of understanding of when these technologies should and shouldn't be used, as well as a fear of the unknown. The plan to adopt AI should include:
Related Research:
Biases can be introduced into an IA system at any stage of the development process, from the data you collect, to the way you collect it, to which algorithms are used and what assumptions were made. In most cases, AI and ML bias is a is a social, political, and business problem.
While bias may not be intentional nor completely prevented or eliminated, early detection, good design, and other proactive preventative steps can be taken to minimize its scope and impact.
Related Research:
University Hospitals Cleveland (UH) faces the same challenge that every major hospital confronts regarding how to deliver increasingly complex, high-quality healthcare to a diverse population efficiently and economically. In 2017, UH embarked on a value improvement program aiming to improve quality while saving $400 million over a five-year period.
In emergency department (ED) and inpatient units, leaders found anticipating demand difficult, and consequently units were often over-staffed when demand was low and under-staffed when demand was high. Hospital leaders were uncertain about how to reallocate resources based on capacity needs.
UH turned to Hospital IQ's Census Solution to proactively manage capacity, staff, and flow in the ED and inpatient areas.
By applying AI, ML, and external data (e.g. weather forecasts) to the hospital's own data (including EMR data and hospital policies), the solution helped UH make two-day census forecasts that managers used to determine whether to open or close in-patient beds and, when necessary, divert low-acuity patients to other hospitals in the system to handle predicted patient volume.
Source: University Hospitals
ED boarding hours have declined by 10% and the hospital has seen a 50% reduction in the number of patients who leave the hospital without
being seen.
UH also predicts in advance patients ready for discharge and identifies roadblocks, reducing the average length of stay by 15%. UH is able to better manage staff, reducing overtime and cutting overall labor costs.
The hospital has also increased staff satisfaction and improved patient safety by closing specific units on weekends and increasing the number of rooms that can be sterilized.
Application management is often viewed as a support function rather than an enabler of business growth. Focus and investments are only placed on application management when it becomes a problem. The lack of governance and practice accountability leaves this practice in a chaotic state: politics take over, resources are not strategically allocated, and customers are frustrated. As a result, application management is often reactive and brushed aside for new development.
Application management ensures valuable software is successfully delivered and is maintained for continuous and sustainable business operations. It contains a repeatable set of activities needed to rationalize and roadmap products and services while balancing priorities of new features and maintenance tasks.
Unfortunately, application management is commonly perceived as a practice that solely addresses issues, updates, and incidents. However, application management teams are also tasked with new value delivery that was not part of the original release.
Application maintenance is the "process of modifying a software system or its components after delivery to correct faults, improve performance or other attributes, or adapt to a changed environment or business process," (IEEE, 1998). While it is critical to quickly fix defects and issues when they occur, reactively addressing them is more expensive than discovering them early and employing the practices to prevent them.
Even if an application is working well, its framework, architecture, and technology may not be compatible with the possible upcoming changes stakeholders and vendors may want to undertake. Applications may not be problems now, but they soon can be.
Proactive application management practices are critical to maintaining business continuity. They require continuous review and modification so that applications are resilient and can address current and future scenarios. Depending on the value of the application, its criticality to business operations, and its susceptibility to technology change, a more proactive management approach may be warranted. Stakeholders can then better manage resources and budget according to the needs of specific products.
Fix and enhance the product when it breaks. In most cases, a plan is in place ahead of a failure, so that the problem can be addressed without significant disruption and costs.
Regularly inspect and optimize the product to reduce the likelihood that it will fail in the future. Schedule inspections based on a specific timeframe or usage threshold.
Predict failures before they happen using performance and usage data to alert teams when products are at risk of failure according to specified conditions.
Analyze all possible failure scenarios for each component of the product and create tailored delivery plans to improve the stability, reliability, and value of each product.
Applications begin to degrade as soon as they are used
Today's applications are tomorrow's shelfware. They gradually lose their value, stability, robustness, and compatibility with other enterprise technologies. The longer these applications are left unattended or simply "keeping the lights on," the more risks they will bring to the application portfolio, such as:
These impacts are further compounded by the continuous work done on a system burdened with technical debt. Technical debt describes the result of avoided costs that, over time, cause ongoing business impacts. Left unaddressed, technical debt can become an existential threat that risks your organization's ability to effectively compete and serve its customers. Unfortunately, most organizations have a significant, growing, unmanageable technical debt portfolio.
|
of respondents stated they saw an increase in perceived change in technical debt during the past three years. A quarter of respondents indicated that it stayed the same. Source: McKinsey Digital, 2020. |
|
US |
is the average cost of a data breach in 2022. This figure represents a 2.6% increase from last year. The average cost has climbed 12.7% since 2020. Source: IBM, 2022; N=537. |
|---|
Historical decisions to meet business demands by deferring key quality, architectural, or other software delivery activities often lead to inefficient and incomplete code, fragile legacy systems, broken processes, data quality problems, and the other contributors to technical debt. The impacts for this challenge is further heightened if organizations are not actively refactoring and updating their applications behind the scenes. Proactive application management is intended to raise awareness of application fragility and prioritize comprehensive refactoring activities alongside new feature development.
Applications are designed, developed, and tested against a specific set of parameters which may become less relevant over time as the business matures, technology changes, and user behaviors and interactions shift. Continuous monitoring of the application system, regular stakeholder and user feedback, and active technology trend research and vendor engagement will reveal tasks to prepare an application for future value opportunities or stability and resilience concerns.
Innovative approaches to infiltrating and compromising applications are becoming prevailing stakeholder concerns. The loopholes and gaps in existing application security protocols, control points, and end-user training are exploited to gain the trust of unsuspecting users and systems. Proactive application management enforces continuous security reviews to determine whether applications are at risk. The goal is to prevent an incident from happening by hardening or complementing measures already in place.
Users expect the same level of performance and experience from their applications in all scenarios. A proactive approach ensures the configurations meet the current needs of users and dependent technologies.
Proactively managed applications are resilient to the latest security concerns and upcoming trends.
Continuous improvements to the underlying architecture, codebase, and interfaces can minimize the cost to maintain and operate the application, such as the transition to a loosely coupled architecture and the standardization of REST APIs.
Stakeholders may not see the association between the application's value and its technical quality.
Updates and enhancements are system changes much like any application function. Depending
on the priority of these changes, new functions may be pushed off to a future release cycle.
Applications teams require dedicated capacity to proactively manage applications, but they are often occupied meeting other stakeholder demands.
Overinvesting in certain application management activities (such as refactoring, re-architecture, and redesign) can create more challenges. Knowing how much to do is important.
| Attracting and Retaining Talent |
Shift focus from maintenance to innovation. Work on the most pressing and critical requests first, with a prioritization framework reflecting cross-functional priorities. |
|---|---|
| Maximizing the Return on Technology |
Improve the reliability of mission-critical applications.Regularly verify and validate applications are up to date with the latest patches and fixes and comply with industry good practices and regulations. |
| Confidently Shifting to Digital |
Prepare applications to support digital tools and technologies.Focus enhancements on the key components required to support the integration, performance, and security needs of digital. |
| Addressing Competing Priorities |
Rationalize the health of the applications.Use data-driven, compelling insights to justify the direction and prioritization of applications initiatives. |
| Fostering a Collaborative Culture |
Include the technical perspective in the viability of future applications plans.Demonstrate how poorly maintained applications impede the team's ability to deliver confidently and quickly. |
| Creating High-Throughput Teams |
Simplify applications to ease delivery and maintenance.Refactor away application complexities and align the application portfolio to a common quality standard to reduce the effort to deliver and test changes. |
Maintenance is often viewed as a support function rather than an enabler of business growth. Focus and investments are only placed on maintenance when it becomes a problem.
Ensure product issues, incidents, defects, and change requests are promptly handled to minimize business and IT risks.
Related Research:
Apply the appropriate management approaches to maintain business continuity and balance priorities and commitments among maintenance and new development requests.
This practice serves as the foundation for creating exceptional customer experience by emphasizing cross-functional accountability for business value and product and service quality.
Related Research:
Technical debt is a type of technical risk, which in turn is business risk. It's up to the business to decide whether to accept technical debt or mitigate it. Create a compelling argument to stakeholders as to why technical debt should be a business priority rather than just an IT one.
Related Research:
Application portfolio management is nearly impossible to perform without an honest and thorough understanding of your portfolio's alignment to business capabilities, business value, total cost of ownership, end-user reception and satisfaction, and technical health.
Develop data-driven insights to help you decide which applications to retire, upgrade, retrain on, or maintain to meet the demands of the business.
Related Research:
Site reliability engineering (SRE) is an operational model for running online services more reliably by a team of dedicated reliability-focused engineers.
DevOps, an operational philosophy promoting development and operations collaboration, can bring the critical insights to make application management practices through SRE more valuable.
Related Research:
A government agency needed to implement a disciplined, sustainable application delivery, planning, and management process so their product delivery team could deliver features and changes faster with higher quality. The goal was to ensure change requests, fixes, and new features would relieve requester frustrations, reduce regression issues, and allow work to be done on agreeable and achievable priorities organization-wide. The new model needed to increase practice efficiency and visibility in order to better manage technical debt and focus on value-added solutions.
This organization recognized a number of key challenges that were inhibiting its team's ability to meet its goals:
Source: Info-Tech Workshop
Various market and company factors are motivating a review on resource and system sourcing strategies. The right sourcing model provides key skills, resources, and capabilities to meet innovation, time to market, financial, and quality goals of the business. However, organizations struggle with how best to support sourcing partners and to allocate the right number of resources to maximize success.
A multisource system is an ecosystem of integrated internally and externally developed applications, data, and infrastructure. These technologies can be custom developed, heavily configured vendor solutions, or they may be commercial off-the-shelf (COTS) solutions. These systems can also be developed, supported, and managed by internal staff, in partnership with outsourced contractors, or be completely outsourced. Multisource systems should be configured and orchestrated in a way that maximizes the delivery of specific value drivers for the targeted audience.
Defining and executing a sourcing approach can be a significant investment and risk because of the close interactions third-party services and partners will have with internal staff, enterprise applications and business capabilities. A careful selection and design is necessary.
The selection of a sourcing partner is not simple. It involves the detailed inspection and examination of different candidates and matching their fit to the broader vision of the multisource system. In cases where control is critical, technology stack and resource sourcing consolidation to a few vendors and partners is preferred. In other cases, where worker productivity and system flexibility are highly prioritized, a plug-and-play best-of-breed approach is preferred.
The image that your applications department and teams want to reflect is frequently dependent on the applications they deliver and support, the resources they are composed of, and the capabilities they provide.
Therefore, choosing the right sourcing approach should be driven by understanding who the teams are and want to be (e.g. internal builder, an integrator, a plug-in player), what they can or want to do (e.g. custom-develop or implement), and what they can deliver or support (e.g. cloud or on-premises) must be established.
Well-integrated systems are the lifeblood of your organization. They provide the capabilities needed to deliver value to customers, employees, and stakeholders. However, underlying system components may not be sourced under a unified strategy, which can lead to duplicate vendor services and high operational costs.
The right sourcing approach ensures your partners address key capabilities in your system's delivery and support, and that they are positioned to maximize the value of critical and high-impact components.
Outsourcing and shifting to a buy-over-build applications strategy are common quick fixes to dealing with capacity and skills gaps. However, these quick fixes often become long-term implementations that are not accounted for in the sourcing selection process. Current application and resource sourcing strategies must be reviewed to ensure that vendor arrangements meet the current and upcoming demands and challenges of the business, customers, and enterprise technologies, such as:
|
of respondents stated they outsourced software development fully or partly in the last 12 months (2021). Source: Coding Sans, 2021. |
|
of respondents stated they were at least somewhat satisfied with the result of outsourcing software development. Source: Coding Sans, 2021. |
Employees are implementing and building applications without consulting, notifying, or heeding the advice of IT. IT is often ill-equipped and under-resourced to fight against shadow IT. Instead, organizations are shifting the mindset of "fight shadow IT" to "embrace business-managed applications," using good practices in managing multisource systems. A multisource approach strikes the right balance between user empowerment and centralized control with the solutions and architecture that can best enable it.
Point solutions offer features to address unique use cases in uncommon technology environments. However, point solutions are often deployed in siloes with limited integration or overlap with other solutions. The right sourcing strategy accommodates the fragmented nature of point solutions into a broader enterprise system strategy, whether that be:
Some vendor services in a multisource environment may be redundant, conflicting, or incompatible. Given that multisource systems are regularly changing, it is difficult to identify what services are affected, what would be needed to fill the gap of the removed solution, or which redundant services should be removed.
A multisource approach motivates the continuous rationalization of your vendor services and partners to determine the right mixture of in-house and outsourced resources, capabilities, and technologies.
Multisource systems can be designed to support an employee's ability to select the tools they want and need.
The environment is architected in a loosely coupled approach to allow applications to be easily added, removed, and modified with minimized impact to other integrated applications.
Rather than investing in large solutions upfront, applications are adopted when they are needed and are removed when little value is gained. Disciplined application portfolio management is necessary to see the full value of this benefit.
The increased number and diversity of applications in multisource system environments can overwhelm system managers who do not have an effective application portfolio management practice.
Fragmented application implementations risk inconsistent adherence to security and other quality policies, especially in situations where IT is not involved.
Application integration can quickly become tangled, untraceable, and unmanageable because of varying team and vendor preferences for specific integration technologies and techniques.
Success can be dependent on your ability to address your pressure points.
| Attracting and Retaining Talent |
Enable business-managed applications.Create the integrations to enable the easy connection of desired tools to enterprise systems with the appropriate guardrails. |
|---|---|
| Maximizing the Return on Technology |
Enhance the functionality of existing applications.Complement current application capability gaps with data, features, and services from third-party applications. |
| Confidently Shifting to Digital |
Use best-of-breed tools to meet specific digital needs.Select the best tools to meet the unique and special functional needs of the digital vision. |
| Addressing Competing Priorities |
Agree on a common philosophy on system composition.Establish an owner of the multisource system to guide how the system should mature as the organization grows. |
| Fostering a Collaborative Culture |
Discuss how applications can work together better in an ecosystem.Build committees to discuss how applications can better support each other and drive more value. |
| Creating High-Throughput Teams |
Alleviate delivery bottlenecks and issues.Leverage third-party sources to fill skills and capacity gaps until a long-term solution can be implemented. |
Understanding the applications team's purpose and image is critical in determining how the system they are managing and the skills and capacities they need should be sourced.
Changing and conflicting definitions of value and goals make it challenging to convey an agreeable strategy of the multisource system. An achievable vision and practical tactics ensure all parties in the multisource system are moving in the same direction.
Related Research:
Almost half of all sourcing initiatives do not realize projected savings, and the biggest reason is the choice of partner (Zhang et al., 2018). Making the wrong choice means inferior products, higher costs and the loss of both clients and reputation.
Choosing the right sourcing partner involves understanding current skills and capacities, finding the right matching partner based on a desired profile, and managing a good working relationship that sees short-term gains and supports long-term goals.
Related Research:
Integration strategies that are focused solely on technology are likely to complicate rather than simplify because little consideration is given on how other systems and processes will be impacted. Enterprise integration needs to bring together business process, applications, and data – in that order.
Kick-start the process of identifying opportunities for improvement by mapping how applications and data are coordinated to support business activities.
Related Research:
Haphazardly implementing and integrating applications can generate significant security, performance, and data risks. A well-thought-through solution architecture is essential in laying the architecture quality principles and roadmap on how the multisource system can grow and evolve in a sustainable and maintainable way.
Good application portfolio management complements the solution architecture as it indicates when low-value and unused applications should be removed to reduce system complexity.
Related Research:
Multisource systems bring a unique opportunity to support the business and end users' desire to implement and develop their own applications. However, traditional models of managing applications may not accommodate the specific IT governance and management practices required to operate business-managed applications:
Related Research:
Source: interview with Jay MacIsaac, Cognizant.
A digital platform enables organizations to leverage a flexible, reliable, and scalable foundation to create a valuable DX, ease delivery and management efforts, maximize existing investments, and motivate the broader shift to digital. This approach provides a standard to architect, integrate, configure, and modernize the applications that compose the platform.
Digital organization as a platform (DOaaP) is a collection of integrated digital services, products, applications, and infrastructure that is used as a vehicle to meet and exceed an organization's digital strategies. It often serves as an accessible "place for exchanges of information, goods, or services to occur between producers and consumers as well as the community that interacts
with said platform" (Watts, 2020).
DOaaP involves a strategy that paves the way for organizations to be digital. It helps organizations use their assets (e.g. data, processes, products, services) in the most effective ways and become more open to cooperative delivery, usage, and management. This opens opportunities for innovation and cross-department collaborations.
Digital organizations are driven by customer focus, meeting and exceeding customer expectations. It must design its services with a "digital first" principle, providing access through every expected channel and including seamless integration and interoperability with various departments, partners, and third-party services. It also means creating trust in its ability to provide secure services and to keep privacy and ethics as core pillars.
Digital leadership brings customer focus to the enterprise and its structures and organizes efficient networks and ecosystems. Accomplishing this means getting rid of silos and a siloed mentality and aligning on a digital vision to design policies and services that are efficient, cost-effective, and provide maximum benefit to the user. Asset sharing, co-creation, and being open and transparent become cornerstones of a digital organization.
Providing digital services across demographics and geographies requires infrastructure, and that in turn requires long-term vision, smart investments, and partnerships with various source partners to create the necessary foundational infrastructure upon which to build digital services.
Automation and digitization of processes and services, as well as creating digital-first products, lead to increased efficiency and reach of the organization across demographics and geographies. Moreover, by taking a digital-first approach, digital organizations future-proof their services and demonstrate their commitment to stakeholders.
DOaaP embraces open standards, designing and developing organizational platforms and ecosystems with a cloud-first mindset and sound API strategies. Developer experience must also take center stage, providing the necessary tools and embracing Agile and DevOps practices and culture become prerequisites. Cybersecurity and privacy are central to the digital platform; hence they must be part of the design and development principles and practices.
Digital transformation continues to be a high-priority initiative for many organizations, and they see DOaaP as an effective way to enable and exploit digital capabilities. However, DOaaP unleashes new strategies, opportunities, and challenges that are elusive or unfamiliar to business leaders. Barriers in current business operating models may limit DOaaP success, such as:
DOaaP is not just about technology, and it is not the sole responsibility of either IT or business. It is the collective responsibility of the organization.
|
of organizations plan to unlock new value through digital. 50% of organizations are planning major transformation over the next three years. Source: Nash Squared, 2022. |
|
of organizations are undertaking digital expansion projects focused on scaling their business with technology. This result is up from 57% in 2021. Source: F5 Inc, 2022. |
Users should have the same experience and perception of a brand no matter what product or service they use. However, fragmented implementation of digital technologies and inconsistent application of design standards makes it difficult to meet this expectation. DOaaP embraces a single design and DX standard for all digital products and services, which creates a consistent perception of your organization's brand and reputation irrespective of what products and services are being used and how they are accessed.
Rapid advancement of end-user devices and changes to end-user behaviors and expectations often outpace an organization's ability to meet these requirements. This can make certain organization products and services difficult to find, access and leverage. DOaaP creates an intuitive and searchable interface to all products and services and enables the strategic combination of technologies to collectively deliver more value.
Many opportunities are left off the table when legacy systems are abstracted away rather than modernized. However, legacy systems may not justify the investment in modernization because their individual value is outweighed by the cost. A DOaaP initiative motivates decision makers to look at the entire system (i.e. modern and legacy) to determine which components need to be brought up to a minimum digital state. The conversation has now changed. Legacy systems should be modernized to increase the collective benefit of the entire DOaaP.
A single, modern, customizable interface enables a common look and feel no matter what and how the platform is being accessed.
Organizations can motivate and encourage the adoption and use of all products and services through the platform and increase the adoption of underused technologies.
DOaaP motivates and supports the modernization of data, processes, and systems to meet the goals and objectives outlined in the broader digital transformation strategy.
Each system may have a different definition of commonly used entities (e.g. customer), which can cause data quality issues when information is shared among these systems.
DOaaP can stress the performance of underlying systems due to the limitations of some systems to handle increased traffic.
Some systems cannot be modernized due to cost constraints, business continuity risks, vendor lock-in, legacy and lore, or other blocking factors.
Limited appetite to make the necessary changes to business operations in order to maximize the value of DOaaP technologies.
| Attracting and Retaining Talent | Promote and showcase achievements and successes. Share the valuable and innovative work of your teams across the organization and with the public. |
|---|---|
| Maximizing the Return on Technology | Increase visibility of underused applications. Promote the adoption and use of all products and services through the platform and use the lessons learned to justify removal, updates or modernizations. |
| Confidently Shifting to Digital | Bring all applications up to a common digital standard. Define the baseline digital state all applications, data, and processes must be in to maximize the value of the platform. |
| Addressing Competing Priorities | Map to a holistic platform vision, goals and objectives. Work with relevant stakeholders, teams and end users to agree on a common directive considering all impacted perspectives. |
| Fostering a Collaborative Culture | Ensure the platform is configured to meet the individual needs of the users. Tailor the interface and capabilities of the platform to address users' functional and personal concerns. |
| Creating High-Throughput Teams | Abstract the enterprise system to expedite delivery. Use the platform to standardize application system access to simplify platform changes and quicken development and testing. |
Organizations realize that a digital model is the way to provide more effective services to their customers and end users in a cost-effective, innovative, and engaging fashion. DOaaP is a way to help support this transition.
However, various platform stakeholders will have different interpretations of and preferences for what this platform is intended to solve, what benefits it is supposed to deliver, and what capabilities it will deliver. A grounded vision is imperative to steer the roadmap and initiatives.
Related Research:
Certain applications may not sufficiently support the compatibility, flexibility, and efficiency requirements of DOaaP. While workaround technologies and tactics can be employed to overcome these application challenges, the full value of the DOaaP may not be realized.
Reviewing the current state of the application portfolio will indicate the functional and value limitations of what DOaaP can provide and an indication of the scope of investment needed to bring applications up to a minimum state.
Related Research:
Technology has reached a point where it's no longer difficult for teams to build functional and valuable digital platforms. Rather, the difficulty lies in creating an interface and platform that people want to use and use frequently.
While it is important to increase the access and promotion of all products and services, orchestrating and configuring them in a way to deliver a satisfying experience is even more important. Applications teams must first learn about and empathize with the needs of end users.
Related Research:
Formalizing and constructing DOaaP just for the sake of doing so often results in an initiative that is lengthy and costly and ends up being considered a failure.
The build and optimization of the platform must be predicated on a thorough understanding of the DOaaP's goals, objectives, and priorities and the business capabilities and process they are meant to support and enable. The appropriate architecture and delivery practices can then be defined and employed.
Related Research:
The digital strategy of Estonia resulted in e-Estonia, with the vision of "creating a society with more transparency, trust, and efficiency." Estonia has addressed the challenge by creating structures, organizations, and a culture of innovation, and then using the speed and efficiency of digital infrastructure, apps, and services. This strategy can reduce or eliminate bureaucracy through transparency and automation.
Estonia embarked on its journey to making digital a priority in 1994-1996, focusing on a committed investment in infrastructure and digital literacy. With that infrastructure in place, they started providing digital services like an e-banking service (1996), e-tax and mobile parking (2002), and then went full steam ahead with a digital information interoperability platform in 2001, digital identity in 2002, e-health in 2008, and e-prescription in 2010. The government is now strategizing for AI.

Source: e-Estonia
The e-Estonia digital government model serves as a reference for governments across the world; this is acknowledged by the various awards it has received, like #2 in "internet freedom," awarded by Freedom House in 2019; #1 on the "digital health index," awarded by the Bertelsmann Foundation in 2019; and #1 on "start-up friendliness," awarded by Index Venture in 2018.
"15th State of Agile Report." Digital.ai, 2021. Web.
"2022 HR Trends Report." McLean & Company, 2022.
"2022: State of Application Strategy Report." F5 Inc, 2022.
"Are Executives Wearing Rose-Colored Glasses Around Digital Transformation?" Cyara, 2021. Web.
"Cost of a Data Breach Report 2022." IBM, 2022. Web.
Dalal, Vishal, et al. "Tech Debt: Reclaiming Tech Equity." McKinsey Digital, Oct. 2020. Web.
"Differentiating Between Intelligent Automation and Hyperautomation." IBM, 15 October 2021. Web.
"Digital Leadership Report 2021." Harvey Nash Group, 2021.
"Digital Leadership Report 2022: The State of Digital." Nash Squared, 2022. Web.
Gupta, Sunil. "Driving Digital Strategy: A Guide to Reimagining Your Business." Harvard Business Review Press, 2018. Web.
Haff, Gordon. "State of Application Modernization Report 2022." Konveyor, 2022. Web.
"IEEE Standard for Software Maintenance: IEEE Std 1219-1998." IEEE Standard for Software Maintenance, 1998. Accessed Dec. 2015.
"Intelligent Automation." Cognizant, n.d. Web.
"Kofax 2022: Intelligent Automation Benchmark Study". Kofax, 2021. Web.
McCann, Leah. "Barco's Virtual Classroom at UCL: A Case Study for the Future of All University Classrooms?" rAVe, 2 July 2020, Web.
"Proactive Staffing and Patient Prioritization to Decompress ED and Reduce Length of Stay." University Hospitals, 2018. Web.
"Secrets of Successful Modernization." looksoftware, 2013. Web.
"State of Software Development." Coding Sans, 2021. Web.
"The State of Low-Code/No-Code." Creatio, 2021. Web.
"We Have Built a Digital Society and We Can Show You How." e-Estonia. n.d. Web.
Zanna. "The 5 Types of Experience Series (1): Brand Experience Is Your Compass." Accelerate in Experience, 9 February 2020. Web.
Zhang, Y. et al. "Effects of Risks on the Performance of Business Process Outsourcing Projects: The Moderating Roles of Knowledge Management Capabilities." International Journal of Project Management, 2018, vol. 36 no. 4, 627-639.
Chris Harrington
Chief Technology Officer
Carolinas Telco Federal Credit Union
Chris Harrington is Chief Technology Officer (CTO) of Carolinas Telco Federal Credit Union. Harrington is a proven leader with over 20 years of experience developing and leading information technology and cybersecurity strategies and teams in the financial industry space.
Benjamin Palacio
Senior Information Technology Analyst County of Placer
Benjamin Palacio has been working in the application development space since 2007 with a strong focus on system integrations. He has seamlessly integrated applications data across multiple states into a single reporting solution for management teams to evaluate, and he has codeveloped applications to manage billions in federal funding. He is also a CSAC-credentialed IT Executive (CA, USA).
Scott Rutherford
Executive Vice President, Technology
LGM Financial Services Inc.
Scott heads the Technology division of LGM Financial Services Inc., a leading provider of warranty and financing products to automotive OEMs and dealerships in Canada. His responsibilities include strategy and execution of data and analytics, applications, and technology operations.
Robert Willatts
IT Manager, Enterprise Business Solutions and Project Services
Town of Newmarket
Robert is passionate about technology, innovation, and Smart City Initiatives. He makes customer satisfaction as the top priority in every one of his responsibilities and accountabilities as an IT manager, such as developing business applications, implementing and maintaining enterprise applications, and implementing technical solutions. Robert encourages communication, collaboration, and engagement as he leads and guides IT in the Town of Newmarket.
Randeep Grewal
Vice President, Enterprise Applications
Red Hat
Randeep has over 25 years of experience in enterprise applications, advanced analytics, enterprise data management, and consulting services, having worked at numerous blue-chip companies. In his most recent role, he is the Vice President of Enterprise Applications at Red Hat. Reporting to the CIO, he is responsible for Red Hat's core business applications with a focus on enterprise transformation, application architecture, engineering, and operational excellence. He previously led the evolution of Red Hat into a data-led company by maturing the enterprise data and analytics function to include data lake, streaming data, data governance, and operationalization of analytics for decision support.
Prior to Red Hat, Randeep was the director of global services strategy at Lenovo, where he led the strategy using market data to grow Lenovo's services business by over $400 million in three years. Prior to Lenovo, Randeep was the director of advanced analytics at Alliance One and helped build an enterprise data and analytics function. His earlier work includes seven years at SAS, helping SAS become a leader in business analytics, and at KPMG consulting, where he managed services engagements at Fortune 100 companies.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Begin the process by identifying your VMO’s ROI maturity level and which calculation components are most appropriate for your situation.
Set measurement baselines and goals for the next measurement cycle.
Measure the VMO's ROI and value created by the VMO’s efforts and the overall internal satisfaction with the VMO.
Report the results to key stakeholders and executives in a way that demonstrates the value added by the VMO to the entire organization.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine how you will measure the VMO’s ROI.
Focus your measurement on the appropriate activities.
1.1 Determine your VMO’s maturity level and identify applicable ROI measurement categories.
1.2 Review and select the appropriate ROI formula components for each applicable measurement category.
1.3 Compile a list of potential data sources, evaluate the viability of each data source selected, and assign data collection and analysis responsibilities.
1.4 Communicate progress and proposed ROI formula components to executives and key stakeholders for feedback and/or approval/alignment.
VMO ROI maturity level and first step of customizing the ROI formula components.
Second and final step of customizing the ROI formula components…what will actually be measured.
Viable data sources and assignments for team members.
A progress report for key stakeholders and executives.
Set baselines to measure created value against.
ROI contributions cannot be objectively measured without baselines.
2.1 Gather baseline data.
2.2 Calculate/set baselines.
2.3 Set SMART goals.
2.4 Communicate progress and proposed ROI formula components to executives and key stakeholders for feedback and/or approval/alignment.
Data to use for calculating baselines.
Baselines for measuring ROI contributions.
Value creation goals for the next measurement cycle.
An updated progress report for key stakeholders and executives.
Calculate the VMO’s ROI.
An understanding of whether the VMO is paying for itself.
3.1 Assemble the data and calculate the VMO’s ROI.
3.2 Organize the data for the reporting step.
The VMO’s ROI expressed in terms of how many times it pays for itself (e.g. 1X, 3X, 5X).
Determine which supporting data will be reported.
Report results to stakeholders.
Stakeholders understand the value of the VMO.
4.1 Create a reporting template.
4.2 Determine reporting frequency.
4.3 Decide how the reports will be distributed or presented.
4.4 Send out a draft report and update based on feedback.
A template for reporting ROI and supporting data.
A decision about quarterly or annual reports.
A decision regarding email, video, and in-person presentation of the ROI reports.
Final ROI reports.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the breadth of the regulation’s requirements and document roles and responsibilities.
Define your GDPR scope and prioritize initiatives based on risk.
Understand the requirements for a record of processing and determine who will own it.
Document your DPO decision and align security strategy to data privacy.
Prioritize any initiatives driven out of Phases 1-4 and begin developing policies that help in the documentation effort.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Kick-off the workshop; understand and define GDPR as it exists in your organizational context.
Prioritize your business units based on GDPR risk.
Assign roles and responsibilities.
1.1 Kick-off and introductions.
1.2 High-level overview of weekly activities and outcomes.
1.3 Identify and define GDPR initiative within your organization’s context.
1.4 Determine what actions have been done to prepare; how have regulations been handled in the past?
1.5 Identify key business units for GDPR committee.
1.6 Document business units and functions that are within scope.
1.7 Prioritize business units based on GDPR.
1.8 Formalize stakeholder support.
Prioritized business units based on GDPR risk
GDPR Compliance RACI Chart
Know the rationale behind a record of processing.
Determine who will own the record of processing.
2.1 Understand the necessity for a record of processing.
2.2 Determine for each prioritized business unit: are you a controller or processor?
2.3 Develop a record of processing for most-critical business units.
2.4 Perform legitimate interest assessments.
2.5 Document an iterative process for creating a record of processing.
Initial record of processing: 1-2 activities
Initial legitimate interest assessment: 1-2 activities
Determination of who will own the record of processing
Review existing security controls and highlight potential requirements.
Ensure the initiatives you’ll be working on align with existing controls and future goals.
3.1 Determine the appetite to align the GDPR project to data classification and data discovery.
3.2 Discuss the benefits of data discovery and classification.
3.3 Review existing incident response plans and highlight gaps.
3.4 Review existing security controls and highlight potential requirements.
3.5 Review all initiatives highlighted during days 1-3.
Highlighted gaps in current incident response and security program controls
Documented all future initiatives
Review project plan and initiatives and prioritize.
Finalize outputs of the workshop, with a strong understanding of next steps.
4.1 Analyze the necessity for a data protection officer and document decision.
4.2 Review project plan and initiatives.
4.3 Prioritize all current initiatives based on regulatory compliance, cost, and ease to implement.
4.4 Develop a data protection policy.
4.5 Finalize key deliverables created during the workshop.
4.6 Present the GDPR project to key stakeholders.
4.7 Workshop executive presentation and debrief.
GDPR framework and prioritized initiatives
Data Protection Policy
List of key tools
Communication plans
Workshop summary documentation
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this step-by-step guide to assess your ransomware readiness and implement controls that will improve your ability to prevent incursions and defend against attacks.
Use this assessment tool to assess existing protection, detection, response, and recovery capabilities and identify potential improvements.
Use this threat preparedness workbook to evaluate the threats and tactics in the ransomware kill chain using the MITRE framework and device appropriate countermeasures.
Adapt this tabletop planning session template to plan and practice the response of your internal IT team to a ransomware scenario.
Adapt these workflow and runbook templates to coordinate the actions of different stakeholders through each stage of the ransomware incident response process.
Adapt this tabletop planning session template to plan leadership contributions to the ransomware response workflow. This second tabletop planning session will focus on communication strategy, business continuity plan, and deciding whether the organization should pay a ransom.
Summarize your current state and present a prioritized project roadmap to improve ransomware resilience over time.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Set workshop goals, review ransomware trends and risk scenarios, and assess the organization’s resilience to ransomware attacks.
Develop a solid understanding of the likelihood and impact of a ransomware attack on your organization.
Complete a current state assessment of key security controls in a ransomware context.
1.1 Review incidents, challenges, and project drivers.
1.2 Diagram critical systems and dependencies and build risk scenario.
1.3 Assess ransomware resilience.
Workshop goals
Ransomware Risk Scenario
Ransomware Resilience Assessment
Improve your capacity to protect your organization from ransomware and detect attacks along common vectors.
Identify targeted countermeasures that improve protection and detection capabilities.
2.1 Assess ransomware threat preparedness.
2.2 Determine the impact of ransomware techniques on your environment.
2.3 Identify countermeasures to improve protection and detection capabilities.
Targeted ransomware countermeasures to improve protection and detection capabilities.
Targeted ransomware countermeasures to improve protection and detection capabilities.
Targeted ransomware countermeasures to improve protection and detection capabilities.
· Improve your organization’s capacity to respond to ransomware attacks and recover effectively.
Build response and recovery capabilities that reduce the potential business disruption of successful ransomware attacks.
3.1 Review the workflow and runbook templates.
3.2 Update/define your threat escalation protocol.
3.3 Define scenarios for a range of incidents.
3.4 Run a tabletop planning exercise (IT).
3.5 Update your ransomware response runbook.
Security Incident Response Plan Assessment.
Tabletop Planning Session (IT)
Ransomware Workflow and Runbook.
Identify prioritized initiatives to improve ransomware resilience.
Identify the role of leadership in ransomware response and recovery.
Communicate workshop outcomes and recommend initiatives to improve ransomware resilience.
4.1 Run a tabletop planning exercise (Leadership).
4.2 Identify initiatives to close gaps and improve resilience.
4.3 Review broader strategies to improve your overall security program.
4.4 Prioritize initiatives based on factors such as effort, cost, and risk.
4.5 Review the dashboard to fine tune your roadmap.
4.6 Summarize status and next steps in an executive presentation.
Tabletop Planning Session (Leadership)
Ransomware Resilience Roadmap and Metrics
Ransomware Workflow and Runbook
Ransomware is a high-profile threat that demands immediate attention:
Ransomware is more complex than other security threats:
To prevent a ransomware attack:
Resilience is not a trampoline, where you're down one moment and up the next. It's more like climbing a mountain. It takes time, planning, and help from people around you to work through challenges. Focus on what is in your organization's control, and cultivate strengths that allow you to protect assets, detect incursions, respond effectively, and recovery quickly.
As I write, the frequency and impact of ransomware attacks continue to increase, with no end in sight. Most organizations will experience ransomware in the next 24 months, some more than once, and business leaders know it. You will never have a better chance to implement best practice security controls as you do now.
The opportunity comes with important challenges. Hackers need to spend less time in discovery before they deploy an attack, which have become much more effective. You can't afford to rely solely on your ability to respond and recover. You need to build a resilient organization that can withstand a ransomware event and recover quickly.
Resilient organizations are not impervious to attack, but they have tools to protect assets, detect incursions, and respond effectively. Resilience is not a trampoline, where you're down one moment and up the next. It's more like climbing a mountain. It takes time, planning, and help from people around you to overcome challenges and work through problems. But eventually you reach the top and look back at how far you've come.
Michel Hébert
Research Director, Security and Privacy
Info-Tech Research Group
Three factors contribute to the threat:
Elementus maps ransomware payments made through bitcoin. Since 2019, victims made at least $2B in payments.
A handful of criminal organizations, many of whom operate out of cybercrime hotbeds in Russia, are responsible for most of the damage. The numbers capture only the ransom paid, not the clean-up cost and economic fallout over attacks during this period.
Emerging strains can exfiltrate sensitive data, encrypt systems and destroy backups in only a few hours, which makes recovery a grueling challenge.
Sophos commissioned a vendor agnostic study of the real-world experience of 5,600 IT professionals in mid-sized organizations across 31 countries and 15 industries.
The survey was conducted in Jan – Feb 2022 and asked about the experience of respondents over the previous year.
66%
Hit by ransomware in 2021
(up from 37% in 2020)
90%
Ransomware attack affected their ability to operate
$812,360 USD
Average ransom payment
$4.54M
Average remediation cost
(not including ransom)
ONE MONTH
Average recovery time
Meanwhile, organizations continue to put their faith in ineffective ransomware defenses.
Of the respondents whose organizations weren't hit by ransomware in 2021 and don't expect to be hit in the future, 72% cited either backups or cyberinsurance as reasons why they anticipated an attack.
While these elements can help recover from an attack, they don't prevent it in the first place.
Source: Sophos, State of Ransomware (2022)
IBM, Cost of A Data Breach (2022)
At each point of the playbook, malicious agents need to achieve something before they can move to the next step.
Resilient organizations look for opportunities to:
|
Initial access Execution |
Privilege Escalation Credential Access |
Lateral Movement Collection |
Data Exfiltration |
Data encryption |
|---|---|---|---|---|
|
Deliver phishing email designed to avoid spam filter. Launch malware undetected. |
Identify user accounts. Target an admin account. Use brute force tactics to crack it. |
Move through the network and collect data. Infect as many critical systems and backups as possible to limit recovery options. |
Exfiltrate data to gain leverage. |
Encrypt data, which triggers alert. Deliver ransom note. |
Ransomware groups thrive through extortion tactics.
Ransom is only a small part of the equation. Four process-related activities drive ransomware recovery costs:
Source: IBM, Cost of a Data Breach (2022)
An effective response with strong, available backups will reduce the operational impact of an attack, but it won't spare you from its reputational and regulatory impact.
Put controls in place to disrupt each stage of the attack workflow to protect the organization from intrusion, enhance detection, respond quickly, and recover effectively.
Ransomware dwell times and average encryption rates are improving dramatically.
Hackers spend less time in your network before they attack, and their attacks are much more effective.
Avg dwell time
3-5 Days
Avg encryption rate
70 GB/h
Avg detection time
11 Days
Dwell time is the time between when a malicious agent gains access to your environment and when they are detected. In a ransomware attack, most organizations don't detect malicious agents until they deploy ransomware, encrypt their files, and lock them out until they pay the ransom.
Effective time is a measure of the effectiveness of the encryption algorithm. Encryption rates vary by ransomware family. Lockbit has the fastest encryption rate, clocking in at 628 GB/h.
It's more critical than ever to build ransomware resilience. Most organizations do not detect ransomware incursions in time to prevent serious business disruption.
References: Bleeping Computers (2022), VentureBeat, Dark Reading, ZDNet.
This blueprint will focus on improving your ransomware resilience to:
|
Response |
Recovery |
|---|---|
|
|
|
For in-depth assistance with disaster recovery planning, refer to Info-Tech's Create a Right-Sized Disaster Recovery. |
|
Disrupt the playbooks of ransomware gangs. Put controls in place to protect, detect, respond and recover effectively.
Put controls in place to harden your environment, train savvy end users, and prevent incursions.
Build and test a backup strategy that meets business requirements to accelerate recovery and minimize disruption.
| Protect | Detect | Respond |
Recover |
Review ransomware threat techniques and prioritize detective and mitigation measures for initial and credential access, privilege escalation, and data exfiltration.
Develop security awareness content and provide cybersecurity and resilience training to employees, contractors and third parties.
Identify and implement network security solutions including analytics, network and email traffic monitoring, and intrusion detection and prevention.
Identify disruption scenarios and develop incident response, business continuity, and disaster recovery strategies.
Review the user access management program, policies and procedures to ensure they are ransomware-ready.
Develop proactive vulnerability and patch management programs that mitigate ransomware techniques and tactics.
| Assess resilience | Protect and detect | Respond and recover | Improve resilience | |
|---|---|---|---|---|
| Phase steps |
|
|
|
|
| Phase outcomes |
|
|
|
|
Resilience is not a trampoline, where you're down one moment and up the next. It's more like climbing a mountain. It takes time, planning, and help from people around you to work through challenges.
Focus on what is in your organization's control, and cultivate strengths that allow you to protect assets, detect incursions, and respond and recover quickly
Build risk scenarios that describe how a ransomware attack would impact organizational goals.
Understand possible outcomes to motivate initiatives, protect your organization, plan your response, and practice recovery.
Dwell times and effective times are dropping dramatically. Malicious agents spend less time in your network before they deploy an attack, and their attacks are much more effective. You can't afford to rely on your ability to respond and recover alone.
The frequency and impact of ransomware attacks continue to increase, and business leaders know it. You will never have a better chance to implement best practice security controls than you do now.
The anatomy of ransomware attack is relatively simple: malicious agents get in, spread, and profit. Deploy ransomware protection metrics to measure ransomware resilience at each stage.
The resilience roadmap captures the key insights your work will generate, including:
Info-Tech supports project and workshop activities with deliverables to help you accomplish your goals and accelerate your success.
Ransomware Resilience Assessment
Measure ransomware resilience, identify gaps, and draft initiatives.
Enterprise Threat Preparedness Workbook
Analyze common ransomware techniques and develop countermeasures.
Ransomware Response Workflow & Runbook
Capture key process steps for ransomware response and recovery.
Run tabletops for your IT team and your leadership team to gather lessons learned.
Capture project insights and measure resilience over time.
Organizations worldwide spent on average USD 4.62M in 2021 to rectify a ransomware attack. These costs include escalation, notification, lost business and response costs, but did not include the cost of the ransom. Malicious ransomware attacks that destroyed data in destructive wiper-style attacks cost an average of USD 4.69M.
Building better now is less expensive than incurring the same costs in addition to the clean-up and regulatory and business disruption costs associated with successful ransomware attacks.
After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research and advisory services helped them achieve.
Source: IBM, Cost of a Data Breach (2022)
See what members have to say about the ransomware resilience blueprint:
"Our advisor was well-versed and very polished. While the blueprint alone was a good tool to give us direction, his guidance made it significantly faster and easier to accomplish than if we had tried to tackle it on our own."
CIO, Global Manufacturing Organization
|
IT benefits |
Business benefits |
|---|---|
|
|
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."
SOURCE: Interview with CIO of large enterprise
Organizations who "build back better" after a ransomware attack often wish they had used relevant controls sooner.
In February 2020, a large organization found a ransomware note on an admin's workstation. They had downloaded a local copy of the organization's identity management database for testing and left a port open on their workstation. Hackers exfiltrated it and encrypted the data on the workstation. They demanded a ransom payment to decrypt the data.
Because private information was breached, the organization informed the state-level regulator. With 250,000 accounts affected, plans were made to require password changes en masse. A public announcement was made two days after the breach to ensure that everyone affected could be reached.
The organization decided not to pay the ransom because it had a copy on an unaffected server.
The organization was praised for its timely and transparent response.
The breach motivated the organization to put more protections in place, including:
SOURCE: Info-Tech Workshop Results
iNDUSTRY: Government
Regional government runs an Info-Tech workshop to fast-track its ransomware incident response planning
The organization was in the middle of developing its security program, rolling out security awareness training for end users, and investing in security solutions to protect the environment and detect incursions. Still, the staff knew they still had holes to fill. They had not yet fully configured and deployed security solutions, key security policies were missing, and they had didn't have a documented ransomware incident response plan.
Info-Tech advisors helped the organization conduct a systematic review of existing processes, policies, and technology, with an eye to identify key gaps in the organization's ransomware readiness. The impact analysis quantified the potential impact of a ransomware attack on critical systems to improve the organizational awareness ransomware risks and improve buy-in for investment in the security program.
Info-Tech's tabletop planning exercise provided a foundation for the organization's actual response plan. The organization used the results to build a ransomware response workflow and the framework for a more detailed runbook. The workshop also helped staff identifies ways to improve the backup strategy and bridge further gaps in their ability to recover.
The net result was a current-state response plan, appropriate capability targets aligned with business requirements, and a project roadmap to achieve the organization's desired state of ransomware readiness.
| Scoping Call | Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|---|
|
Call #1: Discuss context, identify challenges, and scope project requirements. Identify ransomware resilience metrics. |
Call #2: Build ransomware risk scenario. |
Call #4: Review common ransomware attack vectors. Identify and assess mitigation controls. |
Call #5: Document ransomware workflow and runbook. |
Call #7: Run tabletop test with leadership. |
|
Call #3: Assess ransomware resilience. |
Call #6: Run tabletop test with IT. |
Call #8: Build ransomware roadmap. Measure ransomware resilience metrics. |
A guided implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is 6 to 8 calls over the course of 4 to 6 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
| Activities |
Assess ransomware resilience |
Protect and detect |
Respond and recover |
Improve ransomware resilience |
Wrap-up (offsite and offline) |
|
1.1 1 Review incidents, challenges, and project drivers. 1.1.2 Diagram critical systems and dependencies. 1.1.3 Build ransomware risk scenario. |
2.1 1. Assess ransomware threat preparedness. 2.2 2. Determine the impact of ransomware techniques on your environment. 2.3 3. Identify countermeasures to improve protection and detection capabilities. |
3.1.1 Review the workflow and runbook templates. 3.1.2 Update/define your threat escalation protocol. 3.2.1 Define scenarios for a range of incidents. 3.2.2 Run a tabletop planning exercise (IT). 3.3.1 Update your ransomware response workflow. |
4.1.1 Run a tabletop planning exercise (leadership). 4.1.2 Identify initiatives to close gaps and improve resilience. 4.1.3 Review broader strategies to improve your overall security program. 4.2.1 Prioritize initiatives based on factors such as effort, cost, and risk. 4.2.2 Review the dashboard to fine tune your roadmap. 4.3.1 Summarize status and next steps in an executive presentation. |
5.1 Complete in-progress deliverables from previous four days. 5.2 Set up review time for workshop deliverables and to discuss next steps. 5.3 Revisit ransomware resilience metrics in three months. |
|
| Deliverables |
|
|
|
|
|
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
|
1.1 Build ransomware risk scenario 1.2 Conduct resilience assessment |
2.1 Assess attack vectors 2.2 Identify countermeasures |
3.1 Review Security Incident Management Plan 3.2 Run Tabletop Test (IT) 3.3 Document Workflow and Runbook |
4.1 Run Tabletop Test (Leadership) 4.2 Prioritize resilience initiatives 4.3 Measure resilience metrics |
This phase will walk you through the following activities:
This phase involves the following participants:
1.1.1 Review incidents, challenges and project drivers
1.1.2 Diagram critical systems and dependencies
1.1.3 Build ransomware risk scenario
This step will guide you through the following activities:
This step involves the following participants:
Brainstorm the challenges you need to address in the project. Avoid producing solutions at this stage, but certainly record suggestions for later. Use the categories below to get the brainstorming session started.
Brainstorm critical systems and their dependencies to build a ransomware risk scenario. The scenario will help you socialize ransomware risks with key stakeholders and discuss the importance of ransomware resilience.
Focus on a few key critical systems.
Start with a WAN diagram, then your production data center, and then each critical
system. Use the next three slides as your guide.
When you get to this level of detail, use this opportunity to level-set with the team. Consider the following:
For now, make a note of these gaps and continue with the next step.
Risk scenarios are further distilled into a single sentence or risk statement that communicates the essential elements from the scenario.
Risk identification → Risk scenario → Risk statement
The slides walk through how to build a ransomware risk scenario
|
|||
|
An actor capable of harming an asset |
Anything of value that can be affected and results in loss |
Technique an actor uses to affect an asset |
How loss materializes |
|---|---|---|---|
|
Examples: Malicious or untrained employees, cybercriminal groups, malicious state actors |
Examples: Systems, regulated data, intellectual property, people |
Examples: Credential compromise, privilege escalation, data exfiltration |
Examples: Loss of data confidentiality, integrity, or availability; impact on staff health and safety |
Risk scenarios are concise, four to six sentence narratives that describe the core elements of forecasted adverse events.
Use them to engage stakeholders with the right questions and guide them to make informed decisions about how to address ransomware risks.
In a ransomware risk scenario, the threat, their motivations, and their methods are known. Malicious agents are motivated to compromise critical systems, sabotage recovery, and exfiltrate data for financial gain.
The purpose of building the risk scenario is to highlight the assets at risk and the potential effect of a ransomware attack.
As a group, consider critical or mission-essential systems identified in step 1.1.2. On a whiteboard, brainstorm the potential adverse effect of a loss of system availability, confidentiality or integrity.
Consider the impact on:
Inputs for risk scenario identification
|
Risk analysis |
|||
|---|---|---|---|
|
Critical assets |
ERP, CRM, FMS, LMS |
Operational technology |
Sensitive or regulated data |
|
Threat agents |
Cybercriminals |
||
|
Methods |
Compromise end user devices through social engineering attacks,. Compromise networks through external exposures and software vulnerabilities. Identify and crack administrative account. Escalate privileges. Move laterally. Collect data, destroy backups, exfiltrate data for leverage, encrypt systems,. Threaten to publish exfiltrated data and demand ransom. |
||
|
Adverse effect |
Serious business disruption Financial damage Reputational damage Potential litigation Average downtime: 30 Days Average clean-up costs: USD 1.4M |
||
Likelihood: Medium
Impact: High
Cyber-criminals penetrate the network, exfiltrate critical or sensitive data, encrypt critical systems, and demand a ransom to restore access.
They threaten to publish sensitive data online to pressure the organization to pay the ransom, and reach out to partners, staff, and students directly to increase the pressure on the organization.
Network access likely occurs through a phishing attack, credential compromise, or remote desktop protocol session.
Cybercriminals penetrate the network, compromise backups, exfiltrate and encrypt data, and disrupt computer systems for financial gain.
Threat Actor:
Assets:
Effect:
Methods:
1.2.1 Complete resilience assessment
1.2.2 Establish resilience metrics
The maturity levels are based on the Capability Maturity Model Integration framework. We outline our modifications below.
|
CMMI Maturity Level – Default Descriptions: |
CMMI Maturity Level – Modified for This Assessment: |
|---|---|
|
|
(Source: CMMI Institute, CMMI Levels of Capability and Performance)
Disrupt the playbooks of ransomware gangs. Put controls in place to protect, detect, respond and recover effectively.
Put controls in place to harden your environment, train savvy end users, and prevent incursions.
Build and test a backup strategy that meets business requirements to accelerate recovery and minimize disruption.
| Protect | Detect | Respond |
Recover |
Review ransomware threat techniques and prioritize detective and mitigation measures for initial and credential access, privilege escalation, and data exfiltration.
Develop security awareness content and provide cybersecurity and resilience training to employees, contractors and third parties.
Identify and implement network security solutions including analytics, network and email traffic monitoring, and intrusion detection and prevention.
Identify disruption scenarios and develop incident response, business continuity, and disaster recovery strategies.
Review the user access management program, policies and procedures to ensure they are ransomware-ready.
Develop proactive vulnerability and patch management programs that mitigate ransomware techniques and tactics.
Use the Ransomware Resilience Assessment Tool to assess maturity of existing controls, establish a target state, and identify an initial set of initiatives to improve ransomware resilience.
Keep the assessment tool on hand to add gap closure initiatives as you proceed through the project.
Download the Ransomware Resilience Assessment
Ransomware resilience metrics track your ability to disrupt a ransomware attack at each stage of its workflow.
Measure metrics at the start of the project to establish a baseline, as the project nears completion to measure progress.
| Attack workflow | Process | Metric | Target trend | Current | Goal |
|---|---|---|---|---|---|
| GET IN | Vulnerability Management | % Critical patches applied | Higher is better | ||
| Vulnerability Management | # of external exposures | Fewer is better | |||
| Security Awareness Training | % of users tested for phishing | Higher is better | |||
| SPREAD | Identity and Access Management | Adm accounts / 1000 users | Lower is better | ||
| Identity and Access Management | % of users enrolled for MFA | Higher is better | |||
| Security Incident Management | Avg time to detect | Lower is better | |||
| PROFIT | Security Incident Management | Avg time to resolve | Lower is better | ||
| Backup and Disaster Recovery | % critical assets with recovery test | Higher is better | |||
| Backup and Disaster Recovery | % backup to immutable storage | Higher is better |
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Build ransomware risk scenario 1.2 Conduct resilience assessment | 2.1 Assess attack vectors 2.2 Identify countermeasures | 3.1 Review Security Incident Management Plan 3.2 Run Tabletop Test (IT) 3.3 Document Workflow and Runbook | 4.1 Run Tabletop Test (Leadership) 4.2 Prioritize resilience initiatives 4.3 Measure resilience metrics |
This phase will walk you through the following activities:
This phase involves the following participants:
2.1.1 Assess ransomware threat preparedness
2.1.2 Determine the impact of ransomware techniques on your environment
This step involves the following activities:
This step involves the following participants:
Assess risks associated with common ransomware attack vectors.
Download the Enterprise Threat Preparedness Workbook
Deliver phishing email designed to avoid spam filter. Launch malware undetected. | Identify user accounts. Target an admin account. Use brute force tactics to crack it. | Move through the network. Collect data. Infect critical systems and backups to limit recovery options. | Exfiltrate data to gain leverage. | Encrypt data, which triggers alert. Deliver ransom note. |
Once you're comfortable, follow the instructions on the following pages to configure the MITRE ransomware analysis and identify how to improve your protection and detection capabilities.
Download the Enterprise Threat Preparedness Workbook
If you would like to change the set-up, go through the following steps.
The following slides walk you through the process with screenshots from the workbook.
Download the Enterprise Threat Preparedness Workbook
Dwell times and effective times are dropping dramatically. Malicious agents spend less time in your network before they deploy an attack, and their attacks are much more effective. You can't afford to rely on your ability to respond and recover alone.
As you fill out the Tactic tabs with your evaluation, the overall reading will display the average of your overall preparedness for that tactic.
Choosing the Technique Domain level will increase the accuracy of the reporting at the cost of speed.
The Technique level is faster but provides less specifics for each control and analyzes them as a group.
The Sub-Technique level is much more granular, but each tactic and technique has several sub-techniques that you will need to account for.
Check with the dashboard to see the associated risk level for each of the tactics based on the legend. Tactics that appear white have not yet been assessed or are rated as "N/A" (not applicable).
When you select your Technique Domain, you cannot change it again. Changing the domain mid-analysis will introduce inaccuracies in your security preparedness.
How an attacker will attempt to achieve their goals through a specific action.
The corresponding ID number on the MITRE ATT&CK® Matrix for quick reference.
If an attack of this type is successful on your network, how deep does the damage run?
What security protocols do you have in place right now that can help prevent an attacker from successfully executing this attack technique? The rating is based on the CMMI scale.
We highly recommend that you write comments about your current-state security protocols. First, it's great to have documented your thought processes in the event of a threat modeling session. Second, you can speak to deficits clearly, when asked.
You may discover that you have little to no mitigation actions in place to deal with one or many of these techniques. However, look at this discovery as a positive: You've learned more about the potential vectors and can actively work toward remediating them rather than hoping that a breach never happens through one of these avenues.
|
If you have chosen the Sub-Technique level, the tool should resemble this image.
Each sub-technique has a note for additional context and understanding about what the techniques are seeking to do and how they may impact your enterprise.
|
|
2.2.1 Identify countermeasures
Identification of countermeasures to common ransomware techniques, and tactics to improve protection and detection capabilities.
As you work through the tool, your dashboard will prioritize your threat preparedness for each of the various attack techniques to give you an overall impression of your preparedness.
For each action, the tool includes detection and remediation actions for you to consider either for implementation or as table stakes for your next threat modeling sessions.
Note: Some sheets will have the same controls. However, the context of the attack technique may change your answers. Be sure to read the tactic and technique that you are on when responding to the controls.
Prioritize the analysis of ransomware tactics and sub-techniques identified on slide 45. If your initial analysis in Activity 2.2.1 determined that you have robust security protocols for some of the attack vectors, set these domains aside.
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Build ransomware risk scenario 1.2 Conduct resilience assessment | 2.1 Assess attack vectors 2.2 Identify countermeasures | 3.1 Review Security Incident Management Plan 3.2 Run Tabletop Test (IT) 3.3 Document Workflow and Runbook | 4.1 Run Tabletop Test (Leadership) 4.2 Prioritize resilience initiatives 4.3 Measure resilience metrics |
This phase will guide you through the following steps:
This phase involves the following participants:
3.1.1 Review the workflow and runbook templates
3.1.2 Update/define your threat escalation protocol
This step will walk you through the following activities:
This step involves the following participants:
This blueprint includes sample information in the Ransomware Response Workflow Template and Ransomware Response Runbook Template to use as a starting points for the steps in Phase 3, including documenting your threat escalation protocol.
Download the Ransomware Response Workflow Template
Download the Ransomware Response Runbook Template
Document the Threat Escalation Protocol sections in the Ransomware Response Workflow Template or review/update your existing runbook. The threat escalation protocol defines which stakeholders to involve in the incident management process, depending on impact and scope. Specifically, you will need to define the following:
Impact and scope criteria: Impact considers factors such as the criticality of the system/data, whether PII is at risk, and whether public notification is required. Scope considers how many systems or users are impacted.
Severity assessment: Define the severity levels based on impact and scope criteria.
Relevant stakeholders: Identify stakeholders to notify for each severity level, which can include external stakeholders.
If you need additional guidance, see Info-Tech's Develop and Implement a Security Incident Management Program blueprint, which takes a broader look at security incidents.
3.2.1 Define scenarios for a range of incidents
3.2.2 Run a tabletop planning exercise
As a group, collaborate to define scenarios that enable you to develop incident response details for a wide range of potential incidents. Below are example scenarios:
Note: The above is too much to execute in one 30-minute session, so plan a series of exercises as outlined on the next slide.
Schedule these sessions well in advance to ensure appropriate resources are available. Document this in an annual test plan summary that outlines the scope, participants, and dates and times for the planned sessions.
Remember that the goal is a deeper dive into how you would respond to an attack so you can clarify steps and gaps. This is not meant to just be a read-through of your plan. Follow the guidelines below:
Refer to the Ransomware Tabletop Planning Results – Example as a guide for what to capture. Aim for more detail than found in your Ransomware Response Workflow (but not runbook-level detail).
Download the Ransomware Tabletop Planning Results – Example
3.3.1 Update your ransomware response workflow
3.3.2 Update your ransomware response runbook
Use the results from your tabletop planning exercises (Activity 3.2.2) to update and clarify your ransomware response workflow. For example:
Use the results from your tabletop planning exercises (Activity 3.2.2) to update your ransomware response runbook. For example:
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Build ransomware risk scenario 1.2 Conduct resilience assessment | 2.1 Assess attack vectors 2.2 Identify countermeasures | 3.1 Review Security Incident Management Plan 3.2 Run Tabletop Test (IT) 3.3 Document Workflow and Runbook | 4.1 Run Tabletop Test (Leadership) 4.2 Prioritize resilience initiatives 4.3 Measure resilience metrics |
In addition to applying your existing security practices to your backup solution (e.g. anti-malware, restricted access), consider:
This example strategy combines multiple restore points, offsite backup, different storage media, and immutable backups.
Zero trust is a strategy that reduces reliance on perimeter security and moves controls to where your user accesses resources. It often consolidates security solutions, reduces operating costs, and enables business mobility.
IT security needs to determine how zero trust initiatives will affect core business processes. It's not a one-size-fits-all approach to IT security. Zero trust is the goal – but some organizations can only get so close to that ideal.
For more information, see Build a Zero-Trust Roadmap.
A successful zero-trust strategy should evolve. Use an iterative and repeatable process to assess available zero-trust technologies and principles and secure the most relevant protect surfaces. Collaborate with stakeholders to develop a roadmap with targeted solutions and enforceable policies.
Download the Ransomware Resilience Assessment
Prioritize initiatives in the Ransomware Resilience Assessment.
Review and update the roadmap dashboard in your Ransomware Resilience Assessment.
4.3.1 Summarize status and next steps in an executive presentation
Gain stakeholder buy-in by communicating the risk of the status quo and recommendations to reduce that risk. Specifically, capture and present the following from this blueprint:
Overall key findings and next steps.
Download the Ransomware Readiness Summary Presentation Template
Ransomware resilience metrics track your ability to disrupt a ransomware attack at each stage of its workflow.
Revisit metrics as the project nears completion and compare them against your baseline to measure progress.
| Attack workflow | Process | Metric | Target trend | Current | Goal |
|---|---|---|---|---|---|
| GET IN | Vulnerability Management | % Critical patches applied | Higher is better | ||
| Vulnerability Management | # of external exposures | Fewer is better | |||
| Security Awareness Training | % of users tested for phishing | Higher is better | |||
| SPREAD | Identity and Access Management | Adm accounts / 1000 users | Lower is better | ||
| Identity and Access Management | % of users enrolled for MFA | Higher is better | |||
| Security Incident Management | Avg time to detect | Lower is better | |||
| PROFIT | Security Incident Management | Avg time to resolve | Lower is better | ||
| Backup and Disaster Recovery | % critical assets with recovery test | Higher is better | |||
| Backup and Disaster Recovery | % backup to immutable storage | Higher is better |
|
Project overview |
Project deliverables |
|---|---|
|
This blueprint helped you create a ransomware incident response plan for your organization, as well as identify ransomware prevention strategies and ransomware prevention best practices. |
|
|
Project phases |
|
|
Phase 1: Assess ransomware resilience Phase 2: Protect and detect Phase 3: Respond and recover Phase 4: Improve ransomware resilience |
Tab 3. Initiative List in the Ransomware Resilience Assessment identifies relevant Info-Tech Research to support common ransomware resilience initiatives.
Jimmy Tom
AVP of Information Technology and Infrastructure
Financial Horizons
Dan Reisig
Vice President of Technology
UV&S
Samuel Sutton
Computer Scientist (Retired)
FBI
Ali Dehghantanha
Canada Research Chair in Cybersecurity and Threat Intelligence,
University of Guelph
Gary Rietz
CIO
Blommer Chocolate Company
Mark Roman
CIO
Simon Fraser University
Derrick Whalen
Director, IT Services
Halifax Port Authority
Stuart Gaslonde
Director of IT & Digital Services
Falmouth-Exeter Plus
Deborah Curtis
CISO
Placer County
Deuce Sapp
VP of IT
ISCO Industries

Trevor Ward
Information Security Assurance Manager
Falmouth-Exeter Plus
Brian Murphy
IT Manager
Placer County
Arturo Montalvo
CISO
Texas General Land Office and Veterans Land Board
Mduduzi Dlamini
IT Systems Manager
Eswatini Railway
Mike Hare
System Administrator
18th Circuit Florida Courts
Linda Barratt
Director of Enterprise architecture, IT Security, and Data Analytics, Toronto Community Housing Corporation

Josh Lazar
CIO
18th Circuit Florida Courts
Douglas Williamson
Director of IT
Jamaica Civil Aviation Authority
Ira Goldstein
Chief Operating Officer
Herjavec Group
Celine Gravelines
Senior Cybersecurity Analyst
Encryptics
Dan Mathieson
Mayor
City of Stratford
Jacopo Fumagalli
CISO
Omya
Matthew Parker
Program Manager
Utah Transit Authority
Two Additional Anonymous Contributors
2019-Data-Breach-Investigations-Report.-Verizon,-May-2019.
2019-Midyear-Security-Roundup:-Evasive-Threats,-Persistent-Effects.-Trend-Micro,-2019.
Abrams,-Lawrence.-"Ryuk-Ransomware-Uses-Wake-on-Lan-to-Encrypt-Offline-Devices."-Bleeping-Computer,-14-Jan.-2020.
Abrams,-Lawrence.-"Sodinokibi-Ransomware-Publishes-Stolen-Data-for-the-First-Time."-Bleeping-Computer,-11-Jan.-2020.
Canadian-Center-for-Cyber-Security,-"Ransomware-Playbook,"-30-November-2021.-Accessed-21-May-2022.-
Carnegie-Endowment-for-International-Peace.-"Ransomware:-Prevention-and-Protection."-Accessed-May-2022.-
Cawthra,-Jennifer,-Michael-Ekstrom,-Lauren-Lusty,-Julian-Sexton,-John-Sweetnam.-Special-Publication-1800-26-Data-Integrity:-Detecting-and-Responding-to-Ransomware-and-Other-Destructive-Events.-NIST,-Jan.-2020.
Cawthra,-Jennifer,-Michael-Ekstrom,-Lauren-Lusty,-Julian-Sexton,-John-Sweetnam.-Special-Publication-1800-25-Data-Integrity:-Identifying-and-Protecting-Assets-Against-Ransomware-and-Other-Destructive-Events.-NIST,-Jan.-2020.-
Cichonski,-P.,-T.-Millar,-T.-Grance,-and-K.-Scarfone.-"Computer-Security-Incident-Handling-Guide."-SP-800-61-Rev.-2.-NIST,-Aug.-2012.
Cimpanu,-Catalin.-"Company-shuts-down-because-of-ransomware,-leaves-300-without-jobs-just-before-holidays."-ZDNet,-3-Jan.-2020.
Cimpanu,-Catalin.-"Ransomware-attack-hits-major-US-data-center-provider."-ZDNet,-5-Dec.-2019.
CISA,-"Stop-Ransomware,"-Accessed-12-May-2022.
"CMMI-Levels-of-Capability-and-Performance."-CMMI-Institute.-Accessed-May-2022.-
Connolly,-Lena-Yuryna,-"An-empirical-study-of-ransomware-attacks-on-organizations:-an-assessment-of-severity-and-salient-factors-affecting-vulnerability."-Journal-of-Cybersecurity,-2020,.-1-18.
"Definitions:-Backup-vs.-Disaster-Recovery-vs.-High-Availability."-CVM-IT-&-Cloud-Services,-12-Jan.-2017.
"Don't-Become-a-Ransomware-Target-–-Secure-Your-RDP-Access-Responsibly."-Coveware,-2019.-
Elementus,-"Rise-of-the-Ransomware-Cartels-"(2022).-YouTube.-Accessed-May-2022.-
Global-Security-Attitude-Survey.-CrowdStrike,-2019.
Graham,-Andrew.-"September-Cyberattack-cost-Woodstock-nearly-$670,00:-report."-
Global-News,-10-Dec.-2019.
Harris,-K.-"California-2016-Data-Breach-Report."-California-Department-of-Justice,-Feb.-2016.
Hiscox-Cyber-Readiness-Report-2019.-Hiscox-UK,-2019.
Cost-of-A-Data-Breach-(2022).-IBM.-Accessed-June-2022.--
Ikeda,-Scott.-"LifeLabs-Data-Breach,-the-Largest-Ever-in-Canada,-May-Cost-the-Company-Over-$1-Billion-in-Class-Action-Lawsuit."-CPO-Magazine,-2020.
Kessem,-Limor-and-Mitch-Mayne.-"Definitive-Guide-to-Ransomware."-IBM,-May-2022.
Krebs,-Brian.-"Ransomware-Gangs-Now-Outing-Victim-Businesses-That-Don't-Pay-Up."-Krebson-Security,-16-Dec.-2019.
Jaquith,-Andrew-and-Barnaby-Clarke,-"Security-metrics-to-help-protect-against-ransomware."-Panaseer,-July-29,-2021,-Accessed-3-June-2022.
"LifeLabs-pays-ransom-after-cyberattack-exposes-information-of-15-million-customers-in-B.C.-and-Ontario."-CBC-News,-17-Dec.-2019.
Matthews,-Lee.-"Louisiana-Suffers-Another-Major-Ransomware-Attack."-Forbes,-20-Nov.-2019.
NISTIR-8374,-"Ransomware-Risk-Management:-A-Cybersecurity-Framework-Profile."-NIST-Computer-Security-Resource-Center.-February-2022.-Accessed-May-2022.-
"Ransomware-attack-hits-school-district-twice-in-4-months."-Associated-Press,-10-Sept.-2019.
"Ransomware-Costs-Double-in-Q4-as-Ryuk,-Sodinokibi-Proliferate."-Coveware,-2019.
Ransomware-Payments-Rise-as-Public-Sector-is-Targeted,-New-Variants-Enter-the-Market."-Coveware,-2019.
Rector,-Kevin.-"Baltimore-to-purchase-$20M-in-cyber-insurance-as-it-pays-off-contractors-who-helped-city-recover-from-ransomware."-The-Baltimore-Sun,-16-Oct.-2019.
"Report:-Average-time-to-detect-and-contain-a-breach-is-287-days."-VentureBeat,-May-25,-2022.-Accessed-June-2022.-
"Five-Lessons-Learned-from-over-600-Ransomware-Attacks."-Riskrecon.-Mar-2022.-Accessed-May-2022.-
Rosenberg,-Matthew,-Nicole-Perlroth,-and-David-E.-Sanger.-"-'Chaos-is-the-Point':-Russian-Hackers-and-Trolls-Grow-Stealthier-in-2020."-The-New-York-Times,-10-Jan.-2020.
Rouse,-Margaret.-"Data-Archiving."-TechTarget,-2018.
Siegel,-Rachel.-"Florida-city-will-pay-hackers-$600,000-to-get-its-computer-systems-back."-The-Washington-Post,-20-June-2019.
Sheridan,-Kelly.-"Global-Dwell-Time-Drops-as-Ransomware-Attacks-Accelerate."-DarkReading,-13-April-2021.-Accessed-May-2022.-
Smith,-Elliot.-"British-Banks-hit-by-hacking-of-foreign-exchange-firm-Travelex."-CNBC,-9-Jan.-2020.
"The-State-of-Ransomware-2022."-Sophos.-Feb-2022.-Accessed-May-2022.-
"The-State-of-Ransomware-in-the-U.S.:-2019-Report-for-Q1-to-Q3."-Emsisoft-Malware-Lab,-1-Oct.2019.
"The-State-of-Ransomware-in-the-U.S.:-Report-and-Statistics-2019."-Emsisoft-Lab,-12-Dec.-2019.
"The-State-of-Ransomware-in-2020."-Black-Fog,-Dec.-2020.
Toulas,-Bill.-"Ten-notorious-ransomware-strains-put-to-the-encryption-speed-test."-Bleeping-Computers,-23-Mar-2022.-Accessed-May-2022.
Tung,-Liam-"This-is-how-long-hackers-will-hide-in-your-network-before-deploying-ransomware-or-being-spotted."-zdnet.-May-19,-2021.-Accessed-June-2022.-
M365 projects are fraught with obstacles. Common mistakes organizations make include:
There are three primary areas where organizations fail in a successful implementation of M365: training, adoption, and information governance. While it is not up to IT to ensure every user is well trained, it is their initial responsibility to find champions, SMEs, and business-based trainers and manage information governance from the backup, retention, and security aspects of data management.
Migrating to M365 is a disruptive move for most organizations. It poses risk to untrained IT staff, including admins, help desk, and security teams. The aim for organizations, especially in this new hybrid workspace, is to maintain efficiencies through collaboration, share information in a secure environment, and work from anywhere, any time.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
There are three primary goals when deploying Microsoft 365: productivity, security and compliance, and collaborative functionality. On top of these you need to meet the business KPIs and IT’s drive for adoption and usage. This research will guide you through the important considerations that are often overlooked as this powerful suite of tools is rolled out to the organization.
![]() |
There are three primary objectives when deploying Microsoft 365: from a business perspective, the expectations are based on productivity; from an IT perspective, the expectations are based on IT efficiencies, security, and compliance; and from an organizational perspective, they are based on a digital employee experience and collaborative functionality. Of course, all these expectations are based on one primary objective, and that is user adoption of Teams, OneDrive, and SharePoint Online. A mass adoption, along with a high usage rate and a change in the way users work, is required for your investment in M365 to be considered successful. So, adoption is your first step, and that can be tracked and analyzed through analytics in M365 or other tools. But what else needs to be considered once you have released M365 on your organization? What about backup? What about security? What about sharing data outside your business? What about self-service? What about ongoing training? M365 is a powerful suite of tools, and taking advantage of all that it entails should be IT’s primary goal. How to accomplish that, efficiently and securely, is up to you! |
John Donovan |
Collaboration, efficiencies, and cost savings need to be earned |
Migrating to M365 is a disruptive move for most organizations. Additionally, it poses risk to untrained IT staff, including admins, help desk, and security teams. The aim for organizations, especially in this new hybrid workspace, is to maintain efficiencies through collaboration, share information in a secure environment, and work from anywhere, any time. However, organizations need to manage their licensing and storage costs and build this new way of working through post-deployment planning. By reducing their hardware and software footprint they can ensure they have earned these savings and efficiencies. |
Understand any shortcomings in M365 or pay the price |
Failing to understand any shortcomings M365 poses for your organization can ruin your chances at a successful implementation. Commonly overlooked expenses include backup and archiving, especially for regulated organizations; spending on risk mitigation through third-party tools for security; and paying a premium to Microsoft to use its Azure offerings with Microsoft Sentinel, Microsoft Defender, or any security add-on that comes at a price above your E5 license, which is expensive in itself. |
Spend time with users to understand how they will use M365 |
Understanding business processes is key to anticipating how your end users will adopt M365. By spending time with the staff and understanding their day-to-day activities and interactions, you can build better training scenarios to suit their needs and help them understand how the apps in M365 can help them do their job. On top of this you need to meet the business KPIs and IT’s drive for adoption and usage. Encourage early adopters to become trainers and champions. Success will soon follow. |
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
M365 is a full suite of tools for collaboration, communication, and productivity, but organizations find the platform is not used to its full advantage and fail to get full value from their license subscription. Many users are unsure which tool to use when: Do you use Teams or Viva Engage, MS Project or Planner? When do you use SharePoint versus OneDrive? From an IT perspective, finding time to help users at the outset is difficult – it’s quite the task to set up governance, security, and backup. Yet training staff must be a priority if the implementation is to succeed. |
M365 projects are fraught with obstacles. Common mistakes organizations make include:
|
To define your post-migration tasks and projects:
Failure to take meaningful action will not bode well for your M365 journey. |
There are three primary areas where organizations fail in a successful implementation of M365: training, adoption, and information governance. While it is not up to IT to ensure every user is well trained, it is their initial responsibility to find champions, SMEs, and business-based trainers and to manage information governance from backup, retention, and security aspects of data management.
What IT teams are saying
Top IT reasons for adopting M365
61% More collaborative working style
54% Cost savings
51% Improved cybersecurity
49% Greater mobility
Define Vision |
Build Team |
Plan Projects |
Execute |
|---|---|---|---|
Define your vision and what your priorities are for M365. Understand how to reach your vision. |
Ensure you have an executive sponsor, develop champions, and build a team of SMEs. |
List all projects in a to-be scenario. Rank and prioritize projects to understand impact and difficulty. |
Build your roadmap, create timelines, and ensure you have enough resources and time to execute and deliver to the business. |

A clear understanding of the business purpose and processes, along with insight into the organizational culture, will help you align the right apps with the right tasks. This approach will bring about better adoption and collaboration and cancel out the shadow IT products we see in every business silo.
To give organizations insight into the adoption of services in M365, Microsoft provides built-in usage analytics in Power BI, with templates for visualization and custom reports. There are third-party tools out there, but why pay more? However, the template app is not free; you do need a Power BI Pro license.
Usage Analytics pulls data from ActiveDirectory, including location, department, and organization, giving you deeper insight into how users are behaving. It can collect up to 12 months of data to analyze.
Reports that can be created include Adoption, Usage, Communication, Collaboration (how OneDrive and SharePoint are being used), Storage (cloud storage for mailboxes, OneDrive, and SharePoint), and Mobility (which clients and devices are used to connect to Teams, email, Yammer, etc.).
Admin Roles |
Best Practices |
|---|---|
|
Only assign two to four global admins, depending on the size of the organization. Too many admins increases security risk. In larger organizations, segment admin roles using role-based access control. Because admins have access to sensitive data, you’ll want to assign the least permissive role so they can access only the tools and data they need to do their job. Enable MFA for all admins except one break-glass account that is stored in the cloud and not synced. Ensure a complex password, stored securely, and use only in the event of an MFA outage. Due to the large number of admin roles available and the challenges that brings with it, Microsoft has a built-in tool to compare roles in the admin portal. This can help you determine which role should be used for specific tasks. |
Identity Checklist
Determine your training needs and align with your business processes. Choose training modalities that will give users the best chance of success. Consider one or many training methods, such as:
Why is M365 backup so important?
Accidental Data Deletion.
If a user is deleted, that deletion gets replicated across the network. Backup can save you here by restoring that user.
Internal and External Security Threats.
Malicious internal deletion of data and external threats including viruses, ransomware, and malware can severely damage a business and its reputation. A clean backup can easily restore the business’ uninfected data.
Legal and Compliance Requirements.
While e-discovery and legal hold are available to retain sensitive data, a third-party backup solution can easily search and restore all data to meet regulatory requirements – without depending on someone to ensure a policy was set.
Retention Policy Gaps.
Retention policies are not a substitute for backup. While they can be used to retain or delete content, they are difficult to keep track of and manage. Backups offer greater latitude in retention and better security for that data.
Legacy |
Microsoft 365 |
|---|---|
SharePoint 2016/19 |
SharePoint Online |
Microsoft Exchange Server |
Microsoft Exchange in Azure |
Skype for Business Server |
Teams |
Trello |
Planner 2022 |
System Center Configuration Manager (SCCM) |
Endpoint Manager, Intune, Autopilot |
File servers |
OneDrive |
Access |
Power Apps |
To meet the objectives of cost reduction and rationalization, look at synergies that M365 brings to the table. Determine what you are currently using to meet collaboration, storage, and security needs and plan to use the equivalent in your Microsoft entitlement.
There are plenty of preconfigured security features contained in M365, but what’s available to you depends on your license. For example, Microsoft Defender, which has many preset policies, is built-in for E5 licenses, but if you have E3 licenses Defender is an add-on.
Three elements in security policies are profiles, policies, and policy settings.
Check your license entitlement before you start purchasing add-ons or third-party solutions. Security and compliance are not optional in today’s cybersecurity risk world. With many organizations offering hybrid and remote work arrangements and bring-your-own-device (BYOD) policies, it is necessary to protect your data at the tenant level. Defender for Microsoft 365 is a tool that can protect both your exchange and collaboration environments.
More information: Microsoft 365 Defender
NOTE: You must have Azure AD Premium and Windows 10 V1703 or later as well as Intune or other MDM service to use Autopilot. There is a monthly usage fee based on volume of data transmitted. These fees can add up over time.
For more details visit the following Microsoft Learn pages:

Info-Tech’s research on zero-touch provisioning goes into more detail on Intune and Autopilot:
Simplify Remote Deployment With Zero-Touch Provisioning

Drive Ongoing Adoption With an M365 Center of Excellence
Simplify Remote Deployment With Zero-Touch Provisioning
“5 Reasons Why Microsoft Office 365 Backup Is Important.” Apps 4Rent, Dec 2021, Accessed Oct 2022 .
Chandrasekhar, Aishwarya. “Office 365 Migration Best Practices & Challenges 2022.” Saketa, 31 Mar 2022. Accessed Oct. 2022.
Chronlund, Daniel. “The Fundamental Checklist – Secure your Microsoft 365 Tenant”. Daniel Chronlund Cloud Tech Blog,1 Feb 2019. Accessed 1 Oct 2022.
Davies, Joe. “The Microsoft 365 Enterprise Deployment Guide.” Tech Community, Microsoft, 19 Sept 2018. Accessed 2 Oct 2022.
Dillaway, Kevin. “I Upgraded to Microsoft 365 E5, Now What?!.” SpyGlassMTG, 10 Jan 2022. Accessed 4 Oct. 2022.
Hartsel, Joe. “How to Make Your Office 365 Implementation Project a Success.” Centric, 20 Dec 2021. Accessed 2 Oct. 2022.
Jha, Mohit. “The Ultimate Microsoft Office 365 Migration Checklist for Pre & Post Migration.” Office365 Tips.Org, 24 June 2022. Accessed Sept. 2022.
Lang, John. “Why organizations don't realize the full value of Microsoft 365.“Business IT, 29 Nov 202I. Accessed 10 Oct 2022.
Mason, Quinn. “How to increase Office 365 / Microsoft 365 user adoption.” Sharegate, 19 Sept 2019. Accessed 3 Oct 2022.
McDermott, Matt. “6-Point Office 365 Post-Migration Checklist.” Spanning , 12 July 2019 . Accessed 4 Oct 2022.
“Microsoft 365 usage analytics.” Microsoft 365, Microsoft, 25 Oct 2022. Web.
Sharma, Megha. “Office 365 Pre & Post Migration Checklist.’” Kernel Data Recovery, 26 July 2022. Accessed 30 Sept. 2022.
Sivertsen, Per. “How to avoid a failed M365 implementation? Infotechtion, 19 Dec 2021. Accessed 2 Oct. 2022.
St. Hilaire, Dan. “Most Common Mistakes with Office 365 Deployment (and How to Avoid Them).“ KnowledgeWave, 4Mar 2019. Accessed Oct. 2022.
“Under the Hood of Microsoft 365 and Office 365 Adoption.” SoftwareONE, 2019. Web.
Your organization is considering holding an event online, or has been, but:
If you don't begin with strategy, you will fit your event to technology, instead of the other way around.
To determine your requirements:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This deck walks you through key decision points in creating virtual or hybrid events. Then, begin the process of selecting the right software by putting together the first draft of your requirements for a virtual event software solution.
The business should review the list of features and select which ones are mandatory and which are nice to have or optional. Add any features not included.
The COVID-19 pandemic imposed a dramatic digital transformation on the events industry. Though event ticket and registration software, mobile event apps, and onsite audio/visual technology were already important pieces of live events, the total transformation of events into online experiences presented major challenges to organizations whose regular business operations involve at least one annual mid-sized to large event (association meetings, conferences, trade shows, and more).
Many organizations worked to shift to online, or virtual events, in order to maintain business continuity. As time went on, and public gatherings began to restart, a shift to “hybrid” events began to emerge—events that accommodate both in-person and virtual attendance. Regardless of event type, this pivot to using virtual event software, or digital event technology, brings events more closely into IT’s areas of responsibility. If you don't begin with strategy, you risk fitting your event to technology, instead of the other way around.
If virtual and hybrid events are becoming standard forms of delivering content in your organization, use Info-Tech’s material to help define the scope of the event and your requirements, and to support your software selection process.
Emily Sugerman
Research Analyst, Infrastructure & Operations
Info-Tech Research Group
Your ChallengeThe organization (both on the business and IT sides) may not have extensive experience hosting events online. It is not immediately clear how a formerly in-person event’s activities translate to a virtual environment. Like the work-from-home transformation, bringing events online expands IT’s role and responsibilities. |
Common ObstaclesIt is not clear what technological capabilities are needed for the event, which capabilities you already own, and what you may need to purchase. Though virtual events remove some barriers to attendance (distance, travel), it introduces new complications and considerations for planners. Hybrid events introduce another level of complexity. |
Info-Tech’s ApproachIn order to determine your requirements: Determine the scope of the event. Narrow down your list of technical requirements. Use Info-Tech’s Rapid Application Selection Framework to select the right software solution. |
If you don't begin with strategy, you will fit your event to technology, instead of the other way around.
Though you do have some tools that support large meetings, it is not clear if you require a larger and more comprehensive virtual event solution. There is a need to determine what type of technology you might need to purchase versus leveraging what you already have.
It is difficult to quickly and practically identify core event requirements and how they translate into technical capabilities.
Maintaining or improving audience engagement is a perpetual challenge for virtual events.
|
38%
|
21%
|
40%
|
Source: Virtual Event Tech Guide, 2022
Events with networking objectives are not always well served by webinars, which are traditionally more limited in their interactive elements.
Events that include the conducting of organizational/association business (like voting) may have bylaws that make selecting a virtual solution more challenging.
Maintaining attendee engagement is more challenging in a virtual environment.
Prior to the pandemic, your organization may not have been as experienced in putting on fully virtual events, putting more responsibility in your corner as IT. Navigating virtual events can also require technological competencies that your attendee userbase may not universally possess.
Technological limitations and barriers to access can exclude potential attendees just as much as bringing events online can open up attendance to new audiences.
“We had 19,000 registrations from all over the world, almost 50 times the number of people we had expected to host in Amsterdam. . . . Most of this year’s [2020] attendees would not have been able to participate in a physical GrafanaCon in Amsterdam. That was a huge win.” – Raj Dutt, Grafana Labs CEO[5]
| Event | In-person | Online | 2022 |
| Microsoft Build | 2019: 6,000 attendees | 2020: 230,000+ registrants[1] | The 2022 conference was also held virtually[3] |
| Stanford Institute for Human-Centered Artificial Intelligence | A few hundred attendees expected for the original (cancelled) 2020 in-person conference | 2020: 30,000 attendees attended the “COVID-19 and AI” virtual conference[2] | The 2022 Spring Conference was a hybrid event[4] |
[1] Kelly, 2020; [2] Price, 2020; [3] Stanford Digital Economy Lab, 2022; [4] Warren, 2022; [5] Fast Company, 2020
Apply project management principles to your virtual/hybrid event planning process.
Online event planning should follow the same established principles as in-person event planning.
Align the event’s concept and objectives with organizational goals.
Source: Adapted from Event Management Body of Knowledge, CC BY 4.0
Budget: Determine your organization’s budget for this event to help decide the scope of the event and the purchasing decisions you make as you plan.
Internal human resources: Identify who in your organization is usually involved in the organization of this event and if they are available to organize this one.
List of communication and collaboration tools: Acquire the list of the existing communication and collaboration tools you are currently licensed for. Ensure you know the following information about each tool:
Your organization may hold a variety of in-person events that you now wish, for various reasons, to hold fully or partially online. Each event likely has a slightly different set of goals.
Before getting into the details of how to transition your event online, return to the business/organizational goals the event is serving.
Ensure each event (and each component of each event) maps back to an organizational goal.
If a component of the event does not align to an organizational goal, assess whether it should remain as part of the event.
Attendee goals: Who are your attendees? Why do they attend this event? What attendee needs does your event serve? What is your event’s value proposition? Are they intrinsically or extrinsically motivated to attend?
Event goals: From the organizer perspective, why do you usually hold this event? Who are your stakeholders?
Organizational goals: How do the event goals map to your organizational goals? Is there a clear understanding of what the event’s larger strategic purpose is.
Education: our attendees need to learn something new that they cannot learn on their own.
Networking: our attendees need to meet people and make new professional connections.
Professional development: our attendees have certain obligations to keep credentials updated or to present their work publicly to advance their careers.
Entertainment: our attendees need to have fun.
Commerce: our attendees need to buy and sell things.
You can review this after working through the other decision points and the scope becomes clearer.
| Planning roles | Description |
| Project manager | Shepherd event planning until completion while ensuring project remains on schedule and on budget. |
| Event manager | Correspond with presenters during leadup to event, communicate how to use online event tools/platform, perform tests with presenters/exhibitors, coordinate digital event staff/volunteers. |
| Program planner | Select the topics, speakers, activity types, content, streams. |
| Designer and copywriter | Design the event graphics; compose copy for event website. |
| Digital event technologist | Determine event technology requirements; determine how event technology fits together; prepare RFP, if necessary, for new hardware/software. |
| Platform administrator | Set up registration system/integrate registrations into platform(s) of choice; upload video files and collateral; add livestream links; add/delete staff roles and set controls and permissions; collect statistics and recordings after event. |
| Commercial partner liaison | Recruit sponsors and exhibitors (offer sponsorship packages); facilitate agreement/contract between commercial partners and organization; train commercial partners on how to use event technology; retrieve lead data. |
| Marketing/social media | Plan and execute promotional campaigns (email, social media) in the lead up to, and during, the event. Post-event, send follow-up communications, recording files, and surveys. |
| Event production roles | Description |
| Hosts/MCs |
Address attendees at beginning and end of event, and in-between sessions Provide continuity throughout event Introduce sessions |
| Producers |
Prepare presenters for performance Begin and end sessions Use controls to share screens, switch between feeds Send backchannel messages to presenters (e.g., "Up next," "Look into webcam") |
| Moderators |
Admit attendees from waiting room Moderate incoming questions from attendees Manage slides Pass questions to host/panelists to answer Moderate chat |
| IT support |
Manage event technology stack Respond to attendee technical issues Troubleshoot network connectivity problems Ensure audio and video operational Start and stop session recording Save session recordings and files (chat, Q&As) |
Input: List of attendee benefits, List of event goals, List of organizational goals
Output: Ranked list of event goals as they relate to attendee needs and organizational goals
Materials: Whiteboard/flip charts
Participants: Planning team
Identify your event archetype
Decompose the event into its component parts
Identify technical requirements that help meet event goals
Benefits:
Analyze your event’s:
Begin the digital event planning process by understanding how your event’s content is typically consumed. This will help you make decisions later about how best to deliver the content virtually.
Major content
Community
Commercial Partners
Major content
Community interactions
Meeting events
Administration
Major content
Major content
Major content
Use the event archetypes to help you identify your event’s core components and value proposition.
Avoid trying to exactly reproduce the formerly in-person event online. Instead, identify the value proposition of each event component, then determine what its virtual expression could be.
Goals: Information transfer; sales; lead generation.
Event component |
Face-to-face expression |
Value proposition of component |
Virtual expression |
| Attendee types | Paying attendees | Revenue for event organizer; sales and lead generation for booth rep | Access to virtual event space |
| Attendee types | Booth rep | Revenue for event organizer; information source for paying attendees | Access to virtual event space |
| Communication/connection | Conversation between booth rep and attendee | Lead generation for booth rep; information to inform decision making for attendee | Ability to enter open video breakout session staffed by booth reps OR Ability to schedule meeting times with booth rep Multiple booth reps on hand to monitor different elements of the booth (one person to facilitate the discussion over video, another to monitor chat and Q&A) |
| Communication/connection | Serendipitous conversation between attendees | Increased attendee contacts; fun | Multiple attendees can attend the booth’s breakout session simultaneously and participate in web conferencing, meeting chat, or submit questions to Q&A |
| Communication/connection | Badges scanned at booth/email sign-up sheets filled out at table | Lead generation for exhibitors | List of visitors to booth shared with exhibitor (if consent given by attendees) Ability for attendees to request to be contacted for more information |
| Exchange of material | Catering (complimentary coffee, pastries) | Obviate the need for attendees to leave the event for refreshments | N/A: not included in virtual event |
| Exchange of material | Pamphlets, product literature, swag | Portable information for attendee decision making | Downloadable files (pdf) |
| Location | Responsibility of both the organizers (tables, chairs, venue) and booth reps (posters, handouts) | Booth reps need a dedicated space where they can be easily found by attendees and advertise themselves | Booth reps need access to virtual platform to upload files, images, provide booth description |
| Engagement | Attendees able to visit all booths by strolling through space | Event organizers have a captive audience who is present in the immediacy of the event site | Attendees motivated to stay in the event space and attend booths through gamification strategies (points awarded for number of booths visited or appointments booked) |
| Length of event | 2 full days | Attendees travel to event site and spend the entire 2 days at the event, allowing them to be immersed in the event and absorb as much information in as little time as possible | Exhibitors’ visiting hours will be scheduled so they work for both attendees attending in Eastern Standard Time and Pacific Time |
| Metrics for success | -Positive word of mouth -Number of registrations |
These metrics can be used to advertise to future exhibitors and attendees | Number of virtual booths visited Number of file downloads Survey sent to attendees after event (favorite booths, preferred way to interact with exhibitors, suggestions for improvement, most valuable part of experience) |
Use the analytics and reporting features available in your event technology toolset to capture the data you want to measure. Decide how each metric will impact your planning process for the next event.
Examples of metrics:
Ensure the data you capture feeds into better planning for the next event
A greater event reach also means new data privacy considerations, depending on the location of your guests.
Concerns over the collection of personal electronic data may not have previously been a part of your event planning considerations. However, now that your event is online, it’s wise to explore which data protection regulations apply to you. Remember, even if your organization is not located in the EU, if any of your attendees are European data subjects you may still be required to comply with GDPR, which involves the notification of data collected, allowing for opt-out options and the right to have data purged. The data must be collected for a specific purpose; if that purpose is expired, it can no longer be retained. You also have an obligation to report any breaches.
What kind of accessibility laws are you subject to (AODA, WCAG2)? Regardless of compliance requirements, it is a good idea to ensure the online event follows accessibility best practices.
What event policies need to be documented?
How will you communicate them to attendees?
One trend in the large event and conference space in recent years has been the development of codes of conduct that attendees are required to abide by to continue participating in the event.
Now that your event is online, consider whether your code of conduct requires updating. Are there new types of appropriate/inappropriate online behavior that you need to define for your attendees?
If your organization has an event harassment reporting process, determine how this process will transfer over to the digital event.
Ensure the reporting process has an owner and a clear methodology to follow to deal with complaints, as well as a digital reporting channel (a dedicated email or form) that is only accessed by approved staff to protect sensitive information.
Plan for how you will mitigate technical risks during your virtual event
Provide presenters with a process to follow if technical problems arise.
Test audio hardware: Ensure speakers use headphones/earbuds and mics (they do not have to be fancy/expensive). Relying on the computer/laptop mic can lead to more ambient noise and potential feedback problems.
Check lighting: Avoid backlighting. Reposition speakers so they are not behind windows. Ask them to open/close shades. Add lamps as needed.
Prevent interruptions: Before the event, ask panelists to turn phone and computer notifications to silent. Put a sign on the door saying Do not Disturb.
Control audience view of screenshare: If your presenters will be sharing their screens, teach them how this works on the platform they are using. Advise them to exit out of any other application that is not part of their presentation, so they do not share the wrong screen unintentionally. Advise them to remove anything from the desktop that they do not want the audience to see, in case their desktop becomes visible at any point.
Control audience view of physical environment: Before the event, advise participants to turn their cameras on and examine their backgrounds. Remove anything the audience should not be able to see.
Test network connectivity: Send the presenters a link to a speed test and check their internet speed.
Emergency contact: Exchange cell phone numbers for emergency backchannel conversations if problems arise on the day of the event.
Set expectations: Presenting to an online audience feels very different to a live crowd. Prepare presenters for a lack of applause and lack of ability to see their audience, and that this does not mean the presentation was unsuccessful.
To determine what kind of technical requirements you need to build the virtual expression of your event, consult the Virtual Event Platform Requirements Tool.
Download the Virtual/Hybrid Event Software Feature Analysis Tool
Launch Info-Tech’s Rapid Application Selection Framework.
Using the requirements you’ve just gathered as a base, use Info-Tech’s complete framework to improve the efficiency and effectiveness of software selection.
Once you’ve selected a vendor(s), review the contract. Does it define an exit strategy? Does it define when your data will be deleted? Does it set service-level agreements that you find acceptable? Leverage Info-Tech’s contract review service once you have selected the virtual event solution and have received a contract from the vendor.
Dutt, Raj. “7 Lessons from This Company’s First-Ever Virtual Conference.” Fast Company, 29 Jul 2020. Web.
Kelly, Samantha Murphy. “Microsoft Build Proves Splashy Tech Events Can Thrive Online.” CNN, 21 May 2020. Web.
“Phases.” Event Management Body of Knowledge (EMBOK), n.d. Web.
Price, Michael. “As COVID-19 Forces Conferences Online, Scientists Discover Upsides of Virtual Format.” Science, 28 Apr 2020. Web.
“Stanford HAI Spring Conference - Key Advances in Artificial Intelligence.” Stanford Digital Economy Lab, 2022. Web.
“Virtual Event Tech Guide 2022.” Skift Meetings, April 2022. Web.
Warren, Tom. “Microsoft Build 2022 Will Take Place May 24th–26th.” The Verge, 30 March 2022. Web.
6 anonymous contributors
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Begin your journey by understanding whether Salesforce is the right CRM. Also proactively approach Salesforce licensing by understanding which information to gather and assessing the current state and gaps.
Review current products and licensing models to determine which licensing models will most appropriately fit the organization's environment.
Review Salesforce’s contract types and assess which best fits the organization’s licensing needs.
Conduct negotiations, purchase licensing, finalize a licensing management strategy, and enhance your CRM with a Salesforce partner.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Assess current state and align goals; review business feedback.
Interview key stakeholders to define business objectives and drivers.
Have a baseline for whether Salesforce is the right solution.
Understand Salesforce as a solution.
Examine all CRM options.
1.1 Perform requirements gathering to review Salesforce as a potential solution.
1.2 Gather your documentation before buying or renewing.
1.3 Confirm or create your Salesforce licensing team.
1.4 Meet with stakeholders to discuss the licensing options and budget allocation.
Copy of your Salesforce Master Subscription Agreement
RASCI Chart
Salesforce Licensing Purchase Reference Guide
Review product editions and licensing options.
Review add-ons and licensing rules.
Understand how licensing works.
Discuss licensing rules and their application to your current environment.
Determine the product and license mix that is best for your requirements.
2.1 Determine the editions, licenses, and add-ons for your Salesforce CRM solution.
2.2 Calculate total cost of ownership.
2.3 Use the Salesforce Discount Calculator to ensure you are getting the discount you deserve.
2.4 Meet with stakeholders to discuss the licensing options and budget allocation.
Salesforce CRM Solution
Salesforce TCO Calculator
Salesforce Discount Calculator
Salesforce Licensing Purchase Reference Guide
Review terms and conditions of Salesforce contracts.
Review vendors.
Determine if MSA or term agreement is best.
Learn what specific terms to negotiate.
3.1 Perform a T&Cs review and identify key “deal breakers.”
3.2 Decide on an agreement that nets the maximum benefit.
Salesforce T&Cs Evaluation Tool
Salesforce Licensing Purchase Reference Guide
Finalize the contract.
Discuss negotiation points.
Discuss license management and future roadmap.
Discuss Salesforce partner and implementation strategy.
Discuss negotiation strategies.
Learn about licensing management best practices.
Review Salesforce partner options.
Create an implementation plan.
4.1 Know the what, when, and who to negotiate.
4.2 Control the flow of communication.
4.3 Assign the right people to manage the environment.
4.4 Discuss Salesforce partner options.
4.5 Discuss implementation strategy.
4.6 Meet with stakeholders to discuss licensing options and budget allocation.
Salesforce Negotiation Strategy
Vendor Communication Management Plan
RASCI Chart
Info-Tech’s Core CRM Project Plan
Salesforce Licensing Purchase Reference Guide
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Establish an effective EA function that will realize value for the organization with an EA strategy.
Use this template to document the outputs of the EA strategy and to communicate the EA strategy for approval by stakeholders.
Identify and prioritize the stakeholders that are important to your IT strategy development effort.
Use this template to analyze the effect of external factors on IT.
Use this template to create an EA value proposition that explicitly communicates to stakeholders how an EA function can contribute to addressing their needs.
Use this template to help set goals for your EA function based on the EA value proposition and identify objectives to measure the progression towards those EA goals.
Use this template to define relevant universal EA principles and create new EA principles to guide and inform IT investment decisions.
Use this template to identify the EA services relevant to your organization and then define how those services will be accessed.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Show an example of traceability.
Members have a real-world example of traceability between business goals and EA contributions.
1.1 Start from the business goals of the organization.
1.2 Document business and IT drivers.
1.3 Identify EA contributions that help achieve the business goals.
Business goals documented.
Business and IT drivers documented.
Identified EA contributions and traced them to business goals.
Create an understanding about role of architect in Agile ceremonies.
Understanding of the role of the EA architect in Agile ceremonies.
2.1 Document the Agile ceremony used in the organization (based on SAFe or other Agile approaches).
2.2 Determine which ceremonies the system architect will participate in.
2.3 Determine which ceremonies the solution architect will participate in.
2.4 Determine which ceremonies the enterprise architect will participate in.
2.5 Determine architect syncs, etc.
Documented the Agile ceremonial used in the organization (based on SAFe or other Agile approaches).
Determined which ceremonies the system architect will participate in.
Determined which ceremonies the solution architect will participate in.
Determined which ceremonies the enterprise architect will participate in.
Determined architect syncs, etc.
Enterprise Architecture Strategy |
|||
Business & IT Strategy
|
|
|
Unlock the Value of Architecture
|
Current Environment
|
|||
Enterprise architecture is NOT a one-size-fits-all endeavor. It needs to be right-sized to the needs of the organization.
Enterprise architects are boots on the ground and part of the solution; in addition, they need to have a good understanding of the corporate strategy, vision, and goals and have a vested interest on the optimization of the outcomes for the enterprise. They also need to anticipate the moves ahead, to be able to determine future trends and how they will impact the enterprise.
Milena Litoiu
Principal/Senior Director, Enterprise Architecture
Info-Tech Research Group
“Enterprise architects need to think about and consider different areas of expertise when formulating potential business options. By understanding the context, the puzzle pieces can combine to create a positive business outcome that aligns with the organization’s strategies. Sometimes there will be missing pieces; leveraging what you know to create an outline of the pieces and collaborating with others can provide a general direction.”
Jean Bujold
Senior Workshop Delivery Director
Info-Tech Research Group
“The role of enterprise architecture is to eliminate misalignment between the business and IT and create value for the organization.”
Reddy Doddipalli
Senior Workshop Director, Research
Info-Tech Research Group
“Every transformation journey is an opportunity to learn: ‘Tell me and I forget. Teach me and I remember. Involve me and I learn.’ Benjamin Franklin.”
Graham Smith
Senior Lead Enterprise Architect and Independent Consultant
We need to make decisions today for an unknown future. Decisions are influenced by:
Decisions are often made:
The more complex an organization, the more players involved, the more difficult it is to overcome these obstacles.
There is no “right architecture” for organizations of all sizes, maturities, and cultural contexts. The value of enterprise architecture can only be measured against the business goals of a single organization. Enterprise architecture needs to be right-sized for your organization.
| Business engagement
It is important to trace architectural decisions to business goals. As business goals evolve, architecture should evolve as well. As new business input is provided during Agile cycles, architecture is continuously evolving. |
EA fundamentals
EA fundamentals will shape how enterprise architects think and act, how they engage with the organization, what decisions they make, etc. Start small and lean and evolve as needed. Continuously align strategy with delivery and operations. Architects should establish themselves as business partners as well as implementation/delivery leaders. |
Enterprise services
Definitions of enterprise services should start from the business goals of the organization and the capabilities IT needs to perform for the organization to survive in the marketplace. Continuous delivery and continuous innovation are the two facets of architecture. |
| Tactical insight
Your current maturity should be reflected as a baseline in the strategy. |
Tactical insight
Take Agile/opportunistic steps toward your strategic North star. |
Tactical insight
EA services differ based on goals, maturity, and the Agile appetite of the enterprise. |
Jeanne W. Ross, MIT CISR
Co-author of Enterprise Architecture as Strategy: Creating a Foundation for Business Execution,
Harvard Business Press, 2006.
|
|
There is no “absolute maturity” for organizations of all sizes, maturities, and cultural contexts. The maturity of enterprise architecture can only be measured against the business goals of the organization.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Contact your account representative for more information.
workshops@infotech.com1-888-670-8889
| Session 1 | Session 2 | Session 3 | Session 4 | Session 5 | |
| Activities |
Identify organizational needs and landscape1.0 Interview stakeholders to identify business and technology needs 1.1 Review organization perspective, including business needs, challenges, and strategic directions 1.2 Conduct PESTLE analysis to identify business and technology trends 1.3 Conduct SWOT analysis to identify business and technology internal perspective |
Create the EA value proposition2.1 Identify and prioritize EA stakeholders 2.2 Create business and technology drivers from needs 2.3 Define the EA value proposition 2.4 Identify EA maturity and target |
Define the EA fundamentals3.1 Define the EA goals and objectives 3.2 Determine EA scope 3.3 Create a set of EA principles 3.4. Define the need of a methodology/agility 3.5 Create the EA vision and mission statement |
Identify the EA framework and communicate the EA strategy4.1 Define initial EA operating model and governance mechanism 4.2 Define the activities and services the EA function will provide, derived from business goals 4.3 Determine effectiveness measures 4.4 Create EA roadmap and next steps 4.5 Build communication plan for stakeholders |
Next Steps and Wrap-Up (offsite)5.1 Generate workshop report 5.2 Set up review time for workshop report and to discuss next steps |
| Outcomes |
|
|
|
|
|
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is 8 to 12 calls over the course of 4 to 6 months.
While variations depend on the maturity of the organization as well as its aspirations, these are some typical steps:
Phase 1
|
Phase 2
|
||
Phase 3
|
Phase 4
|
Define the role of the group and different roles inside the enterprise architecture competency.
Enterprise architecture needs to have input from the corporate strategy of the organization. Similarly, EA governance needs to be informed by corporate governance. If this is not the case, it is like planning and governing with your eyes closed.
| EA Functions |
Operationalized
|
–––› | Common EA value | |
| Decreased cost | Reduced risk | |||
Emerging
|
–x–› | Cut through complexity | Increased agility | |
| External Factors | –› | Layers of a Business Model (Organization) |
–› | Architecture Supported Transformation |
| Industry Changes | Business Strategy | |||
| Competition | Value Streams
(Business Outcomes) |
|||
| Regulatory Impacts | Business Capability Maps
|
|||
| Workforce Impacts | Execution
|
External forces can affect the organization as a whole; they need to be included as part of the holistic approach for enterprise architecture.
Business and Technology Drivers – A set of statements created from business and technology needs. Gathered from information sources, it communicates improvements needed.
Enterprise architecture needs to create and be part of a culture where decisions are made through collaboration while focusing on enterprise-wide efficiencies (e.g. reduced duplication, reusability, enterprise-wide cost minimization, overall security, comprehensive risk mitigation, and any other cross-cutting concerns) to optimize corporate business goals.
Establish the EA function scope by using the EA value proposition and EA fundamentals that have already been developed. After defining the EA function scope, refer back to these statements to ensure it accurately reflects the EA value proposition and EA fundamentals.
|
EA value proposition +EA vision statement
|
—› Influences |
Organizational coverage Architectural domains Depth Time horizon |
—› Defines |
EA function scope |
The team assembled to create the EA strategy will be defined as the “EA strategy creation team” in this blueprint.
Using an enterprise architecture methodology is a good starting point to achieving a common understanding of what that is. Often, organizations agree to "tailor" methodologies to their needs.
The use of lean/Agile approaches will increase efficiency beyond traditional methodologies.
| Corporate Strategy “Why does our enterprise exist in the market?” |
|
| EA Strategy
“What does EA need to be and do to support the enterprise’s ability to meet its goals? What is EA’s value proposition?” |
Business & IT Operating Culture
“How does the organization’s culture and structure influence the EA operating model?” |
| EA Operating Model
How does EA need to operate on a daily basis to deliver the value proposition?” |
|
(Source: The Center for Organizational Design)
| Vision, goals, and aspirations as well internal and external pressures | ||
|
Business current state
|
Enterprise Architecture |
IT current state
|
|
Business target state
|
IT target state
|
|
| Complex, overlapping, contradictory world of humans vs. logical binary world of IT | ||
| EA is a planning tool to help achieve the corporate business goals | ||
Business architecture is the cornerstone that sets the foundation for all other architectural domains: security, data, application, and technology.
“An enterprise architecture practice is both difficult and costly to set up. It is normally built around a process of peer review and involves the time and talent of the strategic technical leadership of an enterprise.” (The Open Group Architecture Framework, 2018)
The primary question during the design of the EA operating model is how to integrate the EA function with the rest of the business.
If the EA practice functions on its own, you end up with ivory tower syndrome and a dictatorship.
If you totally embed the EA function within business units it will become siloed with no enterprise value.
Organizations need to balance consistency at the enterprise level with creativity from the grass roots.
Decisions at the enterprise level apply across multiple programs/portfolios/solutions and represent the guardrails set for all to play within.
Larger organizations with multiple domains/divisions or business units will need to decide which architecture functions will be centralized and which, if any, will be decentralized as they plan to scope their EA program. What are the core functions to be centralized for the EA to deliver the greatest benefits?
Typically, we see a need to have a centralized repository of reusable assets and standards across the organization, while other approaches/standards can operate locally.
Being able to answer the deceptively simple question “How am I doing?” requires traceability to and from the business goals to be achieved all the way to applications, to infrastructure, and ultimately, to the funded initiatives (portfolios, programs, projects, etc.).
Corporate Business Goals
|
EA Contributions
|
Measurements
|
Organizations must create clear and smart KPIs (key performance indicators) across the board.
In the absence of a corporate strategy, enterprise architecture is missing its North Star.
However, enterprise architects can partner with the business strategists to build the needed vision.
According to the Scaled Agile Framework, three of the most applicable principles for the architectural professions refer to the following:
|
Common DomainsBusiness Architecture Information Architecture Application Architecture Technical Architecture Integration Architecture Security Architecture Others |
All architects are boots on the ground and play in the solutioning space. What differs is their decisions’ impact (the enterprise architect’s decisions affects all domains and solutions).
SAFe definitions of the Enterprise/Solution and System Architect roles can be found here.
The role of the Enterprise Architect is detailed here.
(Adapted from Disciplined Agile)
There are both formal and informal collaborations between enterprise architects and solution architects across the enterprise.
Enterprise architects should collaborate with solutions architects to create the best solutions at the enterprise level and to provide guidance across the board.
According to Scale Agile Framework 5 for Lean Enterprises:
Please check the SAFe Scaled Agile site for detailed information on the approach.
A clear commitment for architects to achieve and support agility is needed. Architects should not be in an ivory tower; they should be hands on and engaged in all relevant Agile ceremonies, like the pre- and post-program increment (PI) planning, etc.
Architect syncs are also required to ensure the needed collaboration.
Architect participation in Agile ceremonies, according to SAFe:
Architecting for scale, modularity, and extensibility is key for the architecture to adapt to changing conditions and evolve.
Proactively address NFRs; architect for performance and security.
Continuously refine the solution intent.
For large solutions, longer foundational architectural runways are needed.
Having an intentional continuous improvement/continuous development (CI/CD) pipeline to continuously release, test, and monitor is key to evolving large and complex systems.
Architects need to help make some fundamental decisions, e.g. help define the environment that best supports continuous innovation or exploration and continuous integration, deployment, and delivery.
The enterprise architecture statement relative to agility specifies the architects’ responsibilities as well as the Agile protocols they will participate in. This statement will guide every architect’s participation in planning meetings, pre- and post-PI, various syncs, etc. Use simple and concise terminology; speak loudly and clearly.
Strong EA statement relative to agility has the following characteristics:
Sample EA statement relative to agility
Below is a sample of connecting keywords to form an enterprise architect role statement, relative to agility.
Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.
Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.
Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.
Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture and provide guidance and accelerators.
Target enterprise structure in an agile way – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:
| Traditional Enterprise Architecture | Next-Generation Enterprise Architecture |
| Scope: Technology focused | Business transformation (scope includes both business and technology) |
| Bottom up | Top down |
| Inside out | Outside In |
| Point to point; difficult to change | Expandable, extensible, evolvable |
| Control-based: Governance intensive; often over-centralized | Guidance-based: Collaboration and partnership-driven based on accepted guardrails |
| Big up-front planning | Incremental/dynamic planning; frequent changes |
| Functional siloes and isolated projects, programs, and portfolios | Enterprise-driven outcome optimization (across value streams) |
The role of the architecture in Lean (Agile) approaches is to set up the needed guardrails and ensure a safe environment where everyone can be effective and creative.
Phase 1
| Phase 2
| ||
Phase 3
| Phase 4
|
An understanding of your organization’s EA needs.
Create the Value Proposition
| Step 2.1 | Step 2.2 |
Creating an EA value proposition should be the first step to realizing a healthy EA function. The EA value proposition demonstrates to organizational stakeholders the importance of EA in helping to realize their needs.
Five steps towards the successful articulation of EA value proposition:
EA can deliver many benefits to an organization. To increase the likelihood of success, each EA group needs to commit to delivering value to their organization based on the current operating environment and the desired direction of the enterprise. An EA value proposition will articulate the group’s promises of value to the enterprise.
All stakeholders need to know how the EA function can help them. Provide the stakeholders with an understanding of the EA strategy’s impact on the business by involving them.
A stakeholder map can be a powerful tool to help identify and prioritize stakeholders. A stakeholder map is a visual sketch of how various stakeholders interact with your organization, with each other, and with external audience segments.
“Stakeholder management is critical to the success of every project in every organization I have ever worked with. By engaging the right people in the right way in your project, you can make a big difference to its success…and to your career.” (Rachel Thompson, MindTools)
Input: Expertise from the EA strategy creation team
Output: An identified and prioritized set of stakeholders for the EA function to target
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Download the Stakeholder Power Map Template for more detailed instructions on completing this activity.
All stakeholders will have a set of needs they would like to address. Take those needs and translate them into business and technology drivers. Drivers help clearly articulate to stakeholders, and the EA function, the stakeholder needs to be addressed.
Business DriverBusiness drivers are internal or external business conditions, changing business capabilities, and changing market trends that impact the way EA operates and provides value to the enterprise. Examples:Ensure corporate compliance with legislation pertaining to data and security (e.g. regulated oil fields). Enable the automation and digitization of internal processes and services to business stakeholders. |
Technology DriverTechnology drivers are internal or external technology conditions or factors that are not within the control of the EA group that impact the way that the EA group operates and provides value to the enterprise. Examples:Establish standards and policies for enabling the organization to take advantage of cloud and mobile technologies. Reduce the frequency of shadow IT by lowering the propensity to make business–technology decisions in isolation. |
Review information sources, then analyze them to derive business and technology drivers. Information sources are not targeted towards EA stakeholders. Analyze the information sources to create drivers that are relevant to EA stakeholders.
| Information Sources | Drivers (Examples) | |||
|
PESTLE Analysis Strategy Documents Stakeholder Interviews SWOT Analysis |
—› |
Analysis |
—› |
Help the organization align technology investments with corporate strategy Ensure corporate compliance with legislation. Increase the organization’s speed to market. |
| Business and Technology Needs
By examining information sources, the EA team will come across a set of business and technology needs. Through analysis, these needs can be synthesized into drivers. |
||||
PESTLE examines six perspectives for external factors that may impact business and technology needs. Below are prompting questions to facilitate a PESTLE analysis working session.
| Political |
|
|
Economic |
| Social |
|
|
Technological |
| Legal |
|
|
Environmental |
2 hours
Input: Expertise from EA strategy creation team
Output: Identified set of business and technology needs from PESTLE
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Download the PESTLE Analysis Template to assist with completing this activity.
Some organizations (and business units) create an authoritative strategy document. These documents contain corporate aspirations and outline initiatives, reorganizations, and shifts in strategy. From these documents, a set of business and technology needs can be generated.
Overt Statements
|
Turn these statements to business and technology needs by:Asking the following:
|
Covert Statements
|
2 hours
Input: Strategic documents in the organization
Output: Identified set of business and technology needs from documents
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin the identification process of business and technology needs from strategic documents with the following steps:
In this interview process, you will be asking EA stakeholders questions that uncover their business and technology needs. You will also be able to ask follow-up questions to get a better understanding of abstract or complex concepts from the strategy document review and PESTLE analysis.
4-8 hours
Input: Expertise from the EA stakeholders
Output: Business and technology needs for EA stakeholders
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team, Identified EA stakeholders
A value proposition document that ties the value of the EA function to stakeholder needs.
Create the EA Value Proposition
| Step 2.1 | Step 2.2 |
|
There are several key attributes that a driver should have. Driver Key Attributes
|
“The greatest impact of enterprise architecture is the strategic impact. Put the mission and the needs of the organization first.” (Matthew Kern, Clear Government Solutions)
3 hours
Input: Expertise from EA strategy creation team
Output: A set of business and technology drivers
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team, EA stakeholders
Meet with the EA strategy creation team and follow the steps below to begin the process of synthesizing the business and technology needs into drivers.
Download the EA Value Proposition Template to record your findings in this activity.
A pain is an obstacle that business stakeholders will face when attempting to address business and technology drivers. Identify the pains associated with each driver so that EA’s contributions can be linked to resolving obstacles to address business needs.
Business and Technology Drivers |
› |
Pains |
| Created by assessing information sources. | A sentence that states the nature of the pain and how the pain stops the organization from addressing the drivers. | |
Examples:
|
Examples:
|
2 hours
Input: Expertise from EA strategy creation team and EA stakeholders
Output: An associated pain that obstructs each identified driver
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team, EA stakeholders
Call a meeting with the EA strategy creation team and any available stakeholders to identify the pains that obstruct addressing the business and technology drivers.
Take each driver and ask the questions below to the EA strategy creation team and to any EA stakeholders who are available. Record the answers to identify the pains when realizing the drivers.
Take the recorded answers and follow the steps below to create the pain statements:
Download the EA Value Proposition Template to record your findings in this activity.
Set the foundations for the value proposition by brainstorming the EA contributions that can alleviate the pains.
Business and technology drivers produce:Pains |
—› |
EA contributions produce:Value by alleviating pains |
PainsObstructions to addressing business and technology drivers. Stakeholders will face these pains. Examples
|
EA contributionsActivities the EA function can perform to help alleviate the pains. Demonstrates the contributions the EA function can make to business value. Examples:
|
| EA contribution category | EA contribution details |
| Define business capabilities and processes | As-is and target business capabilities and processes are documented and understood by both IT and the business. |
| Design information flows and services | Information flows and services effectively support business capabilities and processes. |
| Analyze gaps and identify project opportunities | Create informed project identification, scope definition, and project portfolio management. |
| Optimize technology assets | Greater homogeneity and interoperability between tangible and intangible technology assets. |
| Create and maintain technology standards | Decrease development, integration, and support efforts. Reduce complexity and improve interoperability. |
| Rationalize technology assets | Tangible and intangible technology assets are rationalized to adequately and efficiently support information flows and services. |
2 hours
Input: Expertise from EA strategy creation team
Output: EA contributions that addresses the pains that were identified
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Gather with the EA strategy creation team, take each pain, then ask and record the answers to the questions below to identify the EA contributions that would solve the pains:
Answers to the questions above will generate a list of activities EA can do to help alleviate the pains. Use the following steps to complete this activity:
Download the EA Value Proposition Template to record your findings in this activity.
2 hours
Input: Expertise from EA strategy creation team and EA stakeholders
Output: Promises of value for each business and technology driver
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team, EA stakeholders
Now that the EA contributions have been identified, identify the promises of value to articulate the value proposition.
Take each driver, then ask and record the answers to the questions below to identify the promises of value when realizing the drivers:
Take the recorded answers and follow the steps below to create the promises of value.
Download the EA Value Proposition Template to record your findings in this activity.
Phase 1
| Phase 2
| ||
Phase 3
| Phase 4
|
| Step 3.1 | Step 3.2 |
EA fundamentals include a vision statement, a mission statement, goals and objectives, and principles. They are a set of documented statements that guide the EA function. The fundamentals guide the EA function in terms of its strategy and decision making.
| EA vision statement | EA mission statement |
EA fundamentals |
|
| EA goals and objectives | EA principles |
Treat the critical elements of the EA group the same way as you would a business. Create a directional foundation for EA and define the vision, mission, goals, principles, and scope necessary to deliver on the established value proposition.
The enterprise architecture vision statement communicates a desired future state of the EA function. The statement is expressed in the present tense. It seeks to articulate the desired role of the EA function and how the EA function will be perceived.
The enterprise architecture mission statement specifies the team’s purpose or “reason of being.” The mission should guide each day’s activities and decisions. The mission statements use simple and concise terminology, speak loudly and clearly, and generate enthusiasm for the organization.
The process for constructing the enterprise architecture vision statement and enterprise architecture mission statement is articulated below.
| Promises of value | Derive keywords | Construct draft statements | Reference test criteria | Finalize statements |
| Derive the a set of keywords from the promises of value to accurately capture their essence. | Create the initial statement using the keywords. | Check the initial statement against a set of test criteria to ensure their quality. | Finalize the statement after referencing the initial statement against the test criteria. |
Develop keywords by summarizing the promises of value that were derived from drivers into one word that will take on the essence of the promise. See examples below:
| Business and technology drivers | Promises of value | Keywords |
| Help the organization align investments with the corporate strategy and departmental priorities. | Increase the number of investments that have a direct tie to corporate strategy. | Business |
| Support the rapid growth and development of the company through fiscal planning, project planning, and technology sustainability. | Ensure budgets and projects are delivered on time with the assistance of technology. | IT-Enabled |
| Reduce the duplication and work effort to build and deploy technology solutions across the entire organization. | Aim to reduce the number of redundant applications in the organization to streamline processes and save costs. | Catalyst |
| Improve the organization’s technology responsiveness and increase speed to market. | Reduce the number of days required in the SDLC for all core business support projects. | Value delivery |
Ensure the sentence is cohesive and captures additional value outside of the keywords. The statement as a whole should be greater than the sum of the parts. Expand upon the meaning of the words, if necessary, to communicate the value. Below is an example of a finished vision statement.
SampleCatalyst – We will continuously interact with the business and IT to accelerate and improve results.
IT-enabled – We will ensure the optimal use of technology in enabling business capabilities to achieve business objectives.
Business – We will be perceived as a business-focused unit that understands [Company name]’s business priorities and required business capabilities.
Value delivery – EA’s value will be recognized by both business and IT stakeholders. We will track and market EA’s contribution to business value organization-wide.
Likewise, below is a sample of connecting keywords together to form an EA mission statement:
Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.
Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.
Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.
Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture.
Target enterprise structure – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:
1 hour
Input: Identified promises of value, Vision statement test criteria
Output: EA function vision statement
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin the creation of the EA vision statement by following the steps below:
1 hour
Input: Identified promises of value, Mission statement test criteria
Output: EA function mission statement
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin the creation of the EA mission statement by following the steps below:
Enterprise architecture goals define specific desired outcomes of an EA function. EA goals are important because they establish the milestones the EA function can strive toward to deliver their promises of value.
Inform EA goals by examining:Promises of value |
—› |
EA goals produce:Targets and milestones |
Promises of valueProduce EA strategic outcomes that can be classified into four categories. The four categories are:
|
EA goalsSupport the strategic outcomes. EA goals can be strategic or operational:
|
2 hours
Input: Identified promises of value
Output: EA goals
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin the creation of EA goals by following the steps below:
Download the EA Goals and Objectives Template to assist with completing this activity.
Below are examples of EA goals and the objectives that track their performance:
| IT performance-oriented goals | Objectives |
| Alignment of IT and business strategy |
|
| Increase in IT agility |
|
| Optimization of IT assets, resources, and capabilities |
|
2 hours
Input: Defined EA goals
Output: EA objectives linked to EA goals
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin the process of defining EA objectives and linking them to EA goals using the following steps:
Download the EA Goals and Objectives Template to assist with completing this activity.
Add details to the enterprise architecture objectives previously defined to increase their clarity to stakeholders.
| EA objective detail category | Description |
| Unit of measure |
|
| Calculation formula |
|
| Objective baseline, status, and target |
|
| Data collection |
|
| Reporting |
|
2 hours
Input: Defined list of EA objectives
Output: Increased detail into each defined EA objective
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Record the details of each EA objective. Use the following steps below to assist with recording the details:
Download the EA Goals and Objectives Template to assist with completing this activity.
Build the EA Fundamentals
| Step 3.1 | Step 3.2 |
The EA function scope constrains the promises of value the EA function will deliver on by taking into account factors across four dimensions. The EA function scope ensures that the EA function is not stretched beyond its current/planned means and capabilities when delivering the promised value. The four dimensions are illustrated below:
| Organizational coverage
Determine the focus of the enterprise architecture effort in terms of specific business units, functions, departments, capabilities, or geographical areas. |
Depth
Determine the appropriate level of detail to be captured, based on the intended use of the enterprise architecture and the contingent decisions to be made. |
EA Scope |
|
| Architectural Domains
Determine the EA domains (business, data, application, infrastructure, security) that are appropriate to address stakeholder concerns and architecture requirements. |
Time horizon
Determine the target-state architecture’s objective time period. |
Establish the EA function scope by using the EA value proposition and EA fundamentals that have been developed. After defining the EA function scope, refer back to these statements to ensure the EA function scope accurately reflects the EA value proposition and EA fundamentals.
|
EA value proposition +EA vision statement
|
—› Influences |
Organizational coverage Architectural domains Depth Time horizon |
—› Defines |
EA function scope |
The organizational coverage dimension of EA scope determines the focus of enterprise architecture effort in the organization. Coverage can be determined by specific business units, functions, departments, capabilities, or geographic areas. Info-Tech has typically seen two types of coverage based on the size of the organization.
Indicators: Full-time employees dedicated to manage its data and IT infrastructure. Individuals are IT generalists and may have multiple roles.
Recommended coverage: Typically, for small and medium-size businesses, the organizational coverage of architecture work is the entire enterprise. (Source: The Open Group, 2018)
Indicators: Dedicated full-time IT staff with expertise to manage specific applications or parts of the IT infrastructure.
Recommended coverage: For large enterprises, it is often necessary to develop a number of architectures focused on specific business segments and/or geographies. In this federated model, an overarching enterprise architecture should be established to ensure interoperability and conformance to overarching EA principles. (Source: DCIG, 2011)
Enterprise architecture objectives are specific metrics that help measure and monitor progress towards achieving an EA goal. Objectives are SMART.
| EA goals | —› | EA objectives |
|
|
Download the EA Goals and Objectives Template to see examples between the relationship of EA goals to objectives.
| Corporate Business Goals | Measurements | |
|
|
2 hours
Input: EA value proposition, Previously defined EA fundamentals
Output: Organizational coverage dimension of EA scope defined
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Define the organizational coverage of the EA function scope using the following steps below:
A complete enterprise architecture should address all five architectural domains. The five architectural domains are business, data, application, infrastructure, and security.
| Enterprise Architecture | ||||
| —› | Data Architecture | |||
| Business Architecture | —› | Infrastructure Architecture | ||
| Security Architecture | ||||
| —› | Application Architecture | |||
“The realities of resource and time constraints often mean there is not enough time, funding, or resources to build a top-down, all-inclusive architecture encompassing all four architecture domains. Build architecture domains with a specific purpose in mind.” (The Open Group, 2018)
Below are the definitions of different domains of enterprise architecture (Info-Tech perspective; others can be identified as well, e.g. Integration Architecture).
Business ArchitectureBusiness architecture is a means of demonstrating the business value of subsequent architecture work to key stakeholders and the return on investment to those stakeholders from supporting and participating in the subsequent work. Business architecture defines the business strategy, governance, organization, and key business processes. |
|
Data ArchitectureDescribes the structure of an organization’s logical and physical data assets and data management resources. |
Application ArchitectureProvides a blueprint for the individual applications to be deployed, their interactions, and their relationships to the core business processes of the organization. |
Infrastructure ArchitectureRepresents the sum of hardware, software, and telecommunications-related IT capability associated with a particular enterprise. It is concerned with the synergistic operations and management of the devices in the organization. |
Security ArchitectureProvides an unified security design that addresses the necessities and potential risks involved in a certain scenario or environment. It also specifies when and where to apply security controls. |
EA scope depth defines the architectural detail for each EA domain that the organization has selected to pursue. The level of depth is broken down into four levels. The level of depth the organization decides to pursue should be consistent across the domains.
| Contextual |
|
||||
| Conceptual |
|
||||
| Logical |
|
||||
| Physical |
|
||||
| (Source: Zachman International, 2011) | Business Architecture | Data Architecture | Application Architecture | Infrastructure Architecture | Security Architecture |
The graphic below depicts examples of the key artifacts that each domain of architecture would produce at each depth level.
| Contextual | Enterprise Governance | ||||
| Conceptual | Business strategy | Business objects | Use-case models | Technology landscaping | Security policy |
| Logical | Business capabilities | Data attribution | Application integration | Network/ hardware topology | Security standards |
| Physical | Business process | Database design | Application design | Configuration management | Security configuration |
| Business Architecture | Data Architecture | Application Architecture | Infrastructure Architecture | Security Architecture | |
2 hours
Input: EA value proposition, Previously defined EA fundamentals
Output: Architectural domain and depth dimensions of EA scope defined
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Define the EA function scope for your organization using the following steps below:
It is important that the EA team’s work has an appropriate planning horizon while avoiding two extremes:
| Planning Horizon: | 1 year | 2-3 years | 5 years |
| Recommended under the following conditions: |
|
|
|
2 hours
Input: EA value proposition, Previously defined EA fundamentals
Output: Time horizon dimension of EA scope defined
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Define the EA function scope for your organization using the following steps below:
EA principles are shared, long-lasting beliefs that guide the use of IT in constructing, transforming, and operating the enterprise by informing and restricting target-state enterprise architecture design, IT investment portfolio management, solution development, and procurement decisions.
| EA value proposition | Influences —› |
EA Principles | Guide and inform —› |
Decisions on the Use of IT | Direct and control ‹— |
Specific Domain Policies |
| ‹——————— What decisions should be made? |
————— | ————— | —————
How should decisions be made? |
————— | ————— | —————————›
Who has the accountability and authority to make decisions? |
Info-Tech has identified a set of characteristics that EA principles should possess. Having these characteristics ensures the EA principles are relevant and followed in the organization.
| Approach focused | EA principles are focused on the approach, i.e. how the enterprise is built, transformed, and operated, as apposed to what needs to be built, which is defined by both functional and non-functional requirements. |
| Business relevant | Create EA principles specific to the organization. Tie EA principles to the organization’s priorities and strategic aspirations. |
| Long lasting | Build EA principles that will withstand the test of time. |
| Prescriptive | Inform and direct decision making with EA principles that are actionable. Avoid truisms, general statements, and observations. |
| Verifiable | If compliance can’t be verified, the principle is less likely to be followed. |
| Easily digestible | EA principles must be clearly understood by everyone in IT and by business stakeholders. EA principles aren’t a secret manuscript of the EA team. EA principles should be succinct; wordy principles are hard to understand and remember. |
| Followed | Successful EA principles represent a collection of beliefs shared among enterprise stakeholders. EA principles must be continuously “preached” to all stakeholders to achieve and maintain buy-in.
In organizations where formal policy enforcement works well, EA principles should be enforced through appropriate governance processes. |
| 1. Enterprise value focus | We aim to provide maximum long-term benefits to the enterprise as a whole while optimizing total costs of ownership and risks. |
| 2. Fit for purpose | We maintain capability levels and create solutions that are fit for purpose without over-engineering them. |
| 3. Simplicity | We choose the simplest solutions and aim to reduce operational complexity of the enterprise. |
| 4. Reuse › buy › build | We maximize reuse of existing assets. If we can’t reuse, we procure externally. As a last resort, we build custom solutions. |
| 5. Managed data | We handle data creation, modification, and use enterprise-wide in compliance with our data governance policy. |
| 6. Controlled technical diversity | We control the variety of technology platforms we use. |
| 7. Managed security | We manage security enterprise-wide in compliance with our security governance policy. |
| 8. Compliance to laws and regulations | We operate in compliance with all applicable laws and regulations. |
| 9. Innovation | We seek innovative ways to use technology for business advantage. |
| 10. Customer centricity | We deliver best experiences to our customers with our services and products. |
2 hours
Input: Info-Tech’s ten universal EA principles, Identified promises of value
Output: A defined set of EA principles for your organization
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Create a set of EA principles for your organization using the steps below:
Download the EA Principles Template – EA Strategy to document this step.
After defining the set of EA principles, ensure they are all expanded upon with a rationale and implications. The rationale and implications ensure principles are more likely to be followed because they communicate why the principles are important and how they are to be used.
| Name |
|
| Statement |
|
| Rationale |
|
| Implications |
|
2 hours
Input: Identified set of EA principles
Output: EA principles that have rationale and implications
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Add the rationale and implication of each EA principle that your organization has selected using the following steps:
Download the EA Principles Template – EA Strategy to document this step.
1-2 hours
Input: Defined set of EA principles
Output: EA principles are successfully operationalized
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin to operationalize the EA principles by reviewing the proposed principles with business and technology leadership to secure their approval.
After operationalizing the EA principles for your organization, the organization can now use those principles to guide and inform its IT investment decisions. Below is an example of a scenario where EA principles were used to guide and inform an IT investment decision.
Organization wants to provision an application but it needs to decide how to do so, and it considers the relevant EA principles:
The organization has decided to go with a specialized vendor, even though it normally prefers to reuse existing components. The vendor has experience in this domain, understands the data security implications, and can help the organization mitigate risk. Lastly, the vendor is known for providing new solutions on a regular basis and is a market leader, making it more likely to provide the organization with innovative solutions.
As an enterprise architecture function starting from ground zero, the organization did not have the EA fundamentals in place to guide the EA function. Further, the organization also did not possess an EA function scope to define the boundaries of the EA function.
Due to the lack of EA scope, the EA function did not know which part of the organization to provide contributions toward. A lack of EA fundamentals caused confusion regarding the future direction of the EA function.
Info-Tech worked with the EA team to define the different components of the EA fundamentals. This included EA vision and mission statements, EA goals and objectives, and EA principles.
Additionally, Info-Tech worked with the EA team to define the EA function scope.
These EA strategy components were created by examining the needs of the business. The components were aligned with the identified needs of the EA stakeholders.
The defined EA function scope helped set out the responsibilities of the enterprise architecture function to the organization.
The EA vision and mission statements and EA goals and objectives were used to guide the direction of the EA function. These fundamentals helped the EA function improve its maturity and deliver on its promises.
The EA principles were used in IT review boards to guide the decisions on IT investments in the organization.
1 hour
Input: Existing methodologies
Output: Decisions about need of agility, ceremonies, and protocols to be used
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Add the rationale and implication of adopting an Agile methodology and/or a combination with a traditional methodology.
Phase 1
| Phase 2
| ||
Phase 3
| Phase 4
|
Design the EA Services
| Step 3.1 | Step 3.2 |
Enterprise architecture services are a set of activities the enterprise architecture function provides for the organization. EA services are important because the services themselves provide a set of benefits for the organization.
Viewing the EA function from a service perspective resolves the following pains:
Previously identified EA contributions can be linked to EA services, which helps the EA function identify a set of EA services that are important to business stakeholders. Further, linking the EA contributions to EA services can define for the EA function the services they need to provide.
2 hours
Input: Previously identified EA contributions from the EA value proposition
Output: A set of EA services selected for the organization from Info-Tech’s defined set of EA services
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Begin the selection of EA services relevant to your organization by following the steps below:
Download the EA Service Planning Tool to assist with this activity.
2 hours
Input: Expertise from the EA strategy creation team, Previously defined EA contributions
Output: A defined set of EA services outside the list Info-Tech has recommended
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Identify if services outside of the recommended list in the EA Service Planning Tool are relevant to your organization by using the steps below:
Download the EA Service Planning Tool to assist with this activity.
The EA service catalog is an important communicator to the business. It shifts the technology-oriented view of EA to services that show direct benefit to the business. It is a tool that communicates and provides clarity to the business about the EA services that are available and how those services can assist them.
| Define the services to show value | Define the service catalog to show how to use those services |
Already defined
|
Need to define
|
The EA group must provide the organization with a list of services it will provide to demonstrate value. This will help the team manage expectations and the workload while giving organizational stakeholders a clear understanding of how to engage EA and what lies outside of EA’s involvement.
4 hours
Input: Expertise from the EA strategy creation team
Output: Service details for each EA service in your organization
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Complete the details for each relevant EA service in the EA Service Planning Tool by using the following steps:
Download the EA Service Planning Tool to assist with this activity.
Design the EA Services
| Step 4.1 | Step 4.2 |
For the EA strategy to be successfully executed, it must be approved by the EA stakeholders. Securing their approval will increase the likelihood of success in the execution of the EA operating model.
| Outputs that make up the EA strategy | —› | Present outputs to EA strategy stakeholders |
|
|
1 hour
Input: Completed EA Function Strategy Template, Expertise from EA strategy creation team
Output: Approval of the EA strategy
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team, Key EA stakeholders
Use the following steps to assist with securing approval for your organization’s EA strategy:
Use the EA Function Strategy Template to assist with this activity.
3 hours
Input: Expertise from EA strategy creation team
Output: Service details for each EA service in your organization
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Map EA contributions/services to the goals of the organization.
Download the EA Service Planning Tool to assist with this activity.
1 hour
Input: Expertise from EA strategy creation team
Output: Defined KPIs (SMART)
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Use SMART key performance indicators (KPIs) to measure EA contributions vis-à-vis business goals.
| Corporate Business Goals | EA Contributions | Measurements |
|
|
|
The oil and gas corporation faced a great challenge in communicating the role of enterprise architecture to the organization. Although it has the mandate from the CIO to create the EA function, there was no function in existence. Thus, few people in the organization understood EA.
Because of this lack of understanding, the EA function was often undermined. The EA function was seen as an order taker that provided some services to the organization.
First, Info-Tech worked with the enterprise architecture team to define the EA stakeholders in the organization.
Second, Info-Tech interviewed those stakeholders to identify their needs. The needs were analyzed and pains that would obstruct addressing those needs were identified.
Lastly, Info-Tech worked with the team to identify common EA contributions that would solve those pains.
Through this process, Info-Tech helped the team at the oil and gas company create a document that could communicate the value of EA. Specifically, the document could articulate the issues obstructing each stakeholder from achieving their needs and how enterprise architecture could solve them.
With this value proposition, EA was able to demonstrate value to important stakeholders and set itself up for success in its future endeavors.
As a brand new enterprise architecture function, the EA function at the oil and gas corporation did not have a set of defined EA services. Because of this lack of EA services, the organization did not know what contributions EA could provide.
Further, without the definition of EA services, the EA function did not set out explicit expectations to the business. This caused expectations from the business to be different from those of the EA function, resulting in friction.
Info-Tech worked with the EA function at the oil and gas corporation to define a set of EA services the function could provide.
The Info-Tech team, along with the organization, assessed the business and technology needs of the stakeholder. Those needs acted as the basis for the EA function to create their initial services.
Additionally, Info-Tech worked with the team to define the service details (e.g. service benefits, service requestor, service provider) to communicate how to provide services to the business.
The defined EA services led the EA function to communicate what it could provide for the business. As well, the defined services clarified the level of expectation for the business.
The EA team was able to successfully service the business on future projects, adding value through their expertise and knowledge of the organization’s systems. Because of the demonstrated value, EA has been given greater responsibility throughout the organization.
1 hour
Input: Expertise from EA strategy creation team
Output: Participation in Agile Pre- and Post-PI, Architect Syncs, etc.
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: EA strategy creation team
Document the involvement of the enterprise architect in your organization’s Agile ceremonies.
Note: Roles and responsibilities can be further defined as part of the Agile Enterprise Operating Model.
The enterprise architecture role relative to agility specifies the architecture roles as well as the agile protocols they will participate in.
This statement will guide every architect’s participation in planning meetings, pre- and post-PI, syncs, etc. Use simple and concise terminology; speak loudly and clearly.
A strong EA role statement relative to agility has the following characteristics:
Sample EA mission relative to agility
Likewise, below is a sample of connecting keywords together to form an enterprise architect role statement, relative to agility.
Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.
Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.
Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.
Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture and provide guidance as well as accelerators.
Target enterprise structure in an agile way – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:
Once approved, move on to Info-Tech’s Define an EA Operating Model blueprint to begin executing on the EA strategy.
This blueprint focuses on setting up an enterprise architecture function, with the goal of maximizing the likelihood of EA success. The blueprint puts into place the components that will align the EA function with the needs of the stakeholders, guide the decision making of the EA function, and define the services EA can provide to the organization.
An EA operating model helps you design and organize the EA function, ensuring adherence to architectural standards and delivery of EA services. This blueprint acts on the EA strategy by creating methods to engage, govern, and develop architecture as a part of the larger organization.
|
Milena Litoiu
Senior Director Research and Advisory, Enterprise Architecture
|
|
Lan Nguyen
IT Executive, Mentor, Managing Partner at CIOs Beyond Borders Group
|
|
Dirk Coetsee
Director Research and Advisory, Enterprise Architecture, Data & Analytics
|
|
Andy Neill
AVP, Enterprise Architecture, Data and Analytics
|
|
Wayne Filin-Matthews
Chief Enterprise Architect, ICMG Winner of Global Chief Enterprise Architect of the Year 2019
|
|
Graham Smith
Experienced lead Enterprise Architect and Independent Consultant
|
Thanks also go to all experts who contributed to previous versions of this document:
Additional interviews were conducted but are not listed due to privacy and confidentiality requirements.
“Agile Manifesto for Software Development,” Ward Cunningham, 2001. Accessed July 2021.
“ArchiMate 3.1 Specification.” The Open Group, n.d. Accessed July 2021.
“Are Your IT Strategy and Business Strategy Aligned?” 5Q Partners, 8 Jan. 2015. Accessed Oct. 2016.
Bowen, Fillmore. “How agile companies create and sustain high ROI.” IBM. Accessed Oct. 2016.
Burns, Peter, et al. Building Value through Enterprise Architecture: A Global Study. Booz & Co. 2009. Web. Nov. 2016.
“Demonstrating the Value of Enterprise Architecture in Delivering Business Capabilities.” Cisco, 2008. Web. Oct. 2016.
“Disciplined Agile.” Disciplined Agile Consortium, n.d. Web.
Fowler, Martin. “Building Effective software.” MartinFowler.com. Accessed July 2021.
Fowler, Martin. “Agile Software Guide.” MartinFowler.com, 1 Aug. 2019.
Accessed July 2021.Haughey, Duncan. “SMART Goals.” Project Smart, 2014. Accessed July 2021.
Kern, Matthew. “20 Enterprise Architecture Practices.” LinkedIn, 3 March 2016. Accessed Nov. 2016.
Lahanas, Stephen. “Infrastructure Architecture, Defined.” IT Architecture Journal, Sept. 2014. Accessed July 2021.
Lean IX website, Accessed July 2021.
Litoiu, Milena. Course material from Information Technology 2690: Foundations of Enterprise Architecture, 2021, University of Toronto.
Mocker, M., J.W. Ross, and C.M. Beath. “How Companies Use Digital Technologies to Enhance Customer Findings.” MIT CISR Working Paper No. 434, Feb. 2019. Qtd in Mayor, Tracy. “MIT expert recaps 30-plus years of enterprise architecture.” MIT Sloan, 10 Aug. 2020. Web.
“Open Agile ArchitectureTM.” The Open Group, 2020. Accessed July 2021.
“Organizational Design Framework – The Transformation Model.” The Center for Organizational Design, n.d. Accessed 1 Aug. 2020.
Ross, Jeanne W. et al. Enterprise Architecture as Strategy: Creating a Foundation for Business Execution. Harvard Business School Press, 2006.
Rouse, Margaret. “Enterprise Architecture (EA).” SearchCIO, June 2007. Accessed Nov. 2016.
“SAFe 5 for Lean Enterprises.” Scaled Agile Framework, Scaled Agile, Inc. Accessed 2021.
“Security Architecture.” Technopedia, updated 20 Dec. 2016. Accessed July 2021.
“Software Engineering Institute.” Carnegie Mellon University, n.d. Web.
“TOGAF 9.1.” The Open Group, 2011. Accessed Oct. 2016.
“TOGAF 9.2.” The Open Group, 2018. Accessed July 2021.
Thompson, Rachel. “Stakeholder Analysis: Winning Support for Your Projects.” MindTools, n.d. Accessed July 2021.
Wendt, Jerome M. “Redefining ‘SMB’, ‘SME’ and ‘Large Enterprise.’” DCIG, 25 Mar. 2011. Accessed July 2021.
Wilkinson, Jim. “Business Drivers.” The Strategic CFO, 23 July 2013. Accessed July 2021.
Zachman, John. “Conceptual, Logical, Physical: It is Simple.” Zachman International, 2011. Accessed July 2021.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this report to understand the current situation in the cybersecurity space and inform your plan for 2022. This report includes sections on protecting against and responding to ransomware, acquiring and retaining talent, securing a remote workforce, securing digital transformation, and adopting zero trust.
The pandemic has introduced a lot of changes to our lives over the past two years, and this is also true for various aspects of how we work. In particular, a large workforce moved online overnight, which shifted the work environment rapidly.
People changed how they communicate, how they access company information, and how they connect to the company network. These changes make cybersecurity a more important focus than ever.
Although changes like the shift to remote work occurred in response to the pandemic, they are largely expected to remain, regardless of the progression of the pandemic itself. This report will look into important security trends and the priorities that stemmed from these trends.
30% more professionals expect transformative permanent change compared to one year ago.
47% of professionals expect a lot of permanent change; this remains the same as last year. (Source: Info-Tech Tech Trends 2022 Survey; N=475)
$4.24 millionAverage cost of a data breach in 2021 |
The cost of a data breach rose by nearly 10% in the past year, the highest rate in over seven years. |
$1.07 millionMore costly when remote work involved in the breach |
The average cost of breaches where remote work is involved is $1.07 million higher than breaches where remote work is not involved. The ubiquitous remote work that we saw in 2021 and continue to see in 2022 can lead to more costly security events. (Source: IBM, 2021) |
Remote work is here to stay, and the cost of a breach is higher when remote work is involved.
The cost comes not only directly from payments but also indirectly from reputational loss. (Source: IBM, 2021)
$1.76 millionSaved when zero trust is deployed facing a breach |
Zero trust controls are realistic and effective controls. Organizations that implement zero trust dramatically reduce the cost of an adverse security event. |
35%More costly if it takes more than 200 days to identify and contain a breach |
With increased BYOD and remote work, detection and response is more challenging than ever before – but it is also highly effective. Organizations that detect and respond to incidents quickly will significantly reduce the impact. (Source: IBM, 2021) |
Breaches are 34% less costly when mature zero trust is implemented.
A fully staffed and well-prepared security team could save the cost through quick responses. (Source: IBM, 2021)
As part of its research process for the 2022 Security Priorities Report, Info-Tech Research Group surveyed security and IT leaders (N=97) to ask their top security priorities as well as their main obstacles to security success in 2022:
Top Priorities
Survey respondents were asked to force-rank their security priorities. Among the priorities chosen most frequently as #1 were talent management, addressing ransomware threats, and securing hybrid/remote work. |
Top Obstacles
Talent management is both the #1 priority and the top obstacle facing security leaders in 2022. Unsurprisingly, the ever-changing environment in a world emerging from a pandemic and budget constraints are also top obstacles. |
This report details what we see the world demanding of security leaders in the coming year.
Setting aside the demands – what are security leaders actually working on?
![]() |
Many organizations are still mastering the foundations of a mature cybersecurity program. This is a good idea! Most breaches are still due to gaps in foundational security, not lack of advanced controls. |
![]() |
One industry plainly stands out from the rest. Government organizations are proportionally much more active in security than other industries, and for good reason: they are common targets. Manufacturing and professional services are proportionally less interested in security. This is concerning, given the recent targeting of supply chain and personal data holders by ransomware gangs. |

Main Influencing Factors |
||
| COVID-19 Pandemic
The pandemic has changed the way we interact with technology. Organizations are universally adapting their business and technology processes to fit the post-pandemic paradigm. |
Rampant Cybercrime Activity
By nearly every conceivable metric, cybercrime is way up in the past two years. Cybercriminals smell blood and pose a more salient threat than before. Higher standards of cybersecurity capability are required to respond to this higher level of threat. |
Remote Work and Workforce Reallocation
Talented IT staff across the globe enabled an extraordinarily fast shift to remote and distance work. We must now reckon with the security and human resourcing implications of this huge shift. |
Cybersecurity talent has been in short supply for years, but this shortage has inflected upward since the pandemic.
The Great Resignation contributed to the existing talent gap. The pandemic has changed how people work as well as how and where they choose work. More and more senior workers are retiring early or opting for remote working opportunities.
The cost to acquire cybersecurity talent is huge, and the challenge doesn’t end there. Retaining top talent can be equally difficult.
2.72 million unfilled cybersecurity openings (Source: (ISC)2, 2021)
| Burnout | 30% |
| Other remote opportunities | 20% |
| Lack of growth opportunities | 20% |
| Poor culture | 20% |
| Acquisition concerns | 10% |
| Staffing obstacles in 2022:
“Attracting and retaining talent is always challenging. We don’t pay as well and my org wants staff in the office at least half of the time. Most young, smart, talented new hires want to work remotely 100 percent of the time.“ “Trying to grow internal resources into security roles.” “Remote work expectations by employees and refusal by business to accommodate.” “Biggest obstacle: payscales that are out of touch with cybersecurity market.” “Request additional staff. Obtaining funding for additional position is most significant obstacle.” (Info-Tech Tech Security Priorities Survey 2022) |
Top obstacles in 2022:
As you can see, respondents to our security priorities survey have strong feelings on the challenges of staffing a cybersecurity team. The growth of remote work means local talent can now be hired by anybody, vastly increasing your competition as an employer. Hiring local will get tougher – but so will hiring abroad. People who don’t want to relocate for a new job now have plenty of alternatives. Without a compelling remote work option, you will find non-local prospects unwilling to move for a new job. Lastly, many organizations are still reeling at the cost of experienced cybersecurity talent. Focused internal training and development will be the answer for many organizations. |
| Provide career development opportunities
Many security professionals are dissatisfied with their unclear career development paths. To improve retention, organizations should provide their staff with opportunities and clear paths for career and skills advancement. |
Be open-minded when hiring
To broaden the candidate pool, organizations should be open-minded when considering who to hire.
|
| Facilitate work-life balance
Many security professionals say they experience burnout. Promoting work-life balance in your organization can help retain critical skills. |
Create inclusive environment
Hire a diverse team and create an inclusive environment where they can thrive. |
Use this template to explain the priorities you need your stakeholders to know about.
Provide a brief value statement for the initiative.
Initiative Description:
|
Description must include what IT will undertake to complete the initiative. | |||
Primary Business Benefits:
Reduction in costs due to turnover and talent loss |
Other Expected Business Benefits:
|
Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts. | ||
Risks:
|
Related Info-Tech Research: |
|||
Remote work poses unique challenges to cybersecurity teams. The personal home environment may introduce unauthorized people and unknown network vulnerabilities, and the organization loses nearly all power and influence over the daily cyber hygiene of its users.
In addition, the software used for enabling remote work itself can be a target of cybersecurity criminals.
70% of tech workers work from home (Source: Statcan, 2021)
The security perimeter is finally goneThe data is outside the datacenter.
Organizations that did not implement digital transformation changes following COVID-19 experience higher costs following a breach, likely because it is taking nearly two months longer, on average, to detect and contain a breach when more than 50% of staff are working remotely (IBM, 2021). In 2022 the cumulative risk of so many remote connections means we need to rethink how we secure the remote/hybrid workforce. |
Security
|
![]() |
Network
|
| Mature your identity management
Compromised identity is the main vector to breaches in recent years. Stale accounts, contractor accounts, misalignment between HR and IT – the lack of foundational practices leads to headline-making breaches every week.
|
Get a handle on your endpoints
Work-from-home (WFH) often means unknown endpoints on unknown networks full of other unknown devices…and others in the home potentially using the workstation for non-work purposes. Gaining visibility into your endpoints can help to keep detection and resolution times short. |
| Educate users
Educate everyone on security best practices when working remotely:
|
Ease of use
Many workers complain that the corporate technology solution makes it difficult to get their work done. Employees will take productivity over security if we force them to choose, so IT needs to listen to end users’ needs and provide a solution that is nimble and secure. |
Use this template to explain the priorities you need your stakeholders to know about.
Provide a brief value statement for the initiative.
Initiative Description:
| Description must include what IT will undertake to complete the initiative. | |||
Primary Business Benefits: | Other Expected Business Benefits:
| Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts. | ||
Risks:
| Related Info-Tech Research: | |||
Digital transformation is occurring at an ever-increasing rate these days. As Microsoft CEO Satya Nadella said early in the pandemic, “We’ve seen two years’ worth of digital transformation in two months.”
We have heard similar stories from Info-Tech members who deployed rollouts that were scheduled to take months over a weekend instead.
Microsoft’s own shift to rapidly expand its Teams product is a prime example of how quickly the digital landscape has changed. The global adaption to a digital world has largely been a success story, but rapid change comes with risk, and there is a parallel story of rampant cyberattacks like we have never seen before.
There is an adage that “slow is smooth, and smooth is fast” – the implication being that fast is sloppy. In 2022 we’ll see a pattern of organizations working to catch up their cybersecurity with the transformations we all made in 2020.
$1.78 trillion expected in digital transformation investments (Source: World Economic Forum, 2021)
| Digital transformations often rely heavily on third-party cloud service providers, which increases exposure of corporate data.
Further, adoption of new technology creates a new threat surface that must be assessed, mitigations implemented, and visibility established to measure performance. However, digital transformations are often run on slim budgets and without expert guidance. Survey respondents report as much: rushed deployments, increased cloud migration, and shadow IT are the top vulnerabilities reported by security leaders and executives. |
In a 2020 Ponemon survey, 82% of IT security and C-level executives reported experiencing at least one data breach directly resulting from a digital transformation they had undergone. Scope creep is inevitable on any large project like a digital transformation. A small security shortcut early in the project can have dire consequences when it grows to affect personal data and critical systems down the road. |
| Engage the business early and often
Despite the risks, organizations engage in digital transformations because they also have huge business value. Security leaders should not be seeking to slow or stop digital transformations; rather, we should be engaging with the business early to get ahead of risks and enable successful transformation. |
Establish a vendor security program
Data is moving out of datacenters and onto third-party environments. Without security requirements built into agreements, and clear visibility into vendor security capabilities, that data is a major source of risk. A robust vendor security program will create assurance early in the process and help to reinforce the responsibility of securing data with other parts of the organization. |
| Build/revisit your security strategy
The threat surface has changed since before your transformation. This is the right time to revisit or rebuild your security strategy to ensure that your control set is present throughout the new environment – and also a great opportunity to show how your current security investments are helping secure your new digital lines of business! |
Educate your key players
Only 16% of security leaders and executives report alignment between security and business processes during digital transformation. If security is too low a priority, then key players in your transformation efforts are likely unaware of how security risks impact their own success. It will be incumbent upon the CISO to start that conversation. |
Use this template to explain the priorities you need your stakeholders to know about.
Provide a brief value statement for the initiative.
Initiative Description:
| Description must include what IT will undertake to complete the initiative. | |||
Primary Business Benefits: | Other Expected Business Benefits:
| Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts. | ||
Risks:
| Related Info-Tech Research: | |||
John Kindervag modernized the concept of zero trust back in 2010, and in the intervening years there has been enormous interest in cybersecurity circles, yet in 2022 only 30% of organizations report even beginning to roll out zero trust capabilities (Statista, 2022).
Why such little action on a revolutionary and compelling model?
Zero trust is not a technology; it is a principle. Zero trust adoption takes concerted planning, effort, and expense, for which the business value has been unclear throughout most of the last 10 years. However, several recent developments are changing that:
The time has come for zero trust adoption to begin in earnest.
97% will maintain or increase zero trust budget (Source: Statista, 2022)
A hybrid workforce using traditional VPN creates an environment where we are exposed to all the risks in the wild (unknown devices at any location on any network), but at a stripped-down security level that still provides the trust afforded to on-premises workers using known devices.
What’s more, threats such as ransomware are known to exploit identity and remote access vulnerabilities before moving laterally within a network – vectors that are addressed directly by zero trust identity and networking. Ninety-three percent of surveyed zero trust adopters state that the benefits have matched or exceeded their expectations (iSMG, 2022).
44%Enforce least privilege access to critical resources |
44%Reduce attacker ability to move laterally |
41%Reduce enterprise attack surface |
A major obstacle to zero trust adoption has been the sheer cost, along with the lack of business case for that investment. Two factors are changing that paradigm in 2022:
The May 2021 US White House Executive Order for federal agencies to adopt zero trust architecture finally placed zero trust on the radar of many CEOs and board members, creating the business interest and willingness to consider investing in zero trust.
In addition, the cost of adopting zero trust is quickly being surpassed by the cost of not adopting zero trust, as cyberattacks become rampant and successful zero trust deployments create a case study to support investment.
![]() |
The cost to remediate a ransomware attack more than doubled from 2020 to 2021. Widespread adoption of zero trust capabilities could keep that number from doubling again in 2022. (Source: Sophos, 2021) |
The cost of a data breach is on average $1.76 million less for organizations with mature zero trust deployments.
That is, the cost of a data breach is 35% reduced compared to organizations without zero trust controls. (Source: IBM, 2021)
| Start small
Don’t put all your eggs in one basket by deploying zero trust in a wide swath. Rather, start as small as possible to allow for growing pains without creating business friction (or sinking your project altogether). |
Build a sensible roadmap
Zero trust principles can be applied in a myriad of ways, so where should you start? Between identities, devices, networking, and data, decide on a use case to do pilot testing and then refine your approach. |
| Beware too-good-to-be-true products
Zero trust is a powerful buzzword, and vendors know it. Be skeptical and do your due diligence to ensure your new security partners in zero trust are delivering what you need. |
Use this template to explain the priorities you need your stakeholders to know about.
Provide a brief value statement for the initiative.
Initiative Description:
| Description must include what IT will undertake to complete the initiative. | ||||
Primary Business Benefits: | Other Expected Business Benefits:
| Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts. | |||
Risks:
| Related Info-Tech Research: | ||||
150% increase ransomware attacks in 2020 (Source: ENISA)
| What is the same in 2022
Unbridled ransomware attacks make it seem like attackers must be using complex new techniques, but prevalent ransomware attack vectors are actually well understood. Nearly all modern variants are breaching victim systems in one of three ways:
|
What is new in 2022
The sophistication of victim targetingVictims often find themselves asking, “How did the attackers know to phish the most security-oblivious person in my staff?” Bad actors have refined their social engineering and phishing to exploit high-risk individuals, meaning your chain is only as strong as the weakest link. Ability of malware to evade detectionModern ransomware is getting better at bypassing anti-malware technology, for example, through creative techniques such as those seen in the MedusaLocker variant and in Ghost Control attacks. Effective anti-malware is still a must-have control, but a single layer of defense is no longer enough. Any organization that hopes to avoid paying a ransom must prepare to detect, respond, and recover from an attack. |
| Do you know what it would take to recover from a ransomware incident?
…and does your executive leadership know what it would take to recover? The organizations that are most likely to pay a ransom are unprepared for the reality of recovering their systems. If you have not done a tabletop or live exercise to simulate a true recovery effort, you may be exposed to more risk than you realize. |
Are your defenses sufficiently hardened against ransomware?
Organizations with effective security prevention are often breached by ransomware – but they are prepared to contain, detect, and eradicate the infection. Ask yourself whether you have identified potential points of entry for ransomware. Assume that your security controls will fail. How well are your security controls layered, and how difficult would it be for an attacker to move east/west within your systems? |
| Be prepared for a breach
There is no guarantee that an organization will not fall victim to ransomware, so instead of putting all their effort into prevention, organizations should also put effort into planning to respond to a breach. |
Security awareness training/phishing detection
Phishing continues to be the main point of entry for ransomware. Investing in phishing awareness and detection among your end users may be the most impactful countermeasure you can implement. |
| Zero trust adoption
Always verify at every step of interaction, even when access is requested by internal users. Manage access of sensitive information based on the principle of least privilege access. |
Encrypt and back up your data
Encrypt your data so that even if there is a breach, the attackers don’t have a copy of your data. Also, keep regular backups of data at a separate location so that you still have data to work with after a breach occurs. You never want to pay a ransom. Being prepared to deal with an incident is your best chance to avoid paying! |
Use this template to explain the priorities you need your stakeholders to know about.
Provide a brief value statement for the initiative.
Initiative Description:
| Description must include what IT will undertake to complete the initiative. | |||
Primary Business Benefits: | Other Expected Business Benefits:
| Align initiative benefits back to business benefits or benefits for the stakeholder groups that it impacts. | ||
Risks:
| Related Info-Tech Research: | |||
How long has it been since you’ve gone a full workday without having a videoconference with someone?
We have become inherently trustful that the face we see on the screen is real, but the technology required to falsify that video is widely available and runs on commercially available hardware, ushering in a genuinely post-truth online era.
Criminals can use deepfakes to enhance social engineering, to spread misinformation, and to commit fraud and blackmail.
Many financial institutions have recently deployed voiceprint authentication. TD describes its VoicePrint as “voice recognition technology that allows us to use your voiceprint – as unique to you as your fingerprint – to validate your identity” over the phone.
However, hackers have been defeating voice recognition for years already. There is ripe potential for voice fakes to fool both modern voice recognition technology and the accounts payable staff.
“2021 Ransomware Statistics, Data, & Trends.” PurpleSec, 2021. Web.
Bayern, Macy. “Why 60% of IT security pros want to quit their jobs right now.” TechRepublic, 10 Oct. 2018. Web.
Bresnahan, Ethan. “How Digital Transformation Impacts IT And Cyber Risk Programs.” CyberSaint Security, 25 Feb. 2021. Web.
Clancy, Molly. “The True Cost of Ransomware.” Backblaze, 9 Sept. 2021.Web.
“Cost of a Data Breach Report 2021.” IBM, 2021. Web.
Cybersecurity Ventures. “Global Ransomware Damage Costs To Exceed $265 Billion By 2031.” Newswires, 4 June 2021. Web.
“Digital Transformation & Cyber Risk: What You Need to Know to Stay Safe.” Ponemon Institute, June 2020. Web.
“Global Incident Response Threat Report: Manipulating Reality.” VMware, 2021.
Granger, Diana. “Karmen Ransomware Variant Introduced by Russian Hacker.” Recorded Future, 18 April 2017. Web.
“Is adopting a zero trust model a priority for your organization?” Statista, 2022. Web.
“(ISC)2 Cybersecurity Workforce Study, 2021: A Resilient Cybersecurity Profession Charts the Path Forward.” (ISC)2, 2021. Web.
Kobialka, Dan. “What Are the Top Zero Trust Strategies for 2022?” MSSP Alert, 10 Feb. 2022. Web.
Kost, Edward. “What is Ransomware as a Service (RaaS)? The Dangerous Threat to World Security.” UpGuard, 1 Nov. 2021. Web.
Lella, Ifigeneia, et al., editors. “ENISA Threat Landscape 2021.” ENISA, Oct. 2021. Web.
Mello, John P., Jr. “700K more cybersecurity workers, but still a talent shortage.” TechBeacon, 7 Dec. 2021. Web.
Naraine, Ryan. “Is the ‘Great Resignation’ Impacting Cybersecurity?” SecurityWeek, 11 Jan. 2022. Web.
Oltsik, Jon. “ESG Research Report: The Life and Times of Cybersecurity Professionals 2021 Volume V.” Enterprise Security Group, 28 July 2021. Web.
Osborne, Charlie. “Ransomware as a service: Negotiators are now in high demand.” ZDNet, 8 July 2021. Web.
Osborne, Charlie. “Ransomware in 2022: We’re all screwed.” ZDNet, 22 Dec. 2021. Web.
“Retaining Tech Employees in the Era of The Great Resignation.” TalentLMS, 19 Oct. 2021. Web.
Rubin, Andrew. “Ransomware Is the Greatest Business Threat in 2022.” Nasdaq, 7 Dec. 2021. Web.
Samartsev, Dmitry, and Daniel Dobrygowski. “5 ways Digital Transformation Officers can make cybersecurity a top priority.“ World Economic Forum, 15 Sept. 2021. Web.
Seymour, John, and Azeem Aqil. “Your Voice is My Passport.” Presented at black hat USA 2018.
Solomon, Howard. “Ransomware attacks will be more targeted in 2022: Trend Micro.” IT World Canada, 6 Jan. 2022. Web.
“The State of Ransomware 2021.” Sophos, April 2021. Web.
Tarun, Renee. “How The Great Resignation Could Benefit Cybersecurity.” Forbes Technology Council, Forbes, 21 Dec. 2021. Web.
“TD VoicePrint.” TD Bank, n.d. Web.
“Working from home during the COVID-19 pandemic, April 202 to June 2021.” Statistics Canada, 4 Aug. 2021. Web.
“Zero Trust Strategies for 2022.” iSMG, Palo Alto Networks, and Optiv, 28 Jan. 2022. Web.
A properly optimized CRM ecosystem will reduce costs and increase productivity.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Gather information around the application:
Assess CRM and related environment. Perform CRM process assessment. Assess user satisfaction across key processes, applications, and data. Understand vendor satisfaction
Build your optimization roadmap: process improvements, software capability improvements, vendor relationships, and data improvement initiatives.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Define your CRM application vision.
Develop an ongoing application optimization team.
Realign CRM and business goals.
Understand your current system state capabilities.
Explore CRM and related costs.
1.1 Determine your CRM optimization team.
1.2 Align organizational goals.
1.3 Inventory applications and interactions.
1.4 Define business capabilities.
1.5 Explore CRM-related costs (optional).
CRM optimization team
CRM business model
CRM optimization goals
CRM system inventory and data flow
CRM process list
CRM and related costs
Map current-state capabilities.
Complete a CRM process gap analysis to understand where the CRM is underperforming.
Review the CRM application portfolio assessment to understand user satisfaction and data concerns.
Undertake a software review survey to understand your satisfaction with the vendor and product.
2.1 Conduct gap analysis for CRM processes.
2.2 Perform an application portfolio assessment.
2.3 Review vendor satisfaction.
CRM process gap analysis
CRM application portfolio assessment
CRM software reviews survey
Assess CRM.
Learn which processes you need to focus on.
Uncover underlying user satisfaction issues to address these areas.
Understand where data issues are occurring so that you can mitigate this.
Investigate your relationship with the vendor and product, including that relative to others.
Identify any areas for cost optimization (optional).
3.1 Explore process gaps.
3.2 Analyze user satisfaction.
3.3 Assess data quality.
3.4 Understand product satisfaction and vendor management.
3.5 Look for CRM cost optimization opportunities (optional).
CRM process optimization priorities
CRM vendor optimization opportunities
CRM cost optimization
Build the optimization roadmap.
Understanding where you need to improve is the first step, now understand where to focus your optimization efforts.
4.1 Identify key optimization areas.
4.2 Build your CRM optimization roadmap and next steps.
CRM optimization roadmap
In today’s connected world, continuous optimization of enterprise applications to realize your digital strategy is key.
Customer relationship management (CRM) systems are at the core of a customer-centric strategy to drive business results. They are critical to supporting marketing, sales, and customer service efforts.
CRM systems are expensive, their benefits are difficult to quantify, and they often suffer from poor user satisfaction. Post implementation, technology evolves, organizational goals change, and the health of the system is not monitored. This is complicated in today’s digital landscape with multiple integration points, siloed data, and competing priorities.
Too often organizations jump into the selection of replacement systems without understanding the health of their current systems. IT leaders need to stop reacting and take a proactive approach to continually monitor and optimize their enterprise applications. Strategically realign business goals, identify business application capabilities, complete a process assessment, evaluate user adoption, and create an optimization roadmap that will drive a cohesive technology strategy that delivers results.
Lisa Highfield
Research Director,
Enterprise Applications
Info-Tech Research Group
In today’s connected world, continuous optimization of enterprise applications to realize your digital strategy is key.
Enterprise applications often involve large capital outlay and unquantified benefits.
CRM application portfolios are often messy. Add to that poor processes, distributed data, and lack of training – business results and user dissatisfaction is common.
Technology owners are often distributed across the business. Consolidation of optimization efforts is key.
Enterprise applications involve large numbers of processes and users. Without a clear focus on organizational needs, decisions about what and how to optimize can become complicated.
Competing and conflicting priorities may undermine optimization value by focusing on the approaches that would only benefit one line of business rather than the entire organization.
Teams do not have a framework to illustrate, communicate, and justify the optimization effort in the language your stakeholders understand.
Build an ongoing optimization team to conduct application improvements.
Assess your CRM application(s) and the environment in which they exist. Take a business-first strategy to prioritize optimization efforts.
Validate CRM capabilities, user satisfaction, issues around data, vendor management, and costs to build out an optimization strategy
Pull this all together to develop a prioritized optimization roadmap.
CRM implementation should not be a one-and-done exercise. A properly optimized CRM ecosystem will reduce costs and increase productivity.
CRM platforms are the applications that provide functional capabilities and data management around the customer experience (CX).
Marketing, sales, and customer service are enabled through CRM technology.
CRM technologies facilitate an organization’s relationships with customers, service users, employees, and suppliers.
CRM technology is critical to managing the lifecycle of these relationships, from lead generation, to sales opportunities, to ongoing support and nurturing of these relationships.
Customer relationship management suites are one piece of the overall customer experience management ecosystem, alongside tools such as customer intelligence platforms and adjacent point solutions for sales, marketing, and customer service. Review Info-Tech’s CXM blueprint to build a complete, end-to-end customer interaction solution portfolio that encompasses CRM alongside other critical components. The CXM blueprint also allows you to develop strategic requirements for CRM based on customer personas and external market analysis.
Statistical analysis of CRM projects indicate failures vary from 18% to 69%. Taking an average of those analyst reports, about one-third of CRM projects are considered a failure.
Source: CIO Magazine, 2017
Companies that apply the principles of behavioral economics outperform their peers by 85% in sales growth and more than 25% in gross margin.
Source: Gallup, 2012
In 2019, 40% of executives name customer experience the top priority for their digital transformation.
Source: CRM Magazine, 2019
Drivers of Dissatisfaction |
|||
|---|---|---|---|
| Business | Data | People and Teams | Technology |
|
|
|
|
While technology is the key enabler of building strong customer experiences, there are many other drivers of dissatisfaction. IT must stand shoulder to shoulder with the business to develop a technology framework for customer relationship management.
Marketing, Sales, and Customer Service, along with IT, can only optimize CRM with the full support of each other. The cooperation of the departments is crucial when trying to improve CRM technology capabilities and customer interaction.
“A successful application optimization strategy starts with the business need in mind and not from a technological point of view. No matter from which angle you look at it, modernizing a legacy application is a considerable undertaking that can’t be taken lightly. Your best approach is to begin the journey with baby steps.”
– Ernese Norelus, Sreeni Pamidala, and Oliver Senti
Medium, 2020
| 1. Map Current-State Capabilities | 2. Assess Your Current State | 3. Build Your Optimization Roadmap | |
|---|---|---|---|
| Phase Steps |
|
|
|
| Phase Outcomes |
|
|
|
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.
CRM Optimization Roadmap (Tab 8)

Complete an assessment of processes, user satisfaction, data quality, and vendor management using the Workbook or the APA diagnostic.
Align your business and technology goals and objectives in the current environment.
Identify and prioritize your CRM optimization goals.
Assess IT-enabled user satisfaction across your CRM portfolio.
Understand areas for improvement.
Align strategy and technology to meet consumer demand.
INDUSTRY - Entertainment
SOURCE - Forbes, 2017
Beginning as a mail-out service, Netflix offered subscribers a catalog of videos to select from and have mailed to them directly. Customers no longer had to go to a retail store to rent a video. However, the lack of immediacy of direct mail as the distribution channel resulted in slow adoption.
Blockbuster was the industry leader in video retail but was lagging in its response to industry, consumer, and technology trends around customer experience
In response to the increasing presence of tech-savvy consumers on the internet, Netflix invested in developing its online platform as its primary distribution channel. The benefit of doing so was two-fold: passive brand advertising (by being present on the internet) and meeting customer demands for immediacy and convenience. Netflix also recognized the rising demand for personalized service and created an unprecedented, tailored customer experience.
Netflix’s disruptive innovation is built on the foundation of great customer experience management. Netflix is now a $28-billion company, which is tenfold what Blockbuster was worth.
Netflix used disruptive technologies to innovatively build a customer experience that put it ahead of the long-time, video rental industry leader, Blockbuster.
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| Phase 1 | Phase 2 | Phase 3 | ||
|---|---|---|---|---|
Call #1: Scope requirements, objectives, and your specific challenges. |
Call #2: Build the CRM team. Align organizational goals. |
Call #4: Conduct gap analysis for CRM processes. Prepare application portfolio assessment. |
Call #5: Understand product satisfaction and vendor management. Look for CRM cost optimization opportunities (optional). |
Call #7: Identify key optimization areas. Build out optimization roadmap and next steps. |
Call #3: Map current state. Inventory CRM processes. Explore CRM-related costs. |
Call #6: Review APA results. |
|||
A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between 8 to 12 calls over the course of 4 to 6 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
| Define Your CRM Application Vision | Map Current-State Capabilities | Assess CRM | Build the Optimization Roadmap | Next Steps and Wrap-Up (offsite) | |
Activities |
1.1 Determine your CRM optimization team 1.2 Align organizational goals 1.3 Inventory applications and interactions 1.4 Define business capabilities 1.5 Explore CRM-related costs |
2.1 Conduct gap analysis for CRM processes 2.2 Perform an application portfolio assessment 2.3 Review vendor satisfaction |
3.1 Explore process gaps 3.2 Analyze user satisfaction 3.3 Assess data quality 3.4 Understand product satisfaction and vendor management 3.5 Look for CRM cost optimization opportunities (optional) |
4.1 Identify key optimization areas 4.2 Build your CRM optimization roadmap and next steps |
5.1 Complete in-progress deliverables from previous four days 5.2 Set up review time for workshop deliverables and to discuss next steps |
| Deliverables |
|
|
|
|
Get the Most Out of Your CRM

Integration is paramount: your CRM application often integrates with other applications within the organization. Create an integration map to reflect a system of record and the exchange of data. To increase customer engagement, channel integration is a must (i.e. with robust links to unified communications solutions, email, and VoIP telephony systems).
CRM plays a key role in the more holistic customer experience framework. However, it is heavily influenced by and often interacts with many other platforms.
Data is one key consideration that needs to be considered here. If customer information is fragmented, it will be nearly impossible to build a cohesive view of the customer. Points of integration (POIs) are the junctions between the CRM(s) and other applications where data is flowing to and from. They are essential to creating value, particularly in customer insight-focused and omnichannel-focused deployments.
CRM strategy is a critical component of customer experience (CX).
Source: Forbes, 2019
Build a cohesive CRM strategy that aligns business goals with CRM capabilities.
Customers expect to interact with organizations through the channels of their choice. Now more than ever, you must enable your organization to provide tailored customer experiences.
Technology is the key enabler of building strong customer experiences: IT must stand shoulder to shoulder with the business to develop a technology framework for customer relationship management.
1.1.1 Identify the stakeholders whose support will be critical to success
1.1.2 Select your CRM optimization team
Understand the roles necessary to get the most out of your CRM.
Understand the role of each player within your optimization initiative. Look for listed participants on the activity slides to determine when each player should be involved.
Do not limit input or participation. Include subject matter experts and internal stakeholders at stages within the optimization initiative. Such inputs can be solicited on a one-off basis as needed. This ensures you take a holistic approach to creating your CRM optimization strategy.
| Title | Roles Within CRM Optimization Initiative |
|---|---|
Optimization Sponsor |
|
Optimization Initiative Manager |
|
Business Leads/ |
|
CRM Optimization Team |
|
Steering Committee |
|
Consider the core team functions when composing the CRM optimization team. Form a cross-functional team (i.e. across IT, Marketing, Sales, Service, Operations) to create a well-aligned CRM optimization strategy.
Don’t let your core team become too large when trying to include all relevant stakeholders. Carefully limiting the size of the optimization team will enable effective decision making while still including functional business units such as Marketing, Sales, Service, and Customer Service.
Required Skills/Knowledge |
Suggested Optimization Team Members |
|---|---|
Business |
|
|
|
IT |
|
|
|
| Other | |
|
|
Get the Most Out of Your CRM Workbook
Map Current-State Capabilities
Your corporate strategy:
Your CRM Strategy:
CRM projects are more successful when the management team understands the strategic importance and the criticality of alignment. Time needs to be spent upfront aligning business strategies with CRM capabilities. Effective alignment between Sales, Marketing, Customer Service, Operations, IT, and the business should happen daily. Alignment doesn’t just need to occur at the executive level but at each level of the organization.
Increase Revenue |
Enable lead scoring |
Deploy sales collateral management tools |
Improve average cost per lead via a marketing automation tool |
|---|---|---|---|
Enhance Market Share |
Enhance targeting effectiveness with a CRM |
Increase social media presence via an SMMP |
Architect customer intelligence analysis |
Improve Customer Satisfaction |
Reduce time-to-resolution via better routing |
Increase accessibility to customer service with live chat |
Improve first contact resolution with customer KB |
Increase Customer Retention |
Use a loyalty management application |
Improve channel options for existing customers |
Use customer analytics to drive targeted offers |
Create Customer-Centric Culture |
Ensure strong training and user adoption programs |
Use CRM to provide 360-degree view of all customer interactions |
Incorporate the voice of the customer into product development |
Identifying organizational objectives of high priority will assist in breaking down business needs and CRM objectives. This exercise will better align the CRM systems with the overall corporate strategy and achieve buy-in from key stakeholders.
Business Needs |
Business Drivers |
Technology Drivers |
Environmental Factors |
|
|---|---|---|---|---|
| Definition | A business need is a requirement associated with a particular business process. | Business drivers can be thought of as business-level goals. These are tangible benefits the business can measure such as employee retention, operation excellence, and financial performance. | Technology drivers are technological changes that have created the need for a new CRM enablement strategy. Many organizations turn to technology systems to help them obtain a competitive edge. | External considerations are factors taking place outside of the organization that are impacting the way business is conducted inside the organization. These are often outside the control of the business. |
Examples |
|
|
|
|
One of the biggest drivers for CRM adoption is the ability to make decisions through consolidated data. This driver is a result of external considerations. Many industries today are highly competitive, uncertain, and rapidly changing. To succeed under these pressures, there needs to be timely information and visibility into all components of the organization.
Get the Most Out of Your CRM Workbook
![]() |
|||
|---|---|---|---|
External Considerations |
Organizational Drivers |
Technology Considerations |
Functional Requirements |
|
|
|
|
There are several different factors that may stifle the success of an CRM portfolio. Organizations creating an CRM foundation must scan their current environment to identify internal barriers and challenges.
Management Support |
Organizational Culture |
Organizational Structure |
IT Readiness |
|
|---|---|---|---|---|
| Definition | The degree of understanding and acceptance towards CRM technology and systems. | The collective shared values and beliefs. | The functional relationships between people and departments in an organization. | The degree to which the organization’s people and processes are prepared for new CRM system(s.) |
Questions |
|
|
|
|
| Impact |
|
|
|
|
Get the Most Out of Your CRM Workbook
![]() |
|||
|---|---|---|---|
Functional Gaps |
Technical Gaps |
Process Gaps |
Barriers to Success |
|
|
|
|
![]() | |||
|---|---|---|---|
Business Benefits | IT Benefits | Organizational Benefits | Enablers of Success |
|
|
|
|
| Increase Revenue | CRM Benefits |
|---|---|
|
|
|
|
|
|
|
Download the Get the Most Out of Your CRM Workbook
1.3.1 Inventory applications and interactions


Be sure to include enterprise applications that are not included in the CRM application portfolio. Popular systems to consider for POIs include billing, directory services, content management, and collaboration tools.
When assessing the current application portfolio that supports CRM, the tendency will be to focus on the applications under the CRM umbrella, relating mostly to Marketing, Sales, and Customer Service. Be sure to include systems that act as input to, or benefit due to outputs from, the CRM or similar applications.

1.4.1 Define business capabilities
1.4.2 List your key CRM processes
In business architecture, the primary view of an organization is known as a business capability map.
A business capability defines what a business does to enable value creation, rather than how.
Business capabilities:
A business capability map provides details that help the business architecture practitioner direct attention to a specific area of the business for further assessment.
When examining CRM optimization, it is important we approach this from the appropriate layer.
In today’s complex organizations, it can be difficult to understand where inefficiencies stem from and how performance can be enhanced.
To fix problems and maximize efficiencies business capabilities and processes need to be examined to determine gaps and areas of lagging performance.
Info-Tech’s CRM framework and industry tools such as the APQC’s Process Classification Framework can help make sense of this.
CRM Application Inventory Tool
An operating model is a framework that drives operating decisions. It helps to set the parameters for the scope of CRM and the processes that will be supported. The operating model will serve to group core operational processes. These groupings represent a set of interrelated, consecutive processes aimed at generating a common output.
Value Streams |
Design Product |
Produce Product |
Sell Product |
Customer Service |
|---|---|---|---|---|
|
|
|
|
Value streams connect business goals to the organization’s value realization activities in the marketplace. Those activities are dependent on the specific industry segment in which an organization operates.
There are two types of value streams: core value streams and support value streams.
An effective method for ensuring all value streams have been considered is to understand that there can be different end-value receivers.
Source: APQC, 2020
If you do not have a documented process model, you can use the APQC Framework to help define your inventory of sales business processes.
APQC’s Process Classification Framework is a taxonomy of cross-functional business processes intended to allow the objective comparison of organizational performance within and among organizations.

APQC provides a process classification framework. It allows organizations to effectively define their processes and manage them appropriately.
THE APQC PROCESS CLASSIFICATION FRAMEWORK (PCF)® was developed by non-profit APQC, a global resource for benchmarking and best practices, and its member companies as an open standard to facilitate improvement through process management and benchmarking, regardless of industry, size, or geography. The PCF organizes operating and management processes into 12 enterprise level categories, including process groups and over 1,000 processes and associated activities. To download the full PCF or industry-specific versions of the PCF as well as associated measures and benchmarking, visit www.apqc.org/pcf.
| Level 1 | Level | Level 3 | Level 4 |
|---|---|---|---|
Market and sell products and services |
Understand markets, customers, and capabilities | Perform customer and market intelligence analysis | Conduct customer and market research |
Market and sell products and services |
Develop sales strategy | Develop sales forecast | Gather current and historic order information |
Deliver services |
Manage service delivery resources | Manage service delivery resource demand | Develop baseline forecasts |
| ? | ? | ? | ? |
Focus your initial assessment on the level 1 processes that matter to your organization. This allows you to target your scant resources on the areas of optimization that matter most to the organization and minimize the effort required from your business partners.
You may need to iterate the assessment as challenges are identified. This allows you to be adaptive and deal with emerging issues more readily and become a more responsive partner to the business.
Get the Most Out of Your CRM Workbook

*Adapted from the APQC Cross-Industry Process Classification Framework, 2019.
1.5.1 List CRM-related costs (optional)
Before you can make changes and optimization decisions, you need to understand the high-level costs associated with your current application architecture. This activity will help you identify the types of technology and people costs associated with your current systems.

Get the Most Out of Your CRM Workbook





Option 1: Use Info-Tech’s Application Portfolio Assessment to generate your user satisfaction score. This tool not only measures application satisfaction but also elicits great feedback from users regarding support they receive from the IT team.
Option 2: Use the method of choice to elicit current user satisfaction for each of the processes identified as important to the organization.

Understand user satisfaction across capabilities and departments within your organization.
Download the CRM Application Inventory Tool
Using the results from the Application Portfolio Assessment or your own user survey:

Understand user satisfaction across capabilities and departments within your organization.
2.3.1 Rate your vendor and product satisfaction
2.3.2 Enter SoftwareReviews scores from your CRM Product Scorecard (optional)
Source: SoftwareReviews, March 2019
80% satisfaction score, and the other list is CIOs with <80% satisfaction score.">
The data shows that effective IT leaders invest a significant amount of time (8%) on vendor management initiatives.
Be proactive in managing you calendar and block time for these important tasks.
Analysis of CIOs’ calendars revealed that how CIOs spend their time has a correlation to both stakeholder IT satisfaction and CEO-CIO alignment.
Those CIOs that prioritized vendor management were more likely to have a business satisfaction score greater than 80%.

Use Info-Tech’s vendor satisfaction survey to identify optimization areas with your CRM product(s) and vendor(s).
Option 1 (recommended): Conduct a satisfaction survey using SoftwareReviews. This option allows you to see your results in the context of the vendor landscape.
Download the Get the Most Out of Your CRM Workbook
Option 2: Use your Get the Most Out of Your CRM Workbook, tab “6. Vendor Optimization,” to review your satisfaction with your software.
SoftwareReviews’ Customer Relationship Management

Download the Get the Most Out of Your CRM Workbook
SoftwareReviews’ Customer Relationship Management
Support user satisfaction
Enabling a high-performing, customer-centric sales, marketing, and customer service operations program requires excellent management practices and continuous optimization efforts.
Technology portfolio and architecture is important, but we must go deeper. Taking a holistic view of CRM technologies in the environments in which they operate allows for the inclusion of people and process improvements – this is key to maximizing business results.
Using a formal CRM optimization initiative will drive business-IT alignment, identify IT automation priorities, and dig deep into continuous process improvement.


| Data Quality Management | Effective Data Governance | Data-Centric Integration Strategy | Extensible Data Warehousing |
|---|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|


A VMI is a formalized process within an organization, responsible for evaluating, selecting, managing, and optimizing third-party providers of goods and services.
The amount of resources you assign to managing vendors depends on the number and value of your organization’s relationships. Before optimizing your vendor management program around the best practices presented in this blueprint, assess your current maturity and build the process around a model that reflects the needs of your organization.
Info-Tech uses VMI interchangeably with the terms “vendor management office (VMO),” “vendor management function,” “vendor management process,” and “vendor management program.”
See previous slide for help around implementing a vendor management initiative.

Before you can make changes and optimization decisions, you need to understand the high-level costs associated with your current application architecture. This activity will help you identify the types of technology and people costs associated with your current systems.
This is meant as a high-level roadmap. For formal, ongoing optimization project management, refer to “Build a Better Backlog” (Phase 2 of the Info-Tech blueprint Deliver on Your Digital Product Vision).

Use a holistic assessment of the “interest” paid on technical debt to quantify and prioritize risk and enable the business make better decisions.
Phase 2: Build a Better Product Backlog
Build a structure for your backlog that supports your product vision.
An ongoing CRM optimization effort is best facilitated through a continuous Agile process. Use info-Tech’s developed tools to build out your backlog.
The key to a better backlog is a common structure and guiding principles that product owners and product teams can align to.
Exceptional customer value begins with a clearly defined backlog focused on items that will create the greatest human and business benefits.
Activity Participants | ||||||||
|---|---|---|---|---|---|---|---|---|
Backlog Activity | Quality Filter | Product Manager | Product Owner | Dev Team | Scrum Master | Business | Architects | |
| Sprint | Sprint Planning | “Accepted” | ✔ | ✔ | ✔ | |||
| Ready | Refine | “Ready” | ✔ | ✔ | ✔ | |||
| Qualified | Analysis | “Qualified” | ✔ | ✔ | ✔ | ✔ | ✔ | |
Ideas | Intake | “Backlogged” | ✔ | ✔ | ✔ | ✔ | ✔ | |
A product owner is accountable for defining and prioritizing the work that will be of the greatest value to the organization and its customers. The backlog is the key to facilitating this process and accomplishing the most fundamental goals of delivery.
For more information on the role of a product owner, see Build a Better Product Owner.
Highly effective Agile teams spend 28% of their time on product backlog management and roadmapping (Quantitative Software Management, 2015).
A well-formed backlog can be thought of as a DEEP backlog:
Detailed Appropriately: PBIs are broken down and refined as necessary.
Emergent: The backlog grows and evolves over time as PBIs are added and removed.
Estimated: The effort a PBI requires is estimated at each tier.
Prioritized: The PBI’s value and priority are determined at each tier.
![]() |
3 - IDEASComposed of raw, vague, and potentially large ideas that have yet to go through any formal valuation. |
2 - QUALIFIEDResearched and qualified PBIs awaiting refinement. |
|
1 - READYDiscrete, refined PBIs that are ready to be placed in your development teams’ sprint plans. |
CRM technology is critical to facilitate an organization’s relationships with customers, service users, employees, and suppliers. CRM implementation should not be a one-and-done exercise. There needs to be an ongoing optimization to enable business processes and optimal organizational results.
Get the Most Out of Your CRM allows organizations to proactively implement continuous assessment and optimization of a customer relationship management system. This includes:
This formal CRM optimization initiative will drive business-IT alignment, identify IT automation priorities, and dig deep into continuous process-improvement.
Contact your account representative for more information
workshops@infotech.com
1-866-670-8889

Ben Dickie
Research Practice Lead
Info-Tech Research Group
Ben Dickie is a Research Practice Lead at Info-Tech Research Group. His areas of expertise include customer experience management, CRM platforms, and digital marketing. He has also led projects pertaining to enterprise collaboration and unified communications.

Scott Bickley
Practice Lead & Principal Research Director
Info-Tech Research Group
Scott Bickley is a Practice Lead & Principal Research Director at Info-Tech Research Group focused on vendor management and contract review. He also has experience in the areas of IT asset management (ITAM), software asset management (SAM), and technology procurement, along with a deep background in operations, engineering, and quality systems management.

Andy Neil
Practice Lead, Applications
Info-Tech Research Group
Andy is Senior Research Director, Data Management and BI, at Info-Tech Research Group. He has over 15 years of experience in managing technical teams, information architecture, data modeling, and enterprise data strategy. He is an expert in enterprise data architecture, data integration, data standards, data strategy, big data, and the development of industry-standard data models.
Armel, Kate. “Data-driven Estimation, Management Lead to High Quality.” Quantitative Software Management Inc. 2015. Web.
Chappuis, Bertil, and Brian Selby. “Looking beyond Technology to Drive Sales Operations.” McKinsey & Company, 24 June 2016. Web.
Cross-Industry Process Classification Framework (PCF) Version 7.2.1. APQC, 26 Sept. 2019. Web.
Fleming, John, and Hater, James. “The Next Discipline: Applying Behavioral Economics to Drive Growth and Profitability.” Gallup, 22 Sept. 2012. Accessed 6 Oct. 2020.
Hinchcliffe, Dion. “The evolving role of the CIO and CMO in customer experience.” ZDNet, 22 Jan. 2020. Web.
Karlsson, Johan. “Backlog Grooming: Must-Know Tips for High-Value Products.” Perforce. 18 May 2018. Web. Feb. 2019.
Klie, L. “CRM Still Faces Challenges, Most Speakers Agree: CRM systems have been around for decades, but interoperability and data siloes still have to be overcome.” CRM Magazine, vol. 23, no. 5, 2019, pp. 13-14.
Kumar, Sanjib, et al. “Improvement of CRM Using Data Mining: A Case Study at Corporate Telecom Sector.” International Journal of Computer Applications, vol. 178, no. 53, 2019, pp. 12-20, doi:10.5120/ijca2019919413.
Morgan, Blake. “50 Stats That Prove The Value Of Customer Experience.” Forbes, 24 Sept. 2019. Web.
Norelus, Ernese, et al. “An Approach to Application Modernization: Discovery and Assessment Phase.” IBM Garage, Medium, 24 Feb 2020. Accessed 4 Mar. 2020.
“Process Frameworks.” APQC, 4 Nov. 2020. Web.
“Process vs. Capability: Understanding the Difference.” APCQ, 2017. Web.
Rubin, Kenneth S. "Essential Scrum: A Practical Guide to the Most Popular Agile Process." Pearson Education, 2012.
Savolainen, Juha, et al. “Transitioning from Product Line Requirements to Product Line Architecture.” 29th Annual International Computer Software and Applications Conference (COMPSAC'05), IEEE, vol. 1, 2005, pp. 186-195, doi: 10.1109/COMPSAC.2005.160
Smith, Anthony. “How To Create A Customer-Obsessed Company Like Netflix.” Forbes, 12 Dec. 2017. Web.
“SOA Reference Architecture – Capabilities and the SOA RA.” The Open Group, TOGAF. Web.
Taber, David. “What to Do When Your CRM Project Fails.” CIO Magazine, 18 Sept. 2017. Web.
“Taudata Case Study.” Maximizer CRM Software, 17 Jan. 2020. Web.
It used to be easy: pick your cloud, build out your IT footprint, and get back to business. But the explosion of cloud adoption has also led to an explosion of options for cloud providers, platforms, and deployment options. And that’s just when talking about infrastructure as a service!
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this research to understand the risks and benefits that come with a multicloud posture.
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
It used to be easy: pick your cloud, build out your IT footprint, and get back to business. But the explosion of cloud adoption has also led to an explosion of options for cloud providers, platforms, and deployment. And that’s just when talking about infrastructure as a service! For many businesses, one of the key benefits of the cloud ecosystem is enabling choice for different users, groups, and projects in the organization. But this means embracing multiple cloud platforms. Is it worth it? |
The reality is that multicloud is inevitable for most organizations, and if it’s not yet a reality for your IT team, it soon will be. This brings new challenges:
|
By defining your end goals, framing solutions based on the type of visibility and features your multicloud footprint needs to deliver, you can enable choice and improve performance, flexibility, and availability.
|
Info-Tech Insight
Embracing multicloud in your organization is an opportunity to gain control while enabling choice. Although it increases complexity for both IT operations and governance, with the right tools and principles in place you can reduce the IT burden and increase business agility at the same time.
|
Multicloud isn’t good or bad; it’s inevitable |
The reality is multicloud is usually not a choice. For most organizations, the requirement to integrate with partners, subsidiaries, and parent organizations, as well as the need to access key applications in the software-as-a-service ecosystem, means that going multicloud is a matter of when, not if. The real question most businesses should ask is not whether to go multicloud, but rather how to land in multicloud with intent and use it to their best advantage. |
|---|---|
|
Your workloads will guide the way |
One piece of good news is that multicloud doesn’t change the basic principles of a good cloud strategy. In fact, a well-laid-out multicloud approach can make it even easier to put the right workloads in the right place – and then even move them around as needed. This flexibility isn’t entirely free, though. It’s important to know how and when to apply this type of portability and balance its benefits against the cost and complexity that come with it. |
|
Don’t fall in reactively; land on your feet |
Despite the risks that come with the increased scale and complexity of multicloud, it is possible to maintain control, realize the benefits, and even use multicloud as a springboard for leveraging cloud benefits in your business. By adopting best practices and forethought in key areas of multicloud risk, you can hit the ground running. |
01 Hybrid Cloud
Private cloud and public cloud infrastructure managed as one entity
02 Multicloud
Includes multiple distinct public cloud services, or “footprints”
03 Hybrid IT
Putting the right workloads in the right places with an overall management framework
Info-Tech Insight
The SaaS ecosystem has led organizations to encourage business units to exercise the IT choices that are best for them.
Hybrid IT: Aggregate Management, Monitoring, Optimization, Continuous Improvement
The risks in multicloud are the same as in traditional cloud but amplified by the differences across footprints and providers in your ecosystem.
Info-Tech Insight
Don’t be afraid to ask for help! Each cloud platform you adopt in your multicloud posture requires training, knowledge, and execution. If you’re already leveraging an ecosystem of cloud providers, leverage the ecosystem of cloud enablers as needed to help you on your way.
|
Increasing flexibility & accelerating integration |
Because multicloud increases the number of platforms and environments available to us, we can Multicloud also can be a catalyst for integrating and stitching together resources and services that were previously isolated from each other. Because of the modular design and API architecture prevalent in cloud services, they can be easily consumed and integrated from your various footprints. |
|---|---|
|
Modernizing data strategy |
While it may seem counterintuitive, a proactive multicloud approach will allow you to regain visibility and control of your entire data ecosystem. Defining your data architecture and policies with an eye to the inevitability of multicloud means you can go beyond just regaining control of data stranded in SaaS and other platforms; you can start to really understand the flows of data and how they affect your business processes for better or worse. |
|
Move to cloud-native IT & design |
Embracing multicloud is also a great opportunity to embrace the refactoring and digital transformation you’ve been blocked on. Instead of treading water with respect to keeping control of fragmented applications, services, and workloads, a proactive approach to multicloud allows you to embrace open standards built to deliver cloud-native power and portability and to build automations that increase reliability, performance, and cost effectiveness while reducing your total in-house work burden. |
Info-Tech Insight
Don’t bite off more than you can chew! Especially with IaaS and PaaS services, it’s important to ensure you have the skills and bandwidth to manage and deploy services effectively. It’s better to start with one IaaS platform, master it, and then expand.
| The principles of cloud strategy don’t change with multicloud! |
|
| If anything, a multicloud approach increases your ability to put the right workloads in the right places, wherever that may be. | |
| It can also (with some work and tooling) provide even broader options for portability and resilience. |
Put everything in its right place.
Just like with any cloud strategy, start with a workload-level approach and figure out the right migration path and landing point for your workload in cloud.
Understand the other right places!
Multicloud means for many workloads, especially IaaS- and PaaS-focused ones, you will have multiple footprints you can use for secondary locations as desired for portability, resilience, and high availability (with the right tooling and design).
Info-Tech Insight
Portability is always a matter of balancing increased flexibility, availability, and resilience against increased complexity, maintenance effort, and cost. Make sure to understand the requirement for your workloads and apply portability efforts where they make the most sense
Don’t manage multicloud with off-the-rack tools.
The default dashboards and management tools from most cloud vendors are a great starting point when managing a single cloud. Unfortunately, most of these tools do not extend well to other platforms, which can lead to multiple dashboards for multiple footprints.
These ultimately lead to an inability to view your multicloud portfolio in aggregate and fragmentation of metrics and management practices across your various platforms. In such a situation maintaining compliance and control of IT can become difficult, if not impossible!
Unified standards and tools that work across your entire cloud portfolio will help keep you on track, and the best way to realize these is by applying repeatable, open standards across your various environments and usually adopting new software and tools from the ecosystem of multicloud management software platforms available in the market.
Info-Tech Insight
Even in multicloud, don’t forget that the raw data available from the vendor’s default dashboards is a critical source of information for optimizing performance, efficiency, and costs.
The ecosystem is heterogeneous.
The explosion of cloud platforms and stacks means no single multicloud management tool can provide support for every stack in the private and public cloud ecosystem. This challenge becomes even greater when moving from IaaS/PaaS to addressing the near-infinite number of offerings available in the SaaS market.
When it comes to selecting the right multicloud management tool, it’s important to keep a few things in mind:
Key Features
Info-Tech Insight
SaaS always presents a unique challenge for gathering necessary cloud management data. It’s important to understand what data is and isn’t available and how it can be accessed and made available to your multicloud management tools.
As a working example, you can review these vendors on the following slides:
Info-Tech Insight
Creating vendor profiles will help quickly identify the management tools that meet your multicloud needs.
VMware CloudHealth
Vendor Summary
CloudHealth is a VMware management suite that provides visibility into VMware-based as well as public cloud platforms. CloudHealth focuses on providing visibility to costs and governance as well as applying automation and standardization of configuration and performance across cloud platforms.
Supported Platforms
Supports AWS, Azure, GCP, OCI, VMware
Vendor Summary
ServiceNow IT Operations Management (ITOM) is a module for the ServiceNow platform that allows deep visibility and automated intervention/remediation for resources across multiple public and private cloud platforms. In addition to providing a platform for managing workload portability and costs across multiple cloud platforms, ServiceNow ITOM offers features focused on delivering “proactive digital operations with AIOps.”
URL: servicenow.com/products/it-operations-management.html
Supported Platforms
Supports CloudFormation, ARM, GDM, and Terraform templates. Also provisions virtualized VMware environments.
CloudCheckr
Vendor Summary
CloudCheckr is a SaaS platform that provides end-to-end cloud management to control cost, ensure security, optimize resources, and enable services. Primarily focused on enabling management of public cloud services, CloudCheckr’s broad platform support and APIs can be used to deliver unified visibility across many multicloud postures.
URL: cloudcheckr.com
Supported Platforms
Supports AWS, Azure, GCP, SAP Hana
Feature Sets
This activity involves the following participants:
Outcomes of this step:
Info-Tech Insight
This checkpoint process creates transparency around agreement costs with the business and gives the business an opportunity to reevaluate its requirements for a potentially leaner agreement.
|
SaaS While every service model and deployment model has its place in multicloud, depending on the requirements of the workload and the business, most organizations end up in multicloud because of the wide ecosystem of options available at the SaaS level. Enabling the ability to adopt SaaS offerings into your multicloud footprint should be an area of focus for most IT organizations, as it’s the easiest way to deliver business impact (without taking on additional infrastructure work). |
IaaS and PaaS Although IaaS and PaaS also have their place in multicloud, the benefits are usually focused more on increased portability and availability rather than on enabling business-led IT. Additionally, multicloud at these levels can often be complex and/or costly to implement and maintain. Make sure you understand the cost-benefit for implementing multicloud at this level! |
With multiple SaaS workloads as well as IaaS and PaaS footprints, one of the biggest challenges to effective multicloud is understanding where any given data is, what needs access to it, and how to stitch it all together.
In short, you need a strategy to understand how to collect and consolidate data from your multiple footprints.
Relying solely on the built-in tools and dashboards provided by each provider inevitably leads to data fragmentation – disparate data sets that make it difficult to gain clear, unified visibility into your cloud’s data.
To address the challenge of fragmented data, many organizations will require a multicloud-capable management platform that can provide access and visibility to data from all sources in a unified way.
When it comes to multicloud, cloud-native design is both your enemy and your friend. On one hand, it provides the ability to fully leverage the power and flexibility of your chosen platform to run your workload in the most on-demand, performance-efficient, utility-optimized way possible.
But it’s important to remember that building cloud-native for one platform directly conflicts with that workload’s portability to other platforms! You need to understand the balance between portability and native effectiveness that works best for each of your workloads.
Info-Tech Insight
You can (sort of) have the best of both worlds! While the decision to focus on the cloud-native products, services, and functions from a given cloud platform must be weighed carefully, it’s still a good idea to leverage open standards and architectures for your workloads, as those won’t hamper your portability in the same way.
Even on singular platforms, cloud cost management is no easy task. In multicloud, this is amplified by the increased scale and scope of providers, products, rates, and units of measure.
There is no easy solution to this – ultimately the same accountabilities and tasks that apply to good cost management on one cloud also apply to multicloud, just at greater scale and impact.
Info-Tech Insight
Evolving your tooling applies to cost management too. While the vendor-provided tools and dashboards for cost control on any given cloud provider’s platform are a good start and a critical source for data, to get a proper holistic view you will usually require multicloud cost management software (and possibly some development work).
A key theme in cloud service pricing is “it’s free to come in, but it costs to leave.” This is a critical consideration when designing the inflows and outflows of data, interactions, transactions, and resources among workloads sitting on different platforms and different regions or footprints.
When defining your multicloud posture, think about what needs to flow between your various clouds and make sure to understand how these flows will affect costs, performance, and throughput of your workloads and the business processes they support.
|
Automation Is Your Friend Managing multicloud is a lot of work. It makes sense to eliminate the most burdensome and error-prone tasks. Automating these tasks also increases the ease and speed of workload portability in most cases. Automation and scheduling are also key enablers of standardization – which is critical to managing costs and other risks in multicloud. Create policies that manage and optimize costs, resource utilization, and asset configuration. Use these to reduce the management burden and risk profile. |
Evolve Your Tooling Effective multicloud management requires a clear picture of your entire cloud ecosystem across all footprints. This generally isn’t possible using the default tools for any given cloud vendor. Fortunately, there is a wide ecosystem of multicloud tools to help provide you with a unified view. The best cloud management tools will not only allow you to get a unified view of your IT operations regardless of where the resources lie but also help you to evaluate your multiple cloud environments in a unified way, providing a level playing field to compare and identify opportunities for improvement. |
Info-Tech Insight
Embrace openness! Leveraging open standards and technologies doesn’t just ease portability in multicloud; it also helps rationalize telemetry and metrics across platforms, making it easier to achieve a unified management view.
Multicloud security challenges remain focused around managing user and role complexity
Info-Tech Insight
Don’t reinvent the wheel! Where possible, leverage your existing identity and access management platforms and role-based access control (RBAC) discipline and extend them out to your cloud footprints.
Define Your Cloud Vision
This blueprint covers a workload-level approach to determining cloud migration paths
10 Secrets for Successful Disaster Recovery in the Cloud
This research set covers general cloud best practices for implement DR and resilience in the cloud.
“7 Best Practices for Multi-Cloud Management.” vmware.com, 29 April 2022. Web.
Brown, Chalmers. “Six Best Practices For Multi-Cloud Management.” Forbes, 22 Jan. 2019. Web.
Curless, Tim. “The Risks of Multi-Cloud Outweigh the Benefits.” AHEAD, n.d. Web.
Tucker, Ryan. “Multicloud Security: Challenges and Solutions.” Megaport, 29 Sept 2022. Web.
Velimirovic, Andreja. “How to Implement a Multi Cloud Strategy.” pheonixNAP, 23 June 2021. Web.
“What is a Multi-Cloud Strategy?” vmware.com, n.d. Web.
Organizations are joining the wave and adopting machine learning and artificial intelligence (AI) to unlock the value in their data and power their competitive advantage. But to succeed with these complex analytics programs, they need to begin by looking at their data – empowering their people to realize and embrace the valuable insights within the organization’s data.
The key to achieve becoming a data-driven organization is to foster a strong data culture and equip employees with data skills through an organization-wide data literacy program.
Data literacy is critical to the success of digital transformation and AI analytics. Info-Tech’s approach to creating a sustainable and effective data literacy program is recognizing it is:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Data literacy as part of the data governance strategic program should be launched to all levels of employees that will help your organization bridge the data knowledge gap at all levels of the organization. This research recommends approaches to different learning styles to address data skill needs and helps members create a practical and sustainable data literacy program.
Kick off a data awareness program that explains the fundamental understanding of data and its lifecycle. Explore ways to create or mature the data literacy program with smaller amounts of information on a more frequent basis.
“Digital transformation” and “data driven” are two terms that are inseparable. With organizations accelerating in their digital transformation roadmap implementation, organizations need to invest in developing data skills with their people. Talent is scarce and the demand for data skills is huge, with 70% of employees expected to work heavily with data by 2025. There is no time like the present to launch an organization-wide data literacy program to bridge the data knowledge gap and foster a data-driven culture.
Data literacy training is as important as your cybersecurity training. It impacts all levels of the organization. Data literacy is critical to success with digital transformation and AI analytics.
Principal Advisory Director, Data & Analytics Practice
Info-Tech Research Group
Your ChallengeOrganizations are joining the wave and adopting machine learning (ML) and artificial intelligence (AI) to unlock the value in their data and power their competitive advantage. But to succeed with these complex analytics programs, they need to begin by empowering their people to realize and embrace the valuable insights within the organization’s data. The key to becoming a data-driven organization is to foster a strong data culture and equip people with data skills through an organization-wide data literacy program. |
Common ObstaclesChallenges the data leadership is likely to face as digital transformation initiatives drive intensified competition:
|
Info-Tech's ApproachWe interviewed data leaders and instructors to gather insights about investing in data:
|
By thoughtfully designing a data literacy training program for the audience's own experience, maturity level, and learning style, organizations build the data-driven and engaged culture that helps them to unlock their data's full potential and outperform other organizations.
“Data literacy is the ability to read, work with, analyze, and communicate with data. It's a skill that empowers all levels of workers to ask the right questions of data and machines, build knowledge, make decisions, and communicate meaning to others.” – Qlik, n.d.
Source: Accenture, 2020.
Source: Qlik, 2022.
“[Data debt is] when you have undocumented, unused, incomplete, and inconsistent data,” according to Secoda (2023). “When … data debt is not solved, data teams could risk wasting time managing reports no one uses and producing data that no one understands.”
Signs of data debt when considering investing in data literacy:
of organizations say a backlog of data debt is impacting new data management initiatives.
of organizations say individuals within the business do not trust data insights.
of organizations are unable to become data-driven.
Source: Experian, 2020
Image source: Welocalize, 2020.
Data represents a discrete fact or event without relation to other things (e.g. it is raining). Data is unorganized and not useful on its own.
Information organizes and structures data so that it is meaningful and valuable for a specific purpose (i.e. it answers questions). Information is a refined form of data.
When information is combined with experience and intuition, it results in knowledge. It is our personal map/model of the world.
Knowledge set with context generates insight. We become knowledgeable as a result of reading, researching, and memorizing (i.e. accumulating information).
Wisdom means the ability to make sound judgments. Wisdom synthesizes knowledge and experiences into insights.
Data-driven culture refers to a workplace where decisions are made based on data evidence, not on gut instinct.
Phase Steps |
1. Define Data Literacy Objectives1.1 Understand organization’s needs 1.2 Create vision and objective for data literacy program |
2. Assess Learning Style and Align to Program Design2.1 Create persona and identify audience 2.2 Assess learning style and align to program design 2.3 Determine the right delivery method |
3. Socialize Roadmap and Milestones3.1 Establish a roadmap 3.2 Set key performance metrics and milestones |
Phase Outcomes |
Identify key objectives to establish and grow the data literacy program by articulating the problem and solutions proposed. |
Assess each audience’s learning style and adapt the program to their unique needs. |
Show a roadmap with key performance indicators to track each milestone and tell a data story. |
– Miro Kazakoff, senior lecturer, MIT Sloan, in MIT Sloan School of Management, 2021
By thoughtfully designing a data literacy training program personalized to each audience's maturity level, learning style, and experience, organizations can develop and grow a data-driven culture that unlocks the data's full potential for competitive differentiation.
We can learn a lot from each other. Literacy works both ways – business data stewards learn to “speak data” while IT data custodians understand the business context and value. Everyone should strive to exchange knowledge.
Avoid traditional classroom teaching – create a data literacy program that is learner-centric to allow participants to learn and experiment with data.
Aligning program design to those learning styles will make participants more likely to be receptive to learning a new skill.
A data literacy program isn’t just about data but rather encompasses aspects of business, IT, and data. With executive support and partnership with business, running a data literacy program means that it won’t end up being just another technical training. The program needs to address why, what, how questions.
A lot of programs don’t include the fundamentals. To get data concepts to stick, focus on socializing the data/information/knowledge/wisdom foundation.
Many programs speak in abstract terms. We present case studies and tangible use cases to personalize training to the audience’s world and showcase opportunities enabled through data.
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of the project."
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
Session 1 | Session 2 | Session 3 | Session 4 | |
Activities | Define Data Literacy Objectives1.1 Review Data Culture Diagnostic results 1.2 Identify business context: business goals, initiatives 1.3 Create vision and objective for data literacy program | Assess Learning Style and Align to Program Design2.1 Identify audience 2.2 Assess learning style and align to program design 2.3 Determine the right delivery method | Build a Data Literacy Roadmap and Milestones3.1 Identify program initiatives and topics 3.2 Determine delivery methods 3.3 Build the data literacy roadmap | Operational Strategy to implement Data Literacy4.1 Identify key performance metrics 4.2 Identify owners and document RACI matrix 4.3 Discuss next steps and wrap up. |
Deliverables |
|
|
|
|
Foster Data-Driven Culture With Data Literacy
Input
|
Output
|
Materials
|
Participants
|
Contact your Info-Tech Account Representative for details on launching a Data Culture Diagnostic.
Input
| Output
|
Materials
| Participants
|
Data collected through Info-Tech’s Data Culture Diagnostic suggests three ways to improve data literacy:
think more can be done to define and document commonly used terms with methods such as a business data glossary.
think they can have a better understanding of the meaning of all data elements that are being captured or managed.
feel that they can have more training in terms of tools as well as on what data is available at the organization.
Source: Info-Tech Research Group's Data Culture Diagnostic, 2022; N=2,652
Start with real business problems in a hands-on format to demonstrate the value of data.
Treat data as a strategic asset to gain insight into our customers for all levels of organization.
"According to Forrester, 91% of organizations find it challenging to improve the use of data insights for decision-making – even though 90% see it as a priority. Why the disconnect? A lack of data literacy."
– Alation, 2020
Info-Tech provides various topics suited for a data literacy program that can accommodate different data skill requirements and encompasses relevant aspects of business, IT, and data.
Use discovery and diagnostics to understand users’ comfort level and maturity with data.
Foster Data-Driven Culture With Data Literacy
feel that training was too long to remember or to apply in their day-to-day work.
find training had insufficient follow-up to help them apply on the job.
Source: Grovo, 2018.
Input
| Output
|
Materials
| Participants
|
IT and data professionals need to understand the business as much as business needs to talk about data. Bidirectional learning and feedback improves the synergy between business and IT.
Choose a data role (e.g. data steward, data owner, data scientist).
Describe the persona based on goals, priorities, tenures, preferred learning style, type of work with data.
Identify data skill and level of skills required.
Tailor your data literacy program to meet your organization’s needs, filling your range of knowledge gaps and catering to different levels of users.
When it comes to rolling out a data literacy program, there is no one-size-fits-all solution. Your data literacy program is intended to spread knowledge throughout your organization. It should target everyone from executive leadership to management to subject matter experts across all functions of the business.
The imaginative learner group likes to engage in feelings and spend time on reflection. This type of learner desires personal meaning and involvement. They focus on personal values for themselves and others and make connections quickly.
For this group of learners, their question is: why should I learn this?
The analytical learner group likes to listen, to think about information, and to come up with ideas. They are interested in acquiring facts and delving into concepts and processes. They can learn effectively and enjoy doing independent research.
For this group of learners, their question is: what should I learn?
The common sense learner group likes thinking and doing. They are satisfied when they can carry out experiments, build and design, and create usability. They like tinkering and applying useful ideas.
For this group of learners, their question is: how should I learn?
The dynamic learner group learns through doing and experiencing. They are continually looking for hidden possibilities and researching ideas to make original adjustments. They learn through trial and error and self-discovery.
For this group of learners, their question is: what if I learn this?
There are four common ways to learn a new skill: by watching, conceptualizing, doing, and experiencing. The following are some suggestions on ways to implement your data literacy program through different delivery methods.
Foster Data-Driven Culture With Data Literacy
For the Gantt chart:
Input
| Output
|
Materials
| Participants
|
Name |
Position |
| Andrea Malick | Advisory Director, Info-Tech Research Group |
| Andy Neill | AVP, Data and Analytics, Chief Enterprise Architect, Info-Tech Research Group |
| Crystal Singh | Research Director, Info-Tech Research Group |
| Imad Jawadi | Senior Manager, Consulting Advisory, Info-Tech Research Group |
| Irina Sedenko | Research Director, Info-Tech Research Group |
| Reddy Doddipalli | Senior Workshop Director, Info-Tech Research Group |
| Sherwick Min | Technical Counselor, Info-Tech Research Group |
| Wayne Cain | Principal Advisory Director, Info-Tech Research Group |
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
Session 1 |
Session 2 |
Session 3 |
Session 4 |
|
Activities |
Understand the WHY and Value of Data1.1 Business context, business objectives, and goals 1.2 You and data 1.3 Data journey from data to insights 1.4 Speak data – common terminology |
Learn about the WHAT Through Data Flow2.1 Data creation 2.2 Data ingestion 2.3 Data accumulation 2.4 Data augmentation 2.5 Data delivery 2.6 Data consumption |
Explore the HOW Through Data Visualization Training3.1 Ask the right questions 3.2 Find the top five data elements 3.3 Understand your data 3.4 Present your data story 3.5 Sharing of lessons learned |
Put Them All Together Through Data Governance Awareness4.1 Data governance framework 4.2 Data roles and responsibilities 4.3 Data domain and owners |
Deliverables |
|
|
|
|
Deliver measurable business value.
Key to building and fostering a data-driven culture.
Streamline your data management program with our simplified framework.
About Learning. “4MAT overview.” About Learning., 16 Aug. 2001. Web.
Accenture. “The Human Impact of Data Literacy,” Accenture, 2020. Web.
Anand, Shivani. “IDC Reveals India Data and Content Technologies Predictions for 2022 and onwards; Focus on Data Literacy for an Elevated data Culture.” IDC, 14 Mar. 2022. Web.
Belissent, Jennifer, and Aaron Kalb. “Data Literacy: The Key to Data-Driven Decision Making.” Alation, April 2020. Web.
Brown, Sara. “How to build data literacy in your company.” MIT Sloan School of Management, 9 Feb 2021. Web.
---. “How to build a data-driven company.” MIT Sloan School of Management, 24 Sept. 2020. Web.
Domo. “Data Never Sleeps 9.0.” Domo, 2021. Web.
Dykes, Brent. “Creating A Data-Driven Culture: Why Leading By Example Is Essential.” Forbes, 26 Oct. 2017. Web.
Experian. “10 signs you are sitting on a pile of data debt.” Experian, 2020. Accessed 25 June 2021. Web.
Experian. “2019 Global Data Management Research.” Experian, 2019. Web.
Knight, Michelle. “Data Literacy Trends in 2023: Formalizing Programs.” Dataversity, 3 Jan. 2023. Web.
Ghosh, Paramita. “Data Literacy Skills Every Organization Should Build.” Dataversity, 2 Nov. 2022. Web.
Johnson, A., et al., “How to Build a Strategy in a Digital World,” Compact, 2018, vol. 2. Web.
LifeTrain. “Learning Style Quiz.” EMTrain, Web.
Lambers, E., et al. “How to become data literate and support a data-drive culture.” Compact, 2018, vol. 4. Web.
Marr, Benard. “Why is data literacy important for any business?” Bernard Marr & Co., 16 Aug. 2022. Web.
Marr, Benard. “8 simple ways to enhance your data literacy skills.” Bernard Marr & Co., 16 Aug. 2022. Web/
Mendoza, N.F. “Data literacy: Time to cure data phobia” Tech Republic, 27 Sept. 2022. Web.
Mizrahi, Etai. “How to stay ahead of data debt and downtime?” Secoda, 17 April 2023. Web.
Needham, Mass., “IDC FutureScape: Top 10 Predictions for the Future of Intelligence.” IDC, 5 Dec. 2022. Web.
Paton, J., and M.A.P. op het Veld. “Trusted Analytics.” Compact, 2017, vol. 2. Web.
Qlik. “Data Literacy to be Most In-Demand Skill by 2030 as AI Transforms Global Workplaces.” Qlik., 16 Mar 2022. Web.
Qlik. “What is data literacy?” Qlik, n.d. Web.
Reed, David. Becoming Data Literate. Harriman House Publishing, 1 Sept. 2021. Print.
Salomonsen, Summer. “Grovo’s First-Time Manager Microlearning® Program Will Help Your New Managers Thrive in 2018.” Grovos Blog, 5 Dec. 2018. Web.
Webb, Ryan. “More Than Just Reporting: Uncovering Actionable Insights From Data.” Welocalize, 1 Sept. 2020. Web.
Jammer! U bent te laat.
De VOKA Bedrijven Contact Dagen 2025 zijn voorbij en onze winnaars zijn bekend!
Liguris: 80 points
Keiretsu: 71 points
Staffler: 69 points
Xpo group: 67 points
Actief: 66 points
During peak business hours, I witnessed a straightforward database field addition bring down a whole e-commerce platform. It was meant to be standard procedure, the type of “standard change” that is automatically approved because we have performed it innumerable times.
Adding a field to the end of a table and having applications retrieve data by field name instead of position made the change itself textbook low-impact. There is no need to alter the application or the functional flow. This could have been problematic in the past if you added a field in the middle of the list and it affected the values of other fields, but adding it at the end? That ought to have been impenetrable.
However, it wasn't.
Before I tell you what went wrong, let me explain why this is important to all of the IT professionals who are reading this.
Over the past three decades, industry data has repeatedly supported what this incident taught me: our presumptions about “safe” changes are frequently our greatest weakness. Upon reviewing the ITIL research, I was not surprised to learn that failed changes, many of which were categorized as “standard” or “low-risk,” are responsible for about 80% of unplanned outages.
When you look more closely, the numbers become even more concerning. Since I've been following the Ponemon Institute's work for years, I wasn't surprised to learn that companies with well-established change management procedures have 65% fewer unscheduled outages. The paradox surprised me: many of these “mature” procedures still operate under the premise that safety correlates with repetition.
What I had been observing in the field for decades was confirmed when Gartner released their research showing that standard changes are responsible for almost 40% of change-related incidents. The very changes we consider safe enough to avoid thorough review subtly create some of our greatest risks. IBM's analysis supports the pattern I've seen in innumerable organizations: standard changes cause three times as much business disruption due to their volume and our decreased vigilance around them, whereas emergency changes receive all the attention and scrutiny.
Aberdeen Group data indicates that the average cost of an unplanned outage has increased to $300,000 per hour, with change-related failures accounting for the largest category of preventable incidents. This data makes the financial reality stark.
What precisely went wrong with the addition of that database field that caused our e-commerce platform to crash?
We were unaware that the addition of this one field would cause the database to surpass an internal threshold, necessitating a thorough examination of its execution strategy. In its algorithmic wisdom, the database engine determined that the table structure had changed enough to necessitate rebuilding its access and retrieval mechanisms. Our applications relied on high-speed requests, and the new execution plan was terribly unoptimized for them.
Instead of completing quotes or purchases, customers were spending minutes viewing error pages. All applications began to time out while they awaited data that just wasn't showing up in the anticipated amounts of time. Thousands of transactions were impacted by a single extra field that should have been invisible to the application layer.
The field addition itself was not the primary cause. We assumed that since we had made similar adjustments dozens of times previously, this one would also act in the same way. Without taking into account the hidden complexities of database optimization thresholds, we had categorized it as a standard change based on superficial similarities.
My approach to standard changes was completely altered by this experience, and it is now even more applicable in DevOps-driven environments. Many organizations use pipeline deployments, which produce a standard change at runtime. It's great for speed and reliability, but it can easily fall into the same trap.
However, I have witnessed pipeline deployments result in significant incidents for non-code-related reasons. Due to timing, resource contention, or environmental differences that weren't noticeable in earlier runs, a deployment that performed flawlessly in development and staging abruptly fails in production. Although the automation boosts our confidence, it may also reveal blind spots.
Over the course of thirty years, I have come to the unsettling realization that there is no such thing as a truly routine change in complex systems. Every modification takes place in a slightly different setting, with varying environmental factors, data states, and system loads. What we refer to as “standard changes” are actually merely modifications with comparable processes rather than risk profiles.
For this reason, I support contextual change management. We must consider the system state, timing, dependencies, and cumulative effect of recent changes rather than just categorizing them based on their technical features. After three other changes have changed the system's behavior patterns, a change made at two in the morning on a Sunday with little system load is actually different from the same change made during peak business hours.
Effective change advisory boards must therefore go beyond assessing individual changes separately. I've worked with organizations where the change board carefully considered and approved each modification on its own merits, only to find that the cumulative effect of seemingly unrelated changes led to unexpected interactions and stress on the system. The most developed change management procedures I've come across mandate that their advisory boards take a step back and look at the whole change portfolio over a specified period of time. They inquire whether we are altering the database too frequently during a single maintenance window. Could there be unanticipated interactions between these three different application updates? What is the total resource impact of this week's approved changes?
It's the distinction between forest management and tree management. While each change may seem logical individually, when combined, they can create situations beyond the scope of any single change assessment.
Having worked in this field for thirty years, I've come to the conclusion that our greatest confidences frequently conceal our greatest vulnerabilities. Our primary blind spots frequently arise from the changes we've made a hundred times before, the procedures we've automated and standardized, and the adjustments we've labeled as “routine.”
Whether we should slow down our deployment pipelines or stop using standard changes is not the question. In the current competitive environment, speed and efficiency are crucial. The issue is whether we are posing the appropriate queries before carrying them out. Are we taking into account not only what the change accomplishes but also when it occurs, what else is changing at the same time, and how our systems actually look right now?
I've discovered that the phrase “we've done this before” is more dangerous in IT operations than “what could go wrong?” Because, despite what we may believe, we never actually perform the same action twice in complex systems.
Here is what I would like you to think about: which everyday modifications are subtly putting your surroundings at risk? Which procedures have you standardized or automated to the extent that you no longer challenge their presumptions? Most importantly, when was the last time your change advisory board examined your changes as a cohesive portfolio of system modifications rather than as discrete items on a checklist?
Remember that simple addition to a database field the next time you're tempted to accept a standard change. The most unexpected outcomes can occasionally result from the most routine adjustments.
I'm always up for a conversation if you want to talk about your difficulties with change management.
Security presentations are not a one-way street. The key to a successful executive security presentation is having a goal for the presentation and ensuring that you have met your goal.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this as a guideline to assist you in presenting security to executive stakeholders.
The security presentation templates are a set of customizable templates for various types of security presentation including:
![]() |
As a security leader, you’re tasked with various responsibilities to ensure your organization can achieve its goals while its most important assets are being protected. However, when communicating security to executive stakeholders, challenges can arise in determining what topics are pertinent to present. Changes in the security threat landscape coupled with different business goals make identifying how to present security more challenging. Having a communication framework for presenting security to executive stakeholders will enable you to effectively identify, develop, and deliver your communication goals while obtaining the support you need to achieve your objectives. Ahmad Jowhar Info-Tech Research Group |
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
|
|
Info-Tech Insight
Security presentations are not a one-way street. The key to a successful executive security presentation is having a goal for the presentation and verifying that you have met your goal.
76% of security leaders struggle in conveying the effectiveness of a cybersecurity program.
62% find it difficult to balance the risk of too much detail and need-to-know information.
41% find it challenging to communicate effectively with a mixed technical and non-technical audience.
9% of boards are extremely confident in their organization’s cybersecurity risk mitigation measures.
77% of organizations have seen an increase in the number of attacks in 2021.
56% of security leaders claimed their team is not involved when leadership makes urgent security decisions.
1. Identify communication goals |
2. Collect information to support goals |
3. Develop communication |
4. Deliver communication |
|
|---|---|---|---|---|
Phase steps |
|
|
|
|
Phase outcomes |
A defined list of drivers and goals to help you develop your security presentations |
A list of data sources to include in your communication |
A completed communication template |
A solidified understanding of how to effectively communicate security to your stakeholders |
Security presentations are not a one-way street
The key to a successful executive security presentation is having a goal for the presentation and verifying that you have met your goal.
Identifying your goals is the foundation of an effective presentation
Defining your drivers and goals for communicating security will enable you to better prepare and deliver your presentation, which will help you obtain your desired outcome.
Harness the power of data
Leveraging data and analytics will help you provide quantitative-based communication, which will result in a more meaningful and effective presentation.
Take your audience on a journey
Developing a storytelling approach will help engage with your audience.
Win your audience by building a rapport
Establishing credibility and trust with executive stakeholders will enable you to obtain their support for security objectives.
Tactical insight
Conduct background research on audience members (i.e. professional background) to help understand how best to communicate with them and overcome potential objections.
Tactical insight
Verifying your objectives at the end of the communication is important, as it ensures you have successfully communicated to executive stakeholders.
Report on Security Initiatives |
![]() |
Security Metrics |
![]() |
Security Incident Response & Recovery |
![]() |
Security Funding Request |
![]() |

Template showing how to inform executive stakeholders of proactive security and risk initiatives.
IT/InfoSec benefits |
Business benefits |
|---|---|
|
|
Phase |
Measured Value (Yearly) |
|---|---|
Phase 1: Identify communication goals |
Cost to define drivers and goals for communicating security to executives: 16 FTE hours @ $233K* =$1,940 |
Phase 2: Collect information to support goals |
Cost to collect and synthesize necessary data to support communication goals: 16 FTE hours @ $233K = $1,940 |
Phase 3: Develop communication |
Cost to develop communication material that will contextualize information being shown: 16 FTE hours @ $233K = $1,940 |
Phase 4: Deliver communication |
|
Potential Savings: |
Total estimated effort = $5,820 Our blueprint will help you save $5,820 and over 40 FTE hours |
* The financial figure depicts the annual salary of a CISO in 2022
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Identify drivers for communicating to executives 1.2 Define your goals for communicating to executives |
2.1 Identify data to collect 2.2 Plan how to retrieve data |
3.1 Plan communication 3.2 Build a compelling communication document |
4.1 Deliver a captivating presentation 4.2 Obtain/verify support for security goals |
This phase will walk you through the following activities:
This phase involves the following participants:
As a security leader, you meet with executives and stakeholders with diverse backgrounds, and you aim to showcase your organization’s security posture along with its alignment with the business’ goals.
However, with the constant changes in the security threat landscape, demands and drivers for security could change. Thus, understanding potential drivers that will influence your communication will assist you in developing and delivering an effective security presentation.
39% of organizations had cybersecurity on the agenda of their board’s quarterly meeting.
Info-Tech Insight
Not all security presentations are the same. Keep your communication strategy and processes agile.
By understanding the influences for your security presentations, you will be able to better plan what to present to executive stakeholders.
Understanding drivers will also help you understand how to present security to executive stakeholders.
Identify your communication drivers, which can stem from various initiatives and programs, including:
When it comes to identifying your communication drivers, you can collaborate with subject matter experts, like your corporate secretary or steering committees, to ensure the material being communicated will align with some of the organizational goals.
Audit
Upcoming internal or external audits might require updates on the organization’s compliance
Organizational restructuring
Restructuring within an organization could require security updates
Merger & Acquisition
An M&A would trigger presentations on organization’s current and future security posture
Cyber incident
A cyberattack would require an immediate presentation on its impact and the incident response plan
Ad hoc
Provide security information requested by stakeholders
After identifying drivers for your communication, it’s important to determine what your goals are for the presentation.
Identifying your communication goals could require the participation of the security team, IT leadership, and other business stakeholders.
Info-Tech Insight
There can be different reasons to communicate security to executive stakeholders. You need to understand what you want to get out of your presentation.
Educate
Educate the board on security trends and/or latest risks in the industry
Update
Provide updates on security initiatives, relevant security metrics, and compliance posture
Inform
Provide an incident response plan due to a security incident or deliver updates on current threats and risks
Investment
Request funding for security investments or financial updates on past security initiatives
Ad hoc
Provide security information requested by stakeholders
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Identify drivers for communicating to executives 1.2 Define your goals for communicating to executives | 2.1 Identify data to collect 2.2 Plan how to retrieve data | 3.1 Plan communication 3.2 Build a compelling communication document | 4.1 Deliver a captivating presentation 4.2 Obtain/verify support for security goals |
This phase will walk you through the following activities:
This phase involves the following participants:
After identifying drivers and goals for your communication, it’s important to include the necessary data to justify the information being communicated.
Identifying data to collect doesn’t need to be a rigorous task; you can follow these steps to help you get started:
Info-Tech Insight
Understand how to present your information in a way that will be meaningful to your audience, for instance by quantifying security risks in financial terms.
Educate
Number of organizations in industry impacted by data breaches during past year; top threats and risks affecting the industries
Update
Degree of compliance with standards (e.g. ISO-27001); metrics on improvement of security posture due to security initiatives
Inform
Percentage of impacted clients and disrupted business functions; downtime; security risk likelihood and financial impact
Investment
Capital and operating expenditure for investment; ROI on past and future security initiatives
Ad hoc
Number of security initiatives that went over budget; phishing test campaign results
Once the data that is going to be used for the presentation has been identified, it is important to plan how the data can be retrieved, processed, and shared.
Once the data source and owner has been identified, you need to plan how the data would be processed and leveraged for your presentation
Info-Tech Insight
Using a data-driven approach to help support your objectives is key to engaging with your audience.
Identifying the relevant data sources to retrieve your data and the appropriate data owner enables efficient collaboration between departments collecting, processing, and communicating the data and graphics to the audience.
Examples of where to retrieve your data
Data Source |
Data |
Data Owner |
Communication Goal |
|---|---|---|---|
Audit & Compliance Reports |
Percentage of controls completed to be certified with ISO 27001; Number of security threats & risks identified. |
Audit Manager; Compliance Manager; Security Leader |
Ad hoc, Educate, Inform |
Identity & Access Management (IAM) Applications |
Number of privileged accounts/department; Percentage of user accounts with MFA applied |
Network/Security Analyst |
Ad hoc, Inform, Update |
Security Information & Event Management (SIEM) |
Number of attacks detected and blocked before & after implementing endpoint security; Percentage of firewall rules that triggered a false positive |
Network/Security Analyst |
Ad hoc, Inform, Update |
Vulnerability Management Applications |
Percentage of critical vulnerabilities patched; Number of endpoints encrypted |
Network/Security Analyst |
Ad hoc, Inform, Update |
Financial & Accounting Software |
Capital & operating expenditure for future security investments; Return on investment (ROI) on past and current security investments |
Financial and/or Accounting Manager |
Ad hoc, Educate, Investments |
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Identify drivers for communicating to executives 1.2 Define your goals for communicating to executives | 2.1 Identify data to collect 2.2 Plan how to retrieve data | 3.1 Plan communication 3.2 Build a compelling communication document | 4.1 Deliver a captivating presentation 4.2 Obtain/verify support for security goals |
This phase will walk you through the following activities:
This phase involves the following participants:
Examples of two profiles in a boardroom
Formal board of directors |
The executive team |
|---|---|
|
|
A board’s purpose can include the following:
Examples of potential values and risks
Info-Tech Insight
Conduct background research on audience members (e.g. professional background on LinkedIn) to help understand how best to communicate to them and overcome potential objections.
Examples of potential concerns for each profile of executive stakeholders
Formal board of directors | The executive team |
|---|---|
|
|
Your presentation should be well-rounded and compelling when it addresses the board’s main concerns about security.
Checklist:
Info-Tech Insight
The executive stakeholder’s main concerns will always boil down to one important outcome: providing a level of confidence to do business through IT products, services, and systems – including security.
Info-Tech Insight
Developing a storytelling approach will help keep your audience engaged and allow the information to resonate with them, which will add further value to the communication.
You should be clear about your bottom line and the intent behind your presentation. However, regardless of your bottom line, your presentation must focus on what business problems you are solving and why security can assist in solving the problem.
Examples of communication goals
To inform or educate |
To reach a decision |
|---|---|
|
|
Info-Tech Insight
Nobody likes surprises. Communicate early and often. The board should be pre-briefed, especially if it is a difficult subject. This also ensures you have support when you deliver a difficult message.
Once you understand your target audience, it’s important to tailor your presentation material to what they will care about.
Typical IT boardroom presentations include:
Info-Tech Insight
You must always have a clear goal or objective for delivering a presentation in front of your board of directors. What is the purpose of your board presentation? Identify your objective and outcome up front and tailor your presentation’s story and contents to fit this purpose.
Info-Tech Insight
Telling a good story is not about the message you want to deliver but the one the executive stakeholders want to hear. Articulate what you want them to think and what you want them to take away, and be explicit about it in your presentation. Make your story logically flow by identifying the business problem, complication, the solution, and how to close the gap. Most importantly, communicate the business impacts the board will care about.
To build a strong story for your presentation, ensure you answer these three questions:
WHY |
Why is this a business issue, or why should the executive stakeholders care? |
|---|---|
WHAT |
What is the impact of solving the problem and driving value for the company? |
HOW |
How will we leverage our resources (technology, finances) to solve the problem? |
Scenario 1: The company has experienced a security incident.
Intent: To inform/educate the board about the security incident.
WHY | The data breach has resulted in a loss of customer confidence, negative brand impact, and a reduction in revenue of 30%. |
|---|---|
WHAT | Financial, legal, and reputational risks identified, and mitigation strategies implemented. IT is working with the PR team on communications. Incident management playbook executed. |
HOW | An analysis of vulnerabilities was conducted and steps to address are in effect. Recovery steps are 90% completed. Incident management program reviewed for future incidents. |
Scenario 2: Security is recommending investments based on strategic priorities.
Intent: To reach a decision with the board – approve investment proposal.
WHY | The new security strategy outlines two key initiatives to improve an organization’s security culture and overall risk posture. |
|---|---|
WHAT | Security proposed an investment to implement a security training & phishing test campaign, which will assist in reducing data breach risks. |
HOW | Use 5% of security’s budget to implement security training and phishing test campaigns. |
What you include in your story will often depend on how much time you have available to deliver the message.
Consider the following:
Use the Q&A portion to build credibility with the board.
Info-Tech Insight
The average board presentation is 15 minutes long. Build no more than three or four slides of content to identify the business problem, the business impacts, and the solution. Leave five minutes for questions at the end, and be prepared with back-up slides to support your answers.
Checklist:
Once you’ve identified your communication goals, data, and plan to present to your stakeholders, it’s important to build the compelling communication document that will attract all audiences.
A good slide design increases the likelihood that the audience will read the content carefully.
Leverage these slide design best practices to assist you in developing eye-catching presentations.
Horizontal logic |
Vertical logic |
|---|---|
|
|
![]() |
![]() |
The audience is unsure where to look and in what order. |
The audience knows to read the heading first. Then look within the pie chart. Then look within the white boxes to the right. |
Horizontal logic | Vertical logic |
|---|---|
|
|
![]() |
![]() |
|
Increase skim-ability:
Make it easier on the eyes:
|
Passive voice |
Active voice |
|---|---|
“There are three things to look out for” (8 words) “Network security was compromised by hackers” (6 words) |
“Look for these three things” (5 words) “Hackers compromised network security” (4 words) |
![]() |
![]() |
Easy to read, but hard to remember the stats. |
The visuals make it easier to see the size of the problem and make it much more memorable. Remember to:
|
![]() |
![]() |
This draft slide is just content from the outline document on a slide with no design applied yet. |
|
Cognitively
Emotionally
Visual clues
Persuasion
Often stakeholders prefer to receive content in a specific format. Make sure you know what you require so that you are not scrambling at the last minute.
Leverage this checklist to ensure you are creating the perfect visuals and graphs for your presentation.
Checklist:
Once you have identified your communication goals and plans for building your communication document, you can start building your presentation deck. These presentation templates highlight different security topics depending on your communication drivers, goals, and available data. Info-Tech has created five security templates to assist you in building a compelling presentation. These templates provide support for presentations on the following five topics:
Each template provides instructions on how to use it and tips on ensuring the right information is being presented. All the templates are customizable, which enables you to leverage the sections you need while also editing any sections to your liking. |
![]() |
Download the Security Presentation Templates
It’s important to know that not all security presentations for an organization are alike. However, these templates would provide a guideline on what the best practices are when communicating security to executive stakeholders.
Below is an example of instructions to complete the “Security Risk & Update” template. Please note that the security template will have instructions to complete each of its sections.
![]() |
![]() |
The first slide following the title slide includes a brief executive summary on what would be discussed in the presentation. This includes the main security threats that would be addressed and the associated risk mitigation strategies. |
This slide depicts a holistic overview of the organization’s security posture in different areas along with the main business goals that security is aligning with. Ensure visualizations you include align with the goals highlighted. |
![]() |
![]() |
This slide displays any top threats and risks an organization is facing. Each threat consists of 2-3 risks and is prioritized based on the negative impact it could have on the organization (i.e. red bar = high priority; green bar = low priority). Include risks that have been addressed in the past quarter, and showcase any prioritization changes to those risks. |
This slide follows the “Top Threats & Risks” slide and focuses on the risks that had medium or high priority. You will need to work with subject matter experts to identify risk figures (likelihood, financial impact) that will enable you to quantify the risks (Likelihood x Financial Impact). Develop a threshold for each of the three columns to identify which risks require further prioritization, and apply color coding to group the risks. |
![]() |
![]() |
This slide showcases further details on the top risks along with their business impact. Be sure to include recommendations for the risks and indicate whether further action is required from the executive stakeholders. |
The last slide of the “Security Risk & Update” template presents a timeline of when the different initiatives to mitigate security risks would begin. It depicts what initiatives will be completed within each fiscal year and the total number of months required. As there could be many factors to a project’s timeline, ensure you communicate to your executive stakeholders any changes to the project. |
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
1.1 Identify drivers for communicating to executives 1.2 Define your goals for communicating to executives | 2.1 Identify data to collect 2.2 Plan how to retrieve data | 3.1 Plan communication 3.2 Build a compelling communication document | 4.1 Deliver a captivating presentation 4.2 Obtain/verify support for security goals |
This phase will walk you through the following activities:
This phase involves the following participants:
You’ve gathered all your data, you understand what your audience is expecting, and you are clear on the outcomes you require. Now, it’s time to deliver a presentation that both engages and builds confidence.
Follow these tips to assist you in developing an engaging presentation:
Info-Tech Insight
Establishing credibility and trust with executive stakeholders is important to obtaining their support for security objectives.
Know your environment |
Be professional but not boring |
Connect with your audience |
|---|---|---|
|
|
|
Optimize the timing of your presentation:
Script your presentation:
Other considerations:
Leverage this checklist to ensure you are prepared to develop and deliver an engaging presentation.
Checklist:
Once you’ve delivered your captivating presentation, it’s imperative to communicate with your executive stakeholders.
Info-Tech Insight
Verifying your objectives at the end of the presentation is important, as it ensures you have successfully communicated to executive stakeholders.
Follow this checklist to assist you in obtaining and verifying your communication goals.
Checklist:
Problem Solved
A better understanding of security communication drivers and goals
A developed a plan for how and where to retrieve data for communication
A solidified communication plan with security templates to assist in better presenting to your audience
A defined guideline on how to deliver a captivating presentation to achieve your desired objectives
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.
Contact your account representative for more information.
1-888-670-8889
Build an Information Security Strategy
This blueprint will walk you through the steps of tailoring best practices to effectively manage information security.
Build a Security Metrics Program to Drive Maturity
This blueprint will assist you in identifying security metrics that can tie to your organizational goals and build those metrics to achieve your desired maturity level.
Bhadauriya, Amit S. “Communicating Cybersecurity Effectively to the Board.” Metricstream. Web.
Booth, Steven, et al. “The Biggest Mistakes Made When Presenting Cyber Security to Senior Leadership or the Board, and How to Fix Them.” Mandiant, May 2019. Web.
Bradford, Nate. “6 Slides Every CISO Should Use in Their Board Presentation.” Security Boulevard, 9 July 2020. Web.
Buckalew, Lauren, et al. “Get the Board on Board: Leading Cybersecurity from the Top Down.” Newsroom, 2 Dec. 2019. Web.
Burg, Dave, et al. “Cybersecurity: How Do You Rise above the Waves of a Perfect Storm?” EY US - Home, EY, 22 July 2021. Web.
Carnegie Endowment for International Peace. Web.
“Chief Information Security Officer Salary.” Salary.com, 2022. Web.
“CISO's Guide to Reporting to the Board - Apex Assembly.” CISO's Guide To Reporting to the Board. Web.
“Cyber Security Oversight in the Boardroom” KPMG, Jan. 2016. Web.
“Cybersecurity CEO: My 3 Tips for Presenting in the Boardroom.” Cybercrime Magazine, 31 Mar. 2020. Web.
Dacri , Bryana. Do's & Don'ts for Security Professionals Presenting to Executives. Feb. 2018. Web.
Froehlich, Andrew. “7 Cybersecurity Metrics for the Board and How to Present Them: TechTarget.” Security, TechTarget, 19 Aug. 2022. Web.
“Global Board Risk Survey.” EY. Web.
“Guidance for CISOs Presenting to the C-Suite.” IANS, June 2021. Web.
“How to Communicate Cybersecurity to the Board of Directors.” Cybersecurity Conferences & News, Seguro Group, 12 Mar. 2020. Web.
Ide, R. William, and Amanda Leech. “A Cybersecurity Guide for Directors” Dentons. Web.
Lindberg, Randy. “3 Tips for Communicating Cybersecurity to the Board.” Cybersecurity Software, Rivial Data Security, 8 Mar. 2022. Web.
McLeod, Scott, et al. “How to Present Cybersecurity to Your Board of Directors.” Cybersecurity & Compliance Simplified, Apptega Inc, 9 Aug. 2021. Web.
Mickle, Jirah. “A Recipe for Success: CISOs Share Top Tips for Successful Board Presentations.” Tenable®, 28 Nov. 2022. Web.
Middlesworth, Jeff. “Top-down: Mitigating Cybersecurity Risks Starts with the Board.” Spiceworks, 13 Sept. 2022. Web.
Mishra, Ruchika. “4 Things Every CISO Must Include in Their Board Presentation.” Security Boulevard, 17 Nov. 2020. Web.
O’Donnell-Welch, Lindsey. “CISOs, Board Members and the Search for Cybersecurity Common Ground.” Decipher, 20 Oct. 2022. Web.
“Overseeing Cyber Risk: The Board's Role.” PwC, Jan. 2022. Web.
Pearlson, Keri, and Nelson Novaes Neto. “7 Pressing Cybersecurity Questions Boards Need to Ask.” Harvard Business Review, 7 Mar. 2022. Web.
“Reporting Cybersecurity Risk to the Board of Directors.” Web.
“Reporting Cybersecurity to Your Board - Steps to Prepare.” Pondurance ,12 July 2022. Web.
Staynings, Richard. “Presenting Cybersecurity to the Board.” Resource Library. Web.
“The Future of Cyber Survey.” Deloitte, 29 Aug. 2022. Web.
“Top Cybersecurity Metrics to Share with Your Board.” Packetlabs, 10 May 2022. Web.
Unni, Ajay. “Reporting Cyber Security to the Board? How to Get It Right.” Cybersecurity Services Company in Australia & NZ, 10 Nov. 2022. Web.
Vogel, Douglas, et al. “Persuasion and the Role of Visual Presentation Support.” Management Information Systems Research Center, 1986.
“Welcome to the Cyber Security Toolkit for Boards.” NCSC. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Analyze strategic CIO competencies and assess business stakeholder satisfaction with IT using Info-Tech's CIO Business Vision Diagnostic and CXO-CIO Alignment Program.
Evaluate strategic CIO competencies and business stakeholder relationships.
Create a personal development plan and stakeholder management strategy.
Develop a scorecard to track personal development initiatives.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Gather and review information from business stakeholders.
Assess strategic CIO competencies and business stakeholder relationships.
Gathered information to create a personal development plan and stakeholder management strategy.
Analyzed the information from diagnostics and determined the appropriate next steps.
Identified and prioritized strategic CIO competency gaps.
Evaluated the power, impact, and support of key business stakeholders.
1.1 Conduct CIO Business Vision diagnostic
1.2 Conduct CXO-CIO Alignment program
1.3 Assess CIO competencies
1.4 Assess business stakeholder relationships
CIO Business Vision results
CXO-CIO Alignment Program results
CIO competency gaps
Executive Stakeholder Power Map
Create a personal development plan and stakeholder management strategy.
Track your personal development and establish checkpoints to revise initiatives.
Identified personal development and stakeholder engagement initiatives to bridge high priority competency gaps.
Identified key performance indicators and benchmarks/targets to track competency development.
2.1 Create a personal development plan
2.2 Create a stakeholder management strategy
2.3 Establish key performance indicators and benchmarks/targets
Personal Development Plan
Stakeholder Management Strategy
Strategic CIO Competency Scorecard
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the use cases and benefits of using text-based services for customer support, and establish how they align to the organization’s current service strategy.
Identify the right applications that will be needed to adequately support a text-based support strategy.
Create repeatable workflows and escalation policies for text-centric support.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Create the business case for text-based support.
A clear direction on the drivers and value proposition of text-based customer support for your organization.
1.1 Identify customer personas.
1.2 Define business and IT drivers.
Identification of IT and business drivers.
Project framework and guiding principles for the project.
Create a technology enablement framework for text-based support.
Prioritized requirements for text-based support and a vetted shortlist of the technologies needed to enable it.
2.1 Determine the correct migration strategy based on the current version of Exchange.
2.2 Plan the user groups for a gradual deployment.
Exchange migration strategy.
User group organization by priority of migration.
Create service workflows for text-based support.
Customer service workflows and escalation policies, as well as risk mitigation considerations.
Present final deliverable to key stakeholders.
3.1 Review the text channel matrix.
3.2 Build the inventory of customer service applications that are needed to support text-based service.
Extract requirements for text-based customer support.
Finalize the text service strategy.
Resource and risk mitigation plan.
4.1 Build core customer service workflows for text-based support.
4.2 Identify text-centric risks and create a mitigation plan.
4.3 Identify metrics for text-based support.
Business process models assigned to text-based support.
Formulation of risk mitigation plan.
Key metrics for text-based support.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand your current state and determine the need for a deeper audit.
Audit your selected projects and portfolios. Understand the gaps in portfolio practices.
Document the steps you are going to take to address any issues that were uncovered in phase 2.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
An audit of your portfolio management practices.
Analysis of audit results.
1.1 Info-Tech’s Audit Standard/Engagement Context
1.2 Portfolio Audit
1.3 Input Validation
1.4 Portfolio Audit Analysis
1.5 Start/Stop/Continue
Audit Standard and Audit Glossary of Terms
Portfolio and Project Audit Tool
Start/Stop/Continue
An audit of your project management practices.
Analysis of audit results.
2.1 Project Audit
2.2 Input Validation
2.3 Project Audit Analysis
2.4 Start/Stop/Continue
Portfolio and Project Audit Tool
Start/Stop/Continue
Create a plan to start addressing any vulnerabilities.
A plan to move forward.
3.1 Action Plan
3.2 Key Takeaways
Audit Timeline Template
Make sure to build a strong knowledge management strategy to identify, capture, and transfer knowledge from project delivery to the service desk.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This storyboard will help you craft a project support plan to document information to streamline service support.
Use these two templates as a means of collaboration with the service desk to provide information on the application/product, and steps to take to make sure there are efficient service processes and knowledge is appropriately transferred to the service desk to support the service.
Analyst PerspectiveFormalize your project support plan to shift customer service to the service desk.
|
As a service support team member, you receive a ticket from an end user about an issue they’re facing with a new application. You are aware of the application release, but you don’t know how to handle the issue. So, you will need to either spend a long time investigating the issue via peer discussion and research or escalate it to the project team. Newly developed or improved services should be transitioned appropriately to the support team. Service transitioning should include planning, coordination, and communication. This helps project and support teams ensure that upon a service failure, affected end users receive timely and efficient customer support. At the first level, the project team and service desk should build a strategy around transitioning service support to the service desk by defining tasks, service levels, standards, and success criteria. In the second step, they should check the service readiness to shift support from the project team to the service desk. The next step is training on the new services via efficient communication and coordination between the two parties. The project team should allocate some time, according to the designed strategy, to train the service desk on the new/updated service. This will enable the service desk to provide independent service handling. This research walks you through the above steps in more detail and helps you build a checklist of action items to streamline shifting service support to the service desk. Mahmoud Ramin, PhDSenior Research Analyst
|
Your Challenge
|
Common Obstacles
|
Info-Tech’s Approach
|
Make sure to build a strong knowledge management strategy to identify, capture, and transfer knowledge from project delivery to the service desk.
Service desk team:
|
Project delivery team:
|
A successful launch can still be a failure if the support team isn't fully informed and prepared.
|
Info-Tech InsightInvolve the service desk in the transition process via clear communication, knowledge transfer, and staff training. |
Service desk involvement in the development, testing, and maintenance/change activity steps of your project lifecycle will help you logically define the category and priority level of the service and enable service level improvement accordingly after the project goes live.

The project team is dedicated to projects, while the support team focuses on customer service for several products.Siloed responsibilities:
|
How to break the silos: Develop a tiered model for the service desk and include project delivery in the specialist tier.
|
At the project level, get a clear understanding of support capabilities and demands, and communicate them to the service desk to proactively bring them into the planning step.
|
The following questions help you with an efficient plan for support transition |
|
Why is stakeholder analysis essential?

| Task/Activity | Example |
Conduct administrative work in the application |
|
Update documentation |
|
| Service request fulfillment/incident management |
|
| Technical support for systems troubleshooting |
|
End-user training |
|
| Service desk training |
|
Support management (monitoring, meeting SLAs) |
|
Report on the service transitioning |
|
| Ensure all policies follow the transition activities |
|
|
|
|
|
|
|
Document project description and service priority in the Project Handover Template.
|
|
Document service level objectives and maintenance in the Project Handover Template.
Transition of a project to the service desk includes both knowledge transfer and execution transfer.
01
Provide training and mentoring to ensure technical knowledge is passed on.
02
Transfer leadership responsibilities by appointing the right people.
03
Transfer support by strategically assigning workers with the right technical and interpersonal skills.
04
Transfer admin rights to ensure technicians have access rights for troubleshooting.
05
Create support and a system to transfer work process. For example, using an online platform to store knowledge assets is a great way for support to access project information.
A communication plan and executive presentation will help project managers outline recommendations and communicate their benefits.
|
Leaders of successful change spend considerable time developing a powerful change message, i.e. a compelling narrative that articulates the desired end state, that makes the change concrete and meaningful to staff. The message should:
|
|
The support team usually uses an ITSM solution, while the project team mostly uses a project management solution. End users’ support is done and documented in the ITSM tool.
Even terminologies used by these teams are different. For instance, service desk’s “incident” is equivalent to a project manager’s “defect.” Without proper integration of the development and support processes, the contents get siloed and outdated over time.
Potential ways to deal with this challenge:
This helps you document information in a single platform and provides better visibility of the project status to the support team as well. It also helps project team find out change-related incidents for a faster rollback.
Note: This is not always feasible because of the high costs incurred in purchasing a new application with both ITSM and PM capabilities and the long time it takes for implementing such a solution.
Note: Consider the processes that should be integrated. Don’t integrate unnecessary steps in the development stage, such as design, which will not be helpful for support transition.
Training the service desk has two-fold benefits:
Improve support:
Shift-left enablement:
|
For more information about shift-left enablement, refer to InfoTech’s blueprint Optimize the Service Desk With a Shift-Left Strategy. |
Use the following steps to ensure the service desk gets trained on the new project.
|
Info-Tech InsightAllocate knowledge transfer within ticket handling workflows. When incident is resolved by a specialist, they will assess if it is a good candidate for technician training and/or a knowledgebase article. If so, the knowledge manager will be notified of the opportunity to assign it to a SME for training and documentation of an article. For more information about knowledge transfer, refer to phase 3 of Info-Tech’s blueprint Standardize the Service Desk.
|
| Role | Training Function | Timeline |
Developer/Technical Support |
|
|
| Business Analysts |
|
|
Service Desk Agents |
|
|
| Vendor |
|
Document your knowledge transfer plan in the Project Handover Template.
| Info-Tech InsightNo matter how well training is done, specialists may need to work on critical incidents and handle emergency changes. With effective service support and transition planning, you can make an agreement between the incident manager, change manager, and project manager on a timeline to balance critical incident or emergency change management and project management and define your SLA. |
|
2-3 hours Document project support information and check off each support transition initiative as you shift service support to the service desk.
|
|
You won’t know if transitioning support processes are successful unless you measure their impact. Find out your objectives for project transition and then track metrics that will allow you to fulfill these goals.
|
Determine critical success factors to help you find out key metrics: High quality of the service Effectiveness of communication of the transition Manage risk of failure to help find out activities that will mitigate risk of service disruption Smooth and timely transition of support to the service desk Efficient utilization of the shared services and resources to mitigate conflicts and streamline service transitioning |
Suggested metrics:
|
Following the steps outlined in this research has helped you build a strategy to shift service support from the project team to the service desk, resulting in an improvement in customer service and agent satisfaction.
You have also developed a plan to break the silo between the service desk and specialists and enable knowledge transfer so the service desk will not need to unnecessarily escalate tickets to developers. In the meantime, specialists are also responsible for service desk training on the new application.
Efficient communication of service levels has helped the project team set clear expectations for managers to create a balance between their projects and service support.
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.
Contact your account representative for more information
workshops@infotech.com
1-888-670-8889
Improve customer service by driving consistency in your support approach and meeting SLAs.
Optimize the Service Desk With a Shift-Left StrategyThe best type of service desk ticket is the one that doesn’t exist.
Tailor IT Project Management Processes to Fit Your ProjectsRight-size PMBOK for all of your IT projects.
Brown, Josh. “Knowledge Transfer: What it is & How to Use it Effectively.” Helpjuice, 2021. Accessed November 2022.
Magowan, Kirstie. “Top ITSM Metrics & KPIs: Measuring for Success, Aiming for Improvement.” BMC Blogs, 2020. Accessed November 2022.
“The Complete Blueprint for Aligning Your Service Desk and Development Teams (Process Integration and Best Practices).” Exalate, 2021. Accessed October 2022.
“The Qualities of Leadership: Leading Change.” Cornelius & Associates, 2010. Web.
88% of marketing professionals are unsatisfied with their ability to convert leads (Convince & Convert), but poor lead conversion is just a symptom of much deeper problems.
Globally, B2B SaaS marketers without a well-running lead gen engine will experience:
If treated without a root cause analysis, these symptoms often result in higher-than-average marketing spend and wasted resources. Without an accurate lead gen engine diagnostic tool and a strategy to fix the misfires, marketers will continue to waste valuable time and resources.
The lead gen engine is foundational in building profitable long-term customer relationships. It is the process through which marketers build awareness, trust, and loyalty. Without the ability to continually diagnose lead gen engine flaws, marketers will fail to optimize new customer relationship creation and long-term satisfaction and loyalty.
With a targeted set of diagnostic tools and an optimization strategy, you will:
Organizations who activate the findings from their lead generation diagnostic and optimization strategy will decrease the time and budget spent on lead generation by 25% to 50%. They will quickly uncover inefficiencies in their lead gen engine and develop a proven lead generation optimization strategy based on the diagnostic findings.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Organizations who activate the findings from their lead generation diagnostic and optimization strategy will decrease the time and budget spent on lead generation by 25% to 50%. They will quickly uncover inefficiencies in their lead gen engine and develop a proven lead generation optimization strategy based on the diagnostic findings.
The diagnostic tool allows digital marketers to quickly and easily diagnose weakness within your lead gen engine.
Develop a best-in-class lead gen engine optimization strategy that builds relationships, creates awareness, and establishes trust and loyalty with prospects.
Senior digital marketing leaders are accountable for building relationships, creating awareness, and developing trust and loyalty with website visitors, thereby delivering high-quality, high-value leads that Sales can easily convert to wins. Unfortunately, many marketing leaders report that their website visitors are low-quality and either disengage quickly or, when they engage further with lead gen engine components, they just don’t convert. These marketing leaders urgently need to diagnose what’s not working in three key areas in their lead gen engine to quickly remedy the issue and get back on track, building new customer relationships and driving loyalty. This blueprint will provide you with a tool to quickly and easily diagnose weakness within your lead gen engine. You can use the results to create a strategy that builds relationships, creates awareness, and establishes trust and loyalty with prospects.
Terra Higginson
Marketing Research Director
SoftwareReviews
Globally, business-to-business (B2B) software-as-a-service (SaaS) marketers without a well-running lead gen engine will experience:
88% of marketing professionals are unsatisfied with their ability to convert leads (Convince & Convert), but poor lead conversion is just a symptom of a much larger problem with the lead gen engine. Without an accurate lead gen engine diagnostic tool and a strategy to fix the leaks, marketers will continue to waste valuable time and resources.
Even though lead generation is a critical element of marketing success, marketers struggle to fix the problems with their lead gen engine due to:
Most marketers spend too much on acquiring leads and not enough on converting and keeping them. For every $92 spent acquiring customers, only $1 is spent converting them (Econsultancy, cited in Outgrow). Marketers are increasingly under pressure to deliver high-quality leads to sales but work under tight budgets with inadequate or inexperienced staff who don’t understand the importance of optimizing the lead generation process.
With a targeted set of diagnostic tools and an optimization strategy, you will:
Organizations who activate the findings from their lead generation diagnostic and optimization strategy will decrease the time and budget spent on lead generation by 25% to 50%. They will quickly uncover inefficiencies in their lead gen engine and develop a proven lead generation optimization strategy based on the diagnostic findings.
The lead gen engine is foundational in building profitable long-term customer relationships. It is the process through which marketers build awareness, trust, and loyalty. Without the ability to continually diagnose lead gen engine flaws, marketers will fail to optimize new customer relationship creation and long-term satisfaction and loyalty.
Globally, B2B SaaS marketers without a well-running lead gen engine will experience:
If treated without a root-cause analysis, these symptoms often result in higher-than-average marketing spend and wasted resources. Without an accurate lead gen engine diagnostic tool and a strategy to fix the misfires, marketers will continue to waste valuable time and resources.
88% of marketers are unsatisfied with lead conversion (Convince & Convert).
|
For every 10,000 people that visit your website, 210 will become leads. |
For every 210 leads, 101 will become marketing qualified leads (MQLs). |
For every 101 MQLs, 47 will become sales qualified leads (SQLs). |
For every 47 SQLs, 23 will become opportunities. |
For every 23 opportunities, nine will become customers. |
|
.9% to 2.1% |
36% to 48% |
28% to 46% |
39% to 48% |
32% to 40% |
|
Leads Benchmark |
MQL Benchmark |
SQL Benchmark |
Opportunity Benchmark |
Closing Benchmark |
|
The percentage of website visitors that convert to leads. |
The percentage of leads that convert to marketing qualified leads. |
The percentage of MQLs that convert to sales qualified leads. |
The percentage of SQLs that convert to opportunities. |
The percentage of opportunities that are closed. |
Midmarket B2B SaaS Industry
Lack of Clear Starting Point
The lead gen engine is complex, with many moving parts, and marketers and marketing ops are often overwhelmed about where to begin diagnosis.
Lack of Benchmarks
Marketers often call out metrics such as increasing website visitors, contact-to-lead conversions, numbers of qualified leads delivered to Sales, etc., without a proven benchmark to compare their results against.
Lack of Alignment Between Marketing and Sales
Definitions of a contact, a marketing qualified lead, a sales qualified lead, and a marketing influenced win often vary.
Lack of Measurement Tools
Integration gaps between the website, marketing automation, sales enablement, and analytics exist within some 70% of enterprises. The elements of the marketing (and sales) tech stack change constantly. It’s hard to keep up.
Lack of Understanding of Marketing ROI
This drives many marketers to push the “more” button – more assets, more emails, more ad spend – without first focusing on optimization and effectiveness.
Lack of Resources
Marketers have an endless list of to-dos that drive them to produce daily results. Especially among software startups and mid-sized companies, there are just not enough staff with the right skills to diagnose and fix today’s sophisticated lead gen engines.
Most marketers are spending too much on acquiring leads and not enough on converting and keeping them. For every $92 spent acquiring customers, only $1 is spent converting them.
Lead gen engine optimization increases the efficiency of your marketing efforts and has a 223% ROI.
“It’s much easier to double your business by doubling your conversion rate than by doubling your traffic. Correct targeting and testing methods can increase conversion rates up to 300 percent.” – Jeff Eisenberg, IterateStudio
175%
Buyer Personas Increase Revenue
Source: Illumin8
202%
Personalized CTAs Increase Conversions
Source: HubSpot
50%
Lead Magnets Increase Conversions
Source: ClickyDrip
79%
Lead Scoring Increases Conversions
Source: Bloominari
50%
Lead Nurturing Increases Conversions
Source: KevinTPayne.com
80%
Personalized Landing Pages Increase Conversions
Source: HubSpot
Identifying any areas of weakness within your lead gen engine is a fundamental first step in improving conversions, ROI, and lead quality.
Optimize your lead gen strategy with an easily customizable template that will provide your roadmap for future growth.
|
1. Lead Gen Engine Diagnostic |
2. Lead Gen Engine Optimization Strategy |
|
|
Phase Steps |
|
|
|
Phase Outcomes |
|
|
The lead gen engine is the foundation of marketing
The lead gen engine is critical to building relationships. It is the foundation upon which marketers build awareness, trust, and loyalty.
Misalignment between Sales and Marketing is costly
Digital marketing leaders need to ensure agreement with Sales on the definition of a marketing qualified lead (MQL), as it is the most essential element of stakeholder alignment.
Prioritization is necessary for today’s marketer
By prioritizing the fixes within the lead gen engine that have the highest impact, a marketing leader will be able to focus their optimization efforts in the right place.
Stop, your engine is broken
Any advertising or effort expended while running marketing on a broken lead gen engine is time and money wasted. It is only once the lead gen engine is fixed that marketers will see the true results of their efforts.
Tactical insight
Without a well-functioning lead gen engine, marketers risk wasting valuable time and money because they aren’t creating relationships with prospects that will increase the quality of leads, conversion rate, and lifetime value.
Tactical insight
The foundational lead relationship must be built at the marketing level, or else Sales will be entirely responsible for creating these relationships with low-quality leads, risking product failure.
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
Lead Gen Engine Diagnostic
An efficient and easy-to-use diagnostic tool that uncovers weakness in your lead gen engine.
Lead Gen Engine Optimization Strategy Template
A comprehensive strategy for optimizing conversions and increasing the quality of leads.
Included within Advisory Membership:
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
Optional add-ons:
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Diagnose Your Lead Gen Engine
Call #1: Scope requirements, objectives, and specific challenges with your lead gen engine.
Call #2: Gather baseline metrics and discuss the steering committee and working team.
Call #3: Review results from baseline metrics and answer questions.
Call #4: Discuss the lead gen engine diagnostic tool and your steering committee.
Call #5: Review results from the diagnostic tool and answer questions.
Develop Your Lead Gen Engine Optimization Strategy
Call #6: Identify components to include in the lead gen engine optimization strategy.
Call #7: Discuss the roadmap for continued optimization.
Call #8: Review final lead gen engine optimization strategy.
Call #9: (optional) Follow-up quarterly to check in on progress and answer questions.
A Guided Implementation (GI) is series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization. For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst. Your engagement managers will work with you to schedule analyst calls.
|
Day 1 |
Day 2 |
|
|---|---|---|
|
Activities |
Complete Lead Gen Engine Diagnostic 1.1 Identify the previously selected lead gen engine steering committee and working team. 1.2 Share the baseline metrics that were gathered in preparation for the workshop. 1.3 Run the lead gen engine diagnostic. 1.4 Identify low-scoring areas and prioritize lead gen engine fixes. |
Create Lead Gen Engine Optimization Strategy 2.1 Define the roadmap. 2.2 Create a lead gen engine optimization strategy. 2.3 Present the strategy to the steering committee. |
|
Deliverables |
1. Lead gen engine diagnostic scorecard |
1. Lead gen engine optimization strategy |
Contact your account representative for more information.
workshops@infotech.com1-888-670-8889
|
Phase 1 |
Phase 2 |
|
1.1 Select lead gen engine steering committee & working team 1.2 Gather baseline metrics 1.3 Run the lead gen engine diagnostic 1.4 Identify & prioritize low-scoring areas |
2.1 Define the roadmap 2.2 Create lead gen engine optimization strategy 2.3 Present strategy to steering committee |
The diagnostic tool will allow you to quickly and easily identify the areas of weakness in the lead gen engine by answering some simple questions. The steps include:
Activities
1.1.1 Identify the lead gen engine optimization steering committee and document in the Lead Gen Engine Optimization Strategy Template
1.1.2 Identify the lead gen engine optimization working team document in the Lead Gen Engine Optimization Strategy Template
This step will walk you through the following activities:
Identify the lead gen engine optimization steering committee.
This step involves the following participants:
Outcomes of this step
An understanding of who will be responsible and who will be accountable for accomplishing the lead gen engine diagnostic and optimization strategy.
1-2 hours
|
Input |
Output |
|
|
|
Materials |
Participants |
|
|
Download the Lead Gen Engine Optimization Strategy Template
Consider the skills and knowledge required for the diagnostic and the implementation of the strategy. Constructing a cross-functional steering committee will be essential for the optimization of the lead gen engine. At least one stakeholder from each relevant department should be included in the steering committee.
|
Required Skills/Knowledge |
Suggested Functions |
|
|
For small and mid-sized businesses (SMB), because employees wear many different hats, assign people that have the requisite skills and knowledge, not the role title.
Input | Output |
|
|
Materials | Participants |
|
|
Download the Lead Gen Engine Optimization Strategy Template
Consider the working skills required for the diagnostic and implementation of the strategy and assign the working team.
|
Required Skills/Knowledge |
Suggested Titles |
|---|---|
|
|
Activities
1.2.1 Gather baseline metrics and document in the Lead Gen Engine Optimization Strategy Template
Gather baseline metrics.
Understand and document baseline marketing metrics.
Recording the baseline data allows you to measure the impact your lead gen engine optimization strategy has over the baseline.
Input | Output |
|
|
Materials | Participants |
|
|
Unique Monthly Visitors
Industry standard is 5% to 10% growth month over month.
Visitor to Lead Conversion
Industry standard is between 0.9% to 2.1%.
Lead to MQL Conversion
Industry standard is between 36% to 48%.
CAC
Industry standard is a cost of $400 to $850 per customer acquired.
LTV to CAC Ratio
Industry standard is an LTV:CAC ratio between 3 to 6.
Campaign ROI
Email: 201%
Pay-Per-Click (PPC): 36%
LinkedIn Ads: 94%
Update the Lead Gen Optimization Strategy Template with your company’s baseline metrics.
Download the Lead Gen Engine Optimization Strategy Template
Activities
1.3.1 Gather steering committee and working team to complete the Lead Gen Engine Diagnostic Tool
Gather the steering committee and answer the questions within the Lead Gen Engine Diagnostic Tool.
Lead gen engine diagnostic and scorecard
Input | Output |
|
|
Materials | Participants |
|
|
Download the Lead Gen Engine Diagnostic Tool
Activities
1.4.1 Identify and prioritize low-scoring areas from the diagnostic scorecard
Identify and prioritize the low-scoring areas from the diagnostic scorecard.
A prioritized list of the lead gen engine problems to include in the Lead Gen Engine Optimization Strategy Template
Input | Output |
|
|
Materials | Participants |
|
|
Download the Lead Gen Engine Diagnostic Tool
Phase 1 | Phase 2 |
1.1 Select lead gen engine steering committee & working team 1.2 Gather baseline metrics 1.3 Run the lead gen engine diagnostic 1.4 Identify & prioritize low-scoring areas | 2.1 Define the roadmap 2.2 Create lead gen engine optimization strategy 2.3 Present strategy to steering committee |
Create a best-in-class lead gen optimization strategy and roadmap based on the weaknesses found in the diagnostic tool. The steps include:
Activities
2.1.1 Create the roadmap for the lead gen optimization strategy
Create the optimization roadmap for your lead gen engine strategy.
Strategy roadmap
Input | Output |
|
|
Materials | Participants |
|
|
Download the Lead Gen Engine Optimization Strategy Template
Activities
2.2.1 Customize your lead gen engine optimization strategy using the template
Create a lead gen engine optimization strategy based on the results of your diagnostic scorecard.
Marketing director
A leadership-facing lead gen optimization strategy
Review the strategy template:
Input | Output |
|
|
Materials | Participants |
|
|
Download the Lead Gen Engine Optimization Strategy Template
Activities
2.3.1 Present the findings of the diagnostic and the lead gen optimization strategy to the steering committee.
Get executive buy-in on the lead gen engine optimization strategy.
| Input | Output |
|
|
Materials | Participants |
|
|
Download the Lead Gen Engine Optimization Strategy Template
Make it easier to market, sell, and achieve product-market fit with deeper buyer understanding.
In today’s competitive environment, optimizing Sales’ resources by giving them qualified leads is key to B2B marketing success.
Creating a compelling go-to-market strategy and keeping it current is a critical software company function – as important as financial strategy, sales operations, and even corporate business development – given its huge impact on the many drivers of sustainable growth.
“11 Lead Magnet Statistics That Might Surprise You.” ClickyDrip, 28 Dec. 2020. Accessed April 2022.
“45 Conversion Rate Optimization Statistics Every Marketer Should Know.” Outgrow, n.d. Accessed April 2022.
Bailyn, Evan. “B2B SaaS Funnel Conversion Benchmarks.” First Page Sage, 24 Feb. 2021. Accessed April 2022.
Bailyn, Evan. “B2B SaaS Marketing KPIs: Behind the Numbers.” First Page Sage, 1 Sept. 2021. Accessed April 2022.
Conversion Optimization.” Lift Division, n.d. Accessed April 2022.
Corson, Sean. “LTV:CAC Ratio [2022 Guide] | Benchmarks, Formula, Tactics.” Daasity, 3 Nov. 2021. Accessed April 2022.
Dudley, Carrie. “What are personas?” Illumin8, 26 Jan. 2018. Accessed April 2022.
Godin, Seth. “Permission Marketing.” Accenture, Oct. 2009. Accessed April 2022.
Lebo, T. “Lead Conversion Statistics All B2B Marketers Need to Know.” Convince & Convert, n.d. Accessed April 2022.
Lister, Mary. “33 CRO & Landing Page Optimization Stats to Fuel Your Strategy.” WordStream, 24 Nov. 2021. [Accessed April 2022].
Nacach, Jamie. “How to Determine How Much Money to Spend on Lead Generation Software Per Month.” Bloominari, 18 Sept. 2018. Accessed April 2022.
Needle, Flori. “11 Stats That Make a Case for Landing Pages.” HubSpot, 10 June 2021. Accessed April 2022.
Payne, Kevin. “10 Effective Lead Nurturing Tactics to Boost Your Sales.” Kevintpayne.com, n.d. Accessed April 2022.
Tam, Edwin. “ROI in Marketing: Lifetime Value (LTV) & Customer Acquisition Cost (CAC).” Construct Digital, 19 Jan. 2016. Accessed April 2022.
Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Integrating physical and information security introduces challenges in:
Info-Tech's approach is a modular, incremental, and repeatable process to integrate physical and information security to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Info-Tech provides a three-phased framework for integrating physical security and information security: Plan, Enhance, and Monitor & Optimize.
This tool serves as a repository for information about security integration elements, compliance, and other factors that will influence your integration of physical security and information security.
Populating a RACI chart (Responsible, Accountable, Consulted, and Informed) is a critical step that will assist you in organizing roles for carrying out integration steps. Complete this tool to assign tasks to suitable roles.
Complete this template to effectively communicate your integrated security plan to stakeholders.
From physical access control systems (PACS) such as electronic locks and fingerprint biometrics to video surveillance systems (VSS) such as IP cameras to perimeter intrusion detection and prevention to fire and life safety and beyond: physical security systems pose unique challenges to overall security. Additionally, digital transformation of physical security to the cloud and the convergence of operational technology (OT), internet of things (IoT), and industrial IoT (IIoT) increase both the volume and frequency of security threats.
These threats can be safety, such as the health impact when a gunfire attack downed wastewater pumps at Duke Energy Substation, North Carolina, US, in 2022. The threats can also be economic, such as theft of copper wire, or they can be reliability, such as when a sniper attack on Pacific Gas & Electric’s Metcalf Substation in California, US, damaged 17 out of 21 power transformers in 2013.
Considering the security risks organizations face, many are unifying physical, cyber, and information security systems to gain the long-term overall benefits a consolidated security strategy provides.

Research Director, Security and Privacy Practice
Info-Tech Research Group
Your ChallengePhysical security is often managed by facilities, not by IT security, resulting in segmented security systems. Meanwhile, integrating physical and information security introduces challenges in:
|
Common ObstaclesPhysical security systems integration is complex due to various components such as proprietary devices and protocols and hybrid systems of analog and digital technology. Thus, open architecture with comprehensive planning and design is important. However, territorial protection by existing IT and physical security managers may limit security visibility and hinder security integration. Additionally, integration poses challenges in staffing, training and awareness programs, and dependency on third-party technologies and their migration plans. |
Info-Tech's ApproachInfo-Tech’s approach is a modular, incremental, and repeatable process to integrate physical and information security that enables organizations to:
|
An integrated security architecture, including people, process, and technology, will improve your overall security posture. These benefits are leading many organizations to consolidate their siloed systems into a single platform across physical security, cybersecurity, HR, legal, and compliance.
Current security models do not cover all areas of security, especially if physical systems and personnel are involved and safety is also an important property required.
Sources: Parker, 1998; Pender-Bey, 2012; Cherdantseva and Hilton, 2015
Sources: Cisco, n.d.; Preparing for Technology Convergence in Manufacturing, Info-Tech Research Group, 2018
Physical security includes:
Why is integrating physical and information security gaining more and more traction? Because the supporting technologies are becoming more matured. This includes, for example, migration of physical security devices to IP-based network and open architecture.
Target: Alfred P. Murrah Federal Building, Oklahoma, US. Method: Bombing. Impact: Destroyed structure of 17 federal agencies, 168 casualties, over 800 injuries. Result: Creation of Interagency Security Committee (ISC) in Executive Order 12977 and “Vulnerability Assessment of Federal Facilities” standard.
(Source: Office of Research Services, 2017)
Target: Pacific Gas & Electric’s Metcalf Substation, California, US. Method: Sniper attack. Impact: Out of 21 power transformers, 17 were damaged. Result: Creation of Senate Bill No. 699 and NERC- CIP-014 standard.
(Source: T&D World, 2023)
Target: Nord Stream gas pipelines connecting Russia to Germany, Baltic sea. Method: Detonations. Impact: Methane leaks (~300,000 tons) at four exclusive economic zones (two in Denmark and two in Sweden). Result: Sweden’s Security Service investigation.
(Source: CNBC News, 2022)
Target: Duke Energy Substation, North Carolina, US. Method: Gunfire. Impact: Power outages of ~40,000 customers and wastewater pumps in sewer lift stations down. Result: State of emergency was declared.
(Source: CBS News, 2022)
When it comes to physical security, we have been mostly reactive. Typically the pattern starts with physical attacks. Next, the impacted organization mitigates the incidents. Finally, new government regulatory measures or private sector or professional association standards are put in place. We must strive to change our pattern to become more proactive.
A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.
Source: MarketsandMarkets, 2022
An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.
Source: Ontic Center for Protective Intelligence, 2022
The physical security market is growing in systems and services, especially the integration of threat data management with cybersecurity.
We know the physical security challenges and how the physical security market is growing, but what initiatives are driving this growth? These are the top physical security initiatives and top investments for physical security operations integration:
A survey by Brivo asked 700 security professionals about their top physical security initiatives. The number one initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration.
Source: Brivo, 2022
An Ontic survey (N=359) on areas of investment for physical security operations integration shows the number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.
Source: Ontic Center for Protective Intelligence, 2022
When looking for a quick win, consider learning the best internal or external practice. For example, in 1994 IBM reorganized its security operation by bringing security professionals and non-security professionals in one single structure, which reduced costs by approximately 30% in two years.
Sources: Create and Implement an IoT Strategy, Info-Tech Research Group, 2022; Baker and Benny, 2013; Erich Krueger, Omaha Public Power District (contributor); Doery Abdou, March Networks Corporate (contributor)
4Wall Entertainment is a provider of entertainment lighting and equipment to event venues, production companies, lighting designers, and others, with a presence in 18 US and UK locations.
After many acquisitions, 4Wall Entertainment needed to standardize its various acquired systems, including physical security systems such as access control. In its integrated security approach, IT owns the integrated security, but they interface with related entities such as HR, finance, and facilities management in every location. This allows them to obtain information such as holidays, office hours, and what doors need to be accessed as inputs to the security system and to get sponsorship in budgeting.
In the past, 4Wall Entertainment tried delegating specific physical security to other divisions, such as facilities management and HR. This approach was unsuccessful, so IT took back the responsibility and accountability.
Currently, 4Wall Entertainment works with local vendors, and its biggest challenge is finding third-party vendors that can provide nationwide support.
In the future, 4Wall Entertainment envisions physical security modernization such as camera systems that allow more network accessibility, with one central system to manage and IoT device integration with SIEM and MDR.
Physical security is often part of facilities management. As a result, there are interdependencies with both internal departments (such as IT, information security, and facilities) and external parties (such as third-party vendors). IT leaders, security leaders, and operational leaders should keep the big picture in mind when designing and implementing integration of physical and information security. Use this checklist as a tool to track your security integration journey.
Today’s matured technology makes security integration possible. However, the governance and management of single integrated security presents challenges. These can be overcome using a multi-phased framework that enables a modular, incremental, and repeatable integration process, starting with planning to justify the value of investment, then enhancing the integrated security based on risks and open architecture. This is followed by using metrics for monitoring and optimization.
Just as medicine often comes with side effects, our Integration of Physical and Information Security Framework may introduce risks too. However, as John F. Kennedy, thirty-fifth president of the United States, once said, "There are risks and costs to a program of action — but they are far less than the long-range cost of comfortable inaction."
Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.
Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.
Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.
Find the most optimized architecture that is strategic, realistic, and based on risk. Next, perform an evaluation of the security systems and program by understanding what, where, when, and how to measure and to report the relevant metrics.
Identify the security integration problems to solve with visible improvement possibilities, and don’t choose technology for technology’s sake. Design first, then conduct market research by comparing products or services from vendors or manufacturers.
Avoid a big bang approach and test technologies in multiple conditions. Run inexpensive pilots and increase flexibility to build a technology ecosystem.
Each step of this framework is accompanied by supporting deliverables to help you accomplish your goals:
Map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals. Identify your security integration elements and compliance.
Identify various security integration stakeholders across the organization and assign tasks to suitable roles.
Present your findings in a prepopulated document that summarizes the work you have completed.
Planning is foundational to engage stakeholders. Start with justifying the value of investment, then define roles and responsibilities, update governance, and finally identify integrated elements and compliance obligations.
It is important to speak the same language. Physical security concerns safety and availability, while information security concerns confidentiality and integrity. Thus, the two systems have different goals and require alignment.
Similarly, taxonomy of terminologies needs to be managed,1 e.g. facility management with an emergency management background may have a different understanding from a CISO with an information security background when discussing the same term. For example:
In emergency management prevention means “actions taken to eliminate the impact of disasters in order to protect lives, property and the environment, and to avoid economic disruption.”2
In information security prevention is “preventing the threats by understanding the threat environment and the attack surfaces, the risks, the assets, and by maintaining a secure system.”3
Sources: 1 Owen Yardley, Omaha Public Power District (contributor); 2 Translation Bureau, Government of Canada, n.d.; 3 Security Intelligence, 2020
Input
|
Output
|
Materials
|
Participants
|
Download the Integrate Physical Security and Information Security Requirements Gathering Tool.
Refer to the Integration of Physical and Information Security Framework when filling in the table.
Facilities in most cases have a team that is responsible for physical security installations such as access key controllers. Whenever there is an issue, they contact the provider to fix the error. However, with smart buildings and smart devices, the threat surface grows to include information security threats, and Facilities may not possess the knowledge and skills required to deal with them. At the same time, delegating physical security to IT may add more tasks to their already-too-long list of responsibilities. Consolidating security to a focused security team that covers both physical and information security can help.1 We need to develop the security integration business case beyond physical security "gates, guns, and guards" mentality.2
Benefits |
Metrics |
Operational Efficiency and Cost Savings |
|
Reliability Improvements |
|
Customers & Users Benefits |
|
Cost |
Metrics |
Equipment and Infrastructure |
|
Software and Commission |
|
Support and Resources |
|
Sources: 1 Andrew Amaro, KLAVAN Security Services (contributor); 2 Baker and Benny, 2013;
Industrial Control System Modernization, Info-Tech Research Group, 2023; Lawrence Berkeley National Laboratory, 2021
Input
| Output
|
Materials
| Participants
|
Many factors impact an organization’s level of effectiveness as it relates to integration of physical and information security. How the team interacts, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, we need to identify stakeholders that are:
Download the Integrate Physical Security and Information Security RACI Chart Tool
Define Responsible, Accountable, Consulted, Informed (RACI) stakeholders.
Sources: ISC, 2015; ISC, 2021
The roles and responsibilities should be clearly defined. For example, IT Security should be responsible for the installation and configuration of all physical access controllers and devices, and facility managers should be responsible for the physical maintenance including malfunctioning such as access device jammed or physically broken.
HR provides information such as new hires and office hours as input to the security system. Finance assists in budgeting.
The security and privacy team will need to evaluate solutions and enforce standards on various physical and information security systems and to protect data privacy.
Business stakeholders will provide clarity for their strategy and provide input into how they envision security furthering those goals.
IT stakeholders will be a driving force, ensuring all necessary resources are available and funded.
Operational plans will include asset management, monitoring, and support to meet functional goals and manage throughout the asset lifecycle.
Each solution added to the environment will need to be chosen and architected to meet business goals and security functions.
Assemble the right team to ensure the success of your integrated security ecosystem and decide the governance model, e.g. security steering committee (SSC) or a centralized single structure.
Adapted from Create and Implement an IoT Strategy, Info-Tech Research Group, 2022
Ensuring proper governance over your security program is a complex task that requires ongoing care and feeding from executive management to succeed.
Your SSC should aim to provide the following core governance functions for your security program:
Adapted from Improve Security Governance With a Security Steering Committee , Info-Tech Research Group, 2018
To determine what elements need to be integrated, it’s important to scope the security integration program and to identify the consequences of integration for compliance obligations.
What are my concerns?
How can I address my concerns?
Refer to the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool when filling in the following elements.
Refer to the “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
View a sample contract provided by the US Department of Health and Human Services.
Source: Take Control of Compliance Improvement to Conquer Every Audit, Info-Tech Research Group, 2015
Sources: Real Time Networks, 2022; Andrew Amaro, KLAVAN Security Services (contributor)
Enhancing is the development of an integrated security strategy, policies, procedures, BCP, DR, and IR based on the organization’s risks.
Sources: Amy L. Meger, Platte River Power Authority (contributor); Baker and Benny, 2013; IFSEC Global, 2023; Security Priorities 2023, Info-Tech Research Group, 2023; Build an Information Security Strategy, Info-Tech Research Group, 2020; ISC, n.d.
Maturity models are very effective for determining security states. This table provides examples of general descriptions for physical and information security maturity levels.
Determine which framework is suitable and select the description that most accurately reflects the ideal state for security in your organization.
Level 1 |
Level 2 |
Level 3 |
Level 4 |
Level 5 |
|
| Minimum security with simple physical barriers. | Low-level security to prevent and detect some unauthorized external activity. | Medium security to prevent, detect, and assess most unauthorized external activity and some unauthorized internal activity. | High-level security to prevent, detect, and assess most unauthorized external and internal activity. | Maximum security to prevent, detect, assess, and neutralize all unauthorized external and internal activity. |
Physical security maturity level1 |
| Initial/Ad hoc security programs are reactive. | Developing security programs can be effective at what they do but are not holistic. | A defined security program is holistic, documented, and proactive. | Managed security programs have robust governance and metrics processes. | An optimized security program is based on strong risk management practices, including the production of key risk indicators (KRIs). |
Information security maturity level2 |
Sources: 1 Fennelly, 2013; 2 Build an Information Security Strategy, Info-Tech Research Group, 2020
The risk assessment conducted consists of analyzing existing inherent risks, existing pressure to the risks such as health and safety laws and codes of practice, new risks from the integration process, risk tolerance, and countermeasures.
Sources: EPA, n.d.; America's Water Infrastructure Act (AWIA), 2018; ISC, 2021
Source: Ontic Center for Protective Intelligence, 2022; N=359
The risk assessment conducted is based on a combination of physical and information security factors such as certain facilities factors. The risk level can be used to determine the baseline level of protection (LOP). Next, the baseline LOP is customized to the achievable LOP. The following is an example for federal facilities determined by Interagency Security Committee (ISC).
Source: ISC, 2021
It is important to identify the organization’s requirements, including its environments (IT, IoT, OT, facilities, etc.), and to measure and evaluate its risks and threats using an appropriate risk framework and tools with the critical step of identifying assets prior to acquiring solutions.
Certain exceptions must be identified in risk assessment. Usually physical barriers such as gates and intrusion detection sensors are considered as countermeasures,1 however, under certain assessment, e.g. America's Water Infrastructure Act (AWIA),2 physical barriers are also considered assets and as such must also be assessed.
An anecdotal example of why physical security alone is not sufficient.
Image by Rawpixel.com on Freepik
Lessons learned from using fingerprints for authentication:
In an ideal world, we want a physical security system that is interoperable with all technologies, flexible with minimal customization, functional, and integrated. In the real world, we may have physical systems with proprietary configurations that are not easily customized and siloed.
Source: Robert Dang, Info-Tech Research Group
Microchip implants can be used instead of physical devices such as key cards for digital identity and access management. Risks can be assessed using quantitative or qualitative approaches. In this use case a qualitative approach is applied to impact and likelihood, and a quantitative approach is applied to revenue and cost.
Impact |
|
Likelihood |
|
Revenue |
|
Impact |
|
Likelihood |
|
Cost |
|
Sources: Business Insider, 2018; BBC News, 2022; ISC, 2015
This model works for corporate groups with a parent company. In this model, global security policies are developed by a parent company and local policies are applied to the unique business that is not supported by the parent company.
This model works for organizations with sufficient resources. In this model, integrated security policies are derived from various policies. For example, physical security in smart buildings/devices (sensors, automated meters, HVAC, etc.) and OT systems (SCADA, PLCs, RTUs, etc.) introduce unique risk exposures, necessitating updates to security policies.
This model works for smaller organizations with limited resources. In this model, integrated security policies are derived from information security policies. The issue is when these policies are not applicable to physical security systems or other environments, e.g. OT systems.
Sources: Kris Krishan, Waymo (contributor); Isabelle Hertanto, Info-Tech Research Group (contributor); Physical and Environmental Security Policy Template, Info-Tech Research Group, 2022.
Sources: IEEE, 2021; ISC, 2021
Source: Dan Erwin, Security Officer, Dow Chemical Co., in Computerworld, 2022
Optimizing means working to make the most effective and efficient use of resources, starting with identifying skill requirements and closing skill gaps, followed by designing and deploying integrated security architecture and controls, and finally monitoring and reporting integrated security metrics.
| Identify skill gaps that hinder the successful execution of the hybrid work security strategy. | Use the identified skill gaps to define the technical skill requirements for current and future work roles. | Conduct a skills assessment on your current workforce to identify employee skill gaps. | Decide whether to train (including certification), hire, contract, or outsource to close each skill gap. |
Internal security governance and management using in-house developed tools or off-the-shelf solutions, e.g. security information and event management (SIEM).
Internal security management using third-party security services, e.g. managed security service providers (MSSPs).
Outsourcing the entire security functions, e.g. using managed detection and response (MDR).
Sources: Info-Tech Research Group’s Security Priorities 2023, Close the InfoSec Skills Gap, Build an IT Employee Engagement Program, and Grid Modernization
Sources: ISA and Honeywell Integrated Security Technology Lab, n.d.; IEEE, 2021
Source: FedTech magazine, 2009
Cloud, on-premises, or hybrid? During the pandemic, many enterprises were under tight deadlines to migrate to the cloud. Many did not refactor data and applications correctly for cloud platforms during migration, with the consequence of high cloud bills. This happened because the migrated applications cannot take advantage of on-premises capabilities such as autoscaling. Thus, in 2023, it is plausible that enterprises will bring applications and data back on-premises.
Below is an example of a security design analysis of platform architecture. Design can be assessed using quantitative or qualitative approaches. In this example, a qualitative approach is applied using high-level advantages and disadvantages.
Design criteria | Cloud | Hybrid | On-premises |
Effort | Consumer effort is within a range, e.g. < 60% | Consumer effort is within a range e.g. < 80% | 100% organization |
Reliability | High reliability | High reliability | Medium reliability that depends on data centers |
Cost | High cost when data and applications are not correctly designed for cloud | Optimized cost when data and applications are correctly designed either for cloud or native | Medium cost when data and applications take advantage of on-prem capabilities |
It is important for organizations to find the most optimized architecture to support them, for example, a hybrid architecture of cloud and on-premises based on operations and cost-effectiveness. To help design a security architecture that is strategic, realistic, and based on risk, see Info-Tech’s Identify the Components of Your Cloud Security Architecture research.
Sources: InfoWorld, 2023; Identify the Components of Your Cloud Security Architecture , Info-Tech Research Group, 2021
Below is an example case of a security design analysis of electronic security systems. Design can be assessed using quantitative or qualitative approaches. In this example a qualitative approach is applied using advantages and disadvantages.
Surveillance design criteria |
Video camera |
Motion detector |
Theft of security system equipment |
Higher economic loss | Lower economic loss |
Reliability |
Positive detection of intrusion | Spurious indication and lower reliability |
Energy savings and bandwidth |
Only record when motion is detected | Detect and process all movement |
Once the design has been analyzed, the next step is to conduct market research to analyze the solutions landscape, e.g. to compare products or services from vendors or manufacturers.
Sources: IEEE, 202; IEC, n.d.; IEC, 2013
Passively monitoring data using various protocol layers, actively sending queries to devices, or parsing configuration files of physical security devices, OT, IoT, and IT environments on assets, processes, and connectivity paths.
Automation of threat analysis (signature-based, specification-based, anomaly-based, flow-based, content-based, sandboxing) not only in IT but also in relevant environments, e.g. physical, IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.
Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.
The user and administrative experience, multiple deployment options, extensive integration capabilities, and affordability.
Source: Secure IT/OT Convergence, Info-Tech Research Group, 2022
Security metrics serve various functions in a security program.1 For example:
Physical security interfaces with the physical world. Thus, metrics based on risks related to safety are crucial. These metrics motivate personnel by making clear why they should care about security.
Source: EPRI, 2017
The impact of security on the business can be measured with various metrics such as operational metrics, service level agreements (SLAs), and financial metrics.
Source: BMC, 2022
Early detection leads to faster remediation and less damage. Metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability.
Source: Dark Reading, 2022
Measure the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.
Security failure can be avoided by evaluating the security systems and program. Security evaluation requires understanding what, where, when, and how to measure and to report the relevant metrics.
The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.
Hence, IT and OT need to collaborate, starting with communication to build trust and to overcome their differences and followed by negotiation on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.
Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.
Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.
Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.
This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.
"1402-2021 - IEEE Guide for Physical Security of Electric Power Substations." IEEE, 2021. Accessed 25 Jan. 2023.
"2022 State of Protective Intelligence Report." Ontic Center for Protective Intelligence, 2022. Accessed 16 Jan. 2023.
"8 Staggering Statistics: Physical Security Technology Adoption." Brivo, 2022. Accessed 5 Jan. 2023.
"America's Water Infrastructure Act of 2018." The United States' Congress, 2018. Accessed 19 Jan. 2023.
Baker, Paul and Daniel Benny. The Complete Guide to Physical Security. Auerbach Publications. 2013
Bennett, Steve. "Physical Security Statistics 2022 - Everything You Need to Know." WebinarCare, 4 Dec. 2022. Accessed 30 Dec. 2022.
"Best Practices for Planning and Managing Physical Security Resources: An Interagency Security Committee Guide." Interagency Security Committee (ISC), Dec. 2015. Accessed 23 Jan. 2023.
Black, Daniel. "Improve Security Governance With a Security Steering Committee." Info-Tech Research Group, 23 Nov. 2018. Accessed 30 Jan. 2023.
Borg, Scott. "Don't Put Up Walls Between Your Security People." FedTech Magazine, 17 Feb. 2009. Accessed 15 Dec. 2022.
Burwash, John. “Preparing for Technology Convergence in Manufacturing.” Info-Tech Research Group, 12 Dec. 2018. Accessed 7 Dec. 2022.
Carney, John. "Why Integrate Physical and Logical Security?" Cisco. Accessed 19 Jan. 2023.
"Certification of Cyber Security Skills of ICS/SCADA Professionals." European Union Agency for Cybersecurity (ENISA), 2015. Accessed 27 Sep. 2022.
Cherdantseva, Yulia and Jeremy Hilton. "Information Security and Information Assurance. The Discussion about the Meaning, Scope and Goals." Organizational, Legal, and Technological Dimensions of IS Administrator, Almeida F., Portela, I. (eds.), pp. 1204-1235. IGI Global Publishing, 2013.
Cobb, Michael. "Physical security." TechTarget. Accessed 8 Dec. 2022.
“Conduct a Drinking Water or Wastewater Utility Risk Assessment.” United States Environmental Protection Agency (EPA), n.d. Web.
Conrad, Sandi. "Create and Implement an IoT Strategy." Info-Tech Research Group, 28 July 2022. Accessed 7 Dec. 2022.
Cooksley, Mark. "The IEC 62443 Series of Standards: A Product Manufacturer's Perspective." YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.
"Cyber and physical security must validate their value in 2023." IFSEC Global, 12 Jan. 2023. Accessed 20 Jan. 2023.
"Cybersecurity Evaluation Tool (CSET®)." Cybersecurity and Infrastructure Security Agency (CISA). Accessed 23 Jan. 2023.
"Cybersecurity Maturity Model Certification (CMMC) 2.0." The United States' Department of Defense (DOD), 2021. Accessed 29 Dec. 2022.
“Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.
Czachor, Emily. "Mass power outage in North Carolina caused by gunfire, repairs could take days." CBS News, 5 Dec. 2022. Accessed 20 Jan. 2023.
Dang, Robert, et al. “Secure IT/OT Convergence.” Info-Tech Research Group, 9 Dec. 2022. Web.
"Emergency Management Act (S.C. 2007, c. 15)." The Government of Canada, 2007. Accessed 19 Jan. 2023.
"Emergency management vocabulary." Translation Bureau, Government of Canada. Accessed 19 Jan. 2023.
Fennelly, Lawrence. Effective physical security. Butterworth-Heinemann, 2013.
Ghaznavi-Zadeh, Rassoul. "Enterprise Security Architecture - A Top-down Approach." The Information Systems Audit and Control Association (ISACA). Accessed 25 Jan. 2023.
"Good Practices for Security of Internet of Things." European Union Agency for Cybersecurity (ENISA), 2018. Accessed 27 Sep. 2022.
"Health and Safety at Work etc Act 1974." The United Kingdom Parliament. Accessed 23 Jan. 2023.
Hébert, Michel, et al. “Security Priorities 2023.” Info-Tech Research Group, 1 Feb. 2023. Web.
"History and Initial Formation of Physical Security and the Origin of Authority." Office of Research Services (ORS), National Institutes of Health (NIH). March 3, 2017. Accessed 19 Jan. 2023.
"IEC 62676-1-1:2013 Video surveillance systems for use in security applications - Part 1-1: System requirements - General." International Electrotechnical Commission (IEC), 2013. Accessed 9 Dec. 2022.
"Incident Command System (ICS)." ICS Canada. Accessed 17 Jan. 2023.
"Information Security Manual - Guidelines for Physical Security." The Australian Cyber Security Centre (ACSC), Dec. 2022. Accessed 13 Jan. 2023.
"Integrated Physical Security Framework." Anixter. Accessed 8 Dec. 2022.
"Integrating Risk and Security within a TOGAF® Enterprise Architecture." TOGAF 10, The Open Group. Accessed 11 Jan. 2023.
Latham, Katherine. "The microchip implants that let you pay with your hand." BBC News, 11 Apr. 2022. Accessed 12 Jan. 2023.
Linthicum, David. "2023 could be the year of public cloud repatriation." InfoWorld, 3 Jan. 2023. Accessed 10 Jan. 2023.
Ma, Alexandra. "Thousands of people in Sweden are embedding microchips under their skin to replace ID cards." Business Insider, 14 May 2018. Accessed 12 Jan. 2023.
Mendelssohn, Josh and Dana Tessler. "Take Control of Compliance Improvement to Conquer Every Audit." Info-Tech Research Group, 25 March 2015. Accessed 27 Jan. 2023.
Meredith, Sam. "All you need to know about the Nord Stream gas leaks - and why Europe suspects 'gross sabotage'." CNBC, 11 Oct. 2022. Accessed 20 Jan. 2023.
Nicaise, Vincent. "EU NIS2 Directive: what’s changing?" Stormshield, 20 Oct. 2022. Accessed 17 Nov. 2022.
"NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations." The National Institute of Standards and Technology (NIST), 13 Jul. 2022. Accessed 27 Jan. 2023.
"North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) Series." NERC. Accessed 23 Jan. 2023.
"North America Physical Security Market - Global Forecast to 2026." MarketsandMarkets, June 2021. Accessed 30 Dec. 2022.
"NSTISSI No. 4011 National Training Standard For Information Systems Security (InfoSec) Professionals." The United States Committee on National Security Systems (CNSS), 20 Jun. 1994. Accessed 23 Jan. 2023.
"Occupational Safety and Health Administration (OSH) Act of 1970." The United States Department of Labor. Accessed 23 Jan. 2023.
Palter, Jay. "10 Mistakes Made in Designing a Physical Security Program." Real Time Networks, 7 Sep. 2022. Accessed 6 Jan. 2023.
Parker, Donn. Fighting Computer Crime. John Wiley & Sons, 1998.
Pathak, Parag. "What Is Threat Management? Common Challenges and Best Practices." Security Intelligence, 2020. Accessed 5 Jan. 2023.
Pender-Bey, Georgie. "The Parkerian Hexad." Lewis University, 2012. Accessed 24 Jan. 2023.
Philippou, Oliver. "2023 Trends to Watch: Physical Security Technologies." Omdia. Accessed 20 Jan. 2023.
Phinney, Tom. "IEC 62443: Industrial Network and System Security." ISA and Honeywell Integrated Security Technology Lab. Accessed 30 Jan. 2023.
"Physical Security Market, with COVID-19 Impact Analysis - Global Forecast to 2026." MarketsandMarkets, Jan. 2022. Accessed 30 Dec. 2022.
"Physical Security Professional (PSP)" ASIS International. Accessed 17 Jan. 2023.
"Physical Security Systems (PSS) Assessment Guide" The United States' Department of Energy (DOE), Dec. 2016. Accessed 23 Jan. 2023.
"Policies, Standards, Best Practices, Guidance, and White Papers." Interagency Security Committee (ISC). Accessed 23 Jan. 2023.
"Profiles, Add-ons and Specifications." ONVIF. Accessed 9 Dec. 2022.
"Protective Security Policy Framework (PSPF)." The Australian Attorney-General's Department (AGD). Accessed 13 Jan. 2023.
"Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.
""Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.
Satgunananthan, Niru. "Challenges in Security Convergence?" LinkedIn, 8 Jan. 2022. Accessed 20 Dec. 2022.
Sooknanan, Shastri and Isaac Kinsella. "Identify the Components of Your Cloud Security Architecture." Info-Tech Research Group, 12 March 2021. Accessed 26 Jan. 2023.
"TC 79 Alarm and electronic security systems." International Electrotechnical Commission (IEC), n.d. Accessed 9 Dec. 2022.
"The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard." Interagency Security Committee (ISC), 2021. Accessed 26 Jan. 2023.
"The Short Guide to Why Security Programs Can Fail." CyberTalk, 23 Sep. 2021. Accessed 30 Dec. 2022.
Verton, Dan. "Companies Aim to Build Security Awareness." Computerworld, 27 Nov. 2022. Accessed 26 Jan. 2023.
"Vulnerability Assessment of Federal Facilities." The United States' Department of Justice, 28 Jun. 1995. Accessed 19 Jan. 2023.
"What is IEC 61508?" 61508 Association. Accessed 23 Jan. 2023.
Wolf, Gene. "Better Include Physical Security With Cybersecurity." T&D World 5 Jan. 2023. Accessed 19 Jan. 2023.
Wood, Kate, and Isaac Kinsella. “Build an Information Security Strategy.” Info-Tech Research Group, 9 Sept. 2020. Web.
Woolf, Tim, et al. "Benefit-Cost Analysis for Utility-Facing Grid Modernization Investments: Trends, Challenges, and Considerations." Lawrence Berkeley National Laboratory, Feb. 2021. Accessed 15 Nov. 2022.
"Work Health and Safety Act 2011." The Australian Government. Accessed 13 Jan. 2023.
Wu, Jing. “Industrial Control System Modernization: Unlock the Value of Automation in Utilities.” Info-Tech Research Group, 6 April 2023. Web.
Information and Cyber Governance Manager
Platte River Power Authority
Chief Security Officer (CSO) & Founder
KLAVAN Security
IT Security Manager
4Wall Entertainment
VP of Information Technology
4Wall Entertainment
Senior Manager
March Networks Corporate
Manager of Security Engineering
Omaha Public Power District
Head of IT
Waymo
Director, Facilities Security Preparedness
Omaha Public Power District
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the benefits of DataOps and why organizations are looking to establish agile principles in their data practice, the challenges associated with doing so, and what the new DataOps strategy needs to be successful.
Analyze DataOps using Info-Tech’s DataOps use case framework, to help you identify the gaps in your data practices that need to be matured to truly realize DataOps benefits including data integration, data security, data quality, data engineering, and data science.
Mature your data practice by putting in the right people in the right roles and establishing DataOps metrics, communication plan, DataOps best practices, and data principles.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the DataOps approach and value proposition.
A clear understanding of organization data priorities and metrics along with a simplified view of data using Info-Tech’s Onion framework.
1.1 Explain DataOps approach and value proposition.
1.2 Review the common business drivers and how the organization is driving a need for DataOps.
1.3 Understand Info-Tech’s DataOps Framework.
Organization's data priorities and metrics
Data Onion framework
Assess the DataOps maturity of the organization.
Define clear understanding of organization’s DataOps capabilities.
2.1 Assess current state.
2.2 Develop target state summary.
2.3 Define DataOps improvement initiatives.
Current state summary
Target state summary
Establish clear action items and roadmap.
Define clear and measurable roadmap to mature DataOps within the organization.
3.1 Continue DataOps improvement initiatives.
3.2 Document the improvement initiatives.
3.3 Develop a roadmap for DataOps practice.
DataOps initiatives roadmap
Define a plan for continuous improvements.
Continue to improve DataOps practice.
4.1 Create target cross-functional team structures.
4.2 Define DataOps metrics for continuous monitoring.
4.3 Create a communication plan.
DataOps cross-functional team structure
DataOps metrics
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Analyze the four key benefits of blockchain as they relate to the transportation and logistics industry to understand how the technology can resolve issues being experienced by industry incumbents.
Brainstorm a set of blockchain use cases for your organization and apply design thinking tactics to evaluate and select the optimal one to pitch to your executives for prototyping.
Successful execution of business strategy requires planning that:
To accomplish this, the business architect must engage stakeholders, model the business, and drive planning with business architecture.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Build a structured, repeatable framework for both IT and business stakeholders to appraise the activities that deliver value to consumers; and assess the readiness of their capabilities to enable them.
This template helps you ensure that your business architecture practice receives the resources, visibility, and support it needs to be successful, by helping you develop a strategy to engage the key stakeholders involved.
Record the complete value stream and decompose it into stages. Add a description of the expected outcome of the value stream and metrics for each stage.
Build a business capability model for the organization and map capabilities to the selected value stream.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify and consult stakeholders to discover the business goals and value proposition for the customer.
Engage stakeholders and SMEs in describing the business and its priorities and culture.
Identify focus for the areas we will analyze and work on.
1.1 Select key stakeholders
1.2 Plan for engaging stakeholders
1.3 Gather business goals and priorities
Stakeholder roles
Engagement plan
Business strategy, value proposition
Describe the main value-adding activities of the business from the consumer’s point of view, e.g. provide product or service.
Shared understanding of why we build resources and do what we do.
Starting point for analyzing resources and investing in innovation.
2.1 Define or update value streams
2.2 Decompose selected value stream(s) into value stages and identify problematic areas and opportunities
Value streams for the enterprise
Value stages breakdown for selected value stream(s)
Describe all the capabilities that make up an organization and enable the important customer-facing activities in the value streams.
Basis for understanding what resources the organization has and their ability to support its growth and success.
3.1 Define and describe all business capabilities (Level 1)
3.2 Decompose and analyze capabilities for a selected priority value stream.
Business Capability Map (Level 1)
Business Capabilities Level 2 for selected value stream
Use the Business Capability Map to identify key capabilities (e.g. cost advantage creator), and look more closely at what applications or information or business processes are doing to support or hinder that critical capability.
Basis for developing a roadmap of IT initiatives, focused on key business capabilities and business priorities.
4.1 Identify key capabilities (cost advantage creators, competitive advantage creators)
4.2 Assess capabilities with the perspective of how well applications, business processes, or information support the capability and identify gaps
4.3 Apply analysis tool to rank initiatives
Business Capability Map with key capabilities: cost advantage creators and competitive advantage creators
Assessment of applications or business processes or information for key capabilities
Roadmap of IT initiatives
Info-Tech is a provider of best-practice IT research advisory services that make every IT leader’s job easier.
| 35,000 members sharing best practices you can leverage | Millions spent developing tools and templates annually | Leverage direct access to over 100 analysts as an extension of your team | Use our massive database of benchmarks and vendor assessments | Get up to speed in a fraction of the time |
Business architecture provides a holistic and unified view of:
Without a business architecture it is difficult to see the connections between the business’s activities for the customer and the IT resources supporting them – to demonstrate that what we do in IT is customer-driven.
As a map of your business, the business architecture is an essential input to the digital strategy:
Crystal Singh
Research Director, Data and Analytics
Info-Tech Research Group
Andrea Malick
Research Director, Data and Analytics
Info-Tech Research Group
| Your Challenge | Common Obstacles | Info-Tech’s Approach |
|
Organizations need to innovate rapidly to respond to ever-changing forces and demands in their industry. But they often fail to deliver meaningful outcomes from their IT initiatives within a reasonable time. Successful companies are transforming, i.e. adopting fluid strategies that direct their resources to customer-driven initiatives and execute more quickly on those initiatives. In a responsive and digital organization, strategies, capabilities, information, people, and technology are all aligned, so work and investment are consistently allocated to deliver maximum value. |
You don’t have a complete reference map of your organization’s capabilities on which to base strategic decisions. You don’t know how to prioritize and identify the capabilities that are essential for achieving the organization’s customer-driven objectives. You don’t have a shared enterprise vision, where everyone understands how the organization delivers value and to whom. |
Begin important business decisions with a map of your organization – a business reference architecture. Model the business in the form of architectural blueprints. Engage your stakeholders. Recognize the opportunity for mapping work, and identify and engage the right stakeholders. Drive business architecture forward to promote real value to the organization. Assess your current projects to determine if you are investing in the right capabilities. Conduct business capability assessments to identify opportunities and prioritize projects. |
Info-Tech Insight
Business architecture is the set of strategic planning techniques that connects organization strategy to execution in a manner that is accurate and traceable and promotes the efficient use of organizational resources.
| Phase | Purpose | Activity | Outcome |
| 1. | Business context: Identify organization goals, industry drivers, and regulatory requirements in consultation with business stakeholders. |
Identify forces within and outside the organization to consider when planning the focus and timing of digital growth, through conducting interviews and surveys and reviewing existing strategies. | Business value canvas, business strategy on a page, customer journey |
| 2. | Customer activities (value stream): What is the customer doing? What is our reason for being as a company? What products and services are we trying to deliver? |
Define or update value streams, e.g. purchase product from supplier, customer order, and deliver product to customer. | Value streams enterprise-wide (there may be more than one set of value streams, e.g. a medical school and community clinic) |
| Prioritize value streams: Select key value streams for deeper analysis and focus. |
Assess value streams. | Priority value streams | |
| Value stages: Break down the selected value stream into its stages. |
Define stages for selected value streams. | Selected value stream stages | |
| 3. | Business capability map, level 1 enterprise: What resources and capabilities at a high level do we have to support the value streams? |
Define or update the business capabilities that align with and support the value streams. | Business capability map, enterprise-wide capabilities level 1 |
| Business capability map, level 2 for selected area: List resources and capabilities that we have at a more detailed level. |
Define or update business capabilities for selected value stream to level 2. | Business capability map, selected value stream, capability level 2 | |
| Heatmap Business Capability Map: Flag focus areas in supporting technology, applications, data and information. |
| Day 1: Discover Business Context | Day 2: Define Value Streams | Day 3: Build Business Capability Map | Day 4: Roadmap Business Architecture | ||
|---|---|---|---|---|---|
| Phase Steps |
1.1 Collect corporate goals and strategies 1.2 Identify stakeholders |
2.1 Build or update value streams 2.2 Decompose selected value stream into value stages and analyze for opportunities |
3.1 Update business capabilities to level 1 for enterprise 3.2 For selected value streams, break down level 1 to level 2 |
3.3 Use business architecture to heatmap focus areas: technology, information, and processes 3.4 Build roadmap of future business architecture initiatives |
|
| Phase Outcomes |
|
|
|
|
| INDUSTRY VALUE CHAIN | DIGITAL TRANSFORMATION | BUSINESS ARCHITECTURE |
| A high-level analysis of how the industry creates value for the consumer as an overall end-to-end process. | The adoption of digital technologies to innovate and re-invent existing business, talent ,and operating models to drive growth, business value, and improved customer experience. | A holistic, multidimensional business view of capabilities, end-to-end value, and operating model in relation to the business strategy. |
| INDUSTRY VALUE STREAM | STRATEGIC OBJECTIVES | CAPABILITY ASSESSMENTS |
| A set of activities, tasks, and processes undertaken by a business or a business unit across the entire end-to-end business function to realize value. | A set of standard objectives that most industry players will feature in their corporate plans. | A heat-mapping effort to analyze the maturity and priority of each capability relative to the strategic priorities that they serve. |
| 1 | Understand the business context and drivers Deepen your understanding of the organization’s priorities by gathering business strategies and goals. Talking to key stakeholders will allow you to get a holistic view of the business strategy and forces shaping the strategy, e.g. economy, workforce, and compliance. |
| 2 | Define value streams; understand the value you provide Work with senior leadership to understand your customers’ experience with you and the ways your industry provides value to them. Assess the value streams for areas to explore and focus on. |
| 3 | Customize the industry business architecture;
develop business capability map
Work with business architects and enterprise architects to customize Info-Tech’s business architecture for your industry as an enterprise-wide map of the organization and its capabilities. Extend the business capability map to more detail (Level 2) for the value stream stages you select to focus on. |
Business architecture provides a framework that connects business strategy and IT strategy to project execution through a set of models that provide clarity and actionable insights. How well do you know your business?
Business architecture is:
Business architecture must be branded as a front-end planning function to be appropriately embedded in the organization’s planning process.
Brand business architecture as an early planning pre-requisite on the basis of maintaining clarity of communication and spreading an accurate awareness of how strategic decisions are being made.
As an organization moves from strategy toward execution, it is often unclear as to exactly how decisions pertaining to execution are being made, why priority is given to certain areas, and how the planning function operates.
The business architect’s primary role is to model this process and document it.
In doing so, the business architect creates a unified view as to how strategy connects to execution so it is clearly understood by all levels of the organization.
| Business Architecture | ||
|---|---|---|
| Business strategy map | Business model canvas | Value streams |
| Business capability map | Business process flows | Service portfolio |
| Data Architecture | Application Architecture | Infrastructure Architecture |
| Conceptual data model | Application portfolio catalog | Technology standards catalog |
| Logical data model | Application capability map | Technology landscape |
| Physical data model | Application communication model | Environments location model |
| Data flow diagram | Interface catalog | Platform decomposition diagram |
| Data lifecycle diagram | Application use-case diagram | Network computing / hardware diagram |
| Security Architecture | ||
| Enterprise security model | Data security model | Application security model |
The key characteristic of the business architecture is that it represents real-world aspects of a business, along with how they interact.
Many different views of an organization are typically developed. Each view is a diagram that illustrates a way of understanding the enterprise by highlighting specific information about it:
The business owns the strategy and operating model; the business architect connects all the pieces together.
| R | Business Architect (Responsible) |
| A | Business Unit Leads (Accountable) |
| C | Subject Matter Experts (Consulted) – Business Lines, Operations, Data, Technology Systems & Infrastructure Leads |
| I | Business Operators (Informed) – Process, Data, Technology Systems & Infrastructure |
Picking the right project is critical to setting the tone for business architecture work in the organization.
Consider these best practices to maintain a high level of engagement from key stakeholders throughout the process of establishing or applying business architecture.
Balance short-term cost savings with long-term benefits
Participate in project governance to facilitate compliance
Create a center of excellence to foster dialogue
It is important to understand the different value-generating activities that deliver an outcome for and from your customers.
We do this by looking at value streams, which refer to the specific set of activities an industry player undertakes to create and capture value for and from the end consumer (and so the question to ask is, how do you make money as an organization?).
Our approach helps you to strengthen and transform those value streams that generate the most value for your organization.
An organization can have more than one set of streams.
For example, an enterprise can provide both retail shopping and financial services, such as credit cards.
| Value Streams | Create or Purchase the Product | Manage Inventory | Distribute Product | Sell Product, Make Product Available to Customers |
|---|---|---|---|---|
|
|
|
|
Value streams – the activities we do to provide value to customers – require business capabilities.
Value streams are broken down further into value stages, for example, the Sell Product value stream has value stages Evaluate Options, Place Order, and Make Payment.
Think of value streams as the core operations: the reason for your organization’s being. A professional consulting organization may have a legal team but it does not brand itself as a law firm. A core value stream is providing research products and services; a business capability that supports it is legal counsel.
The stages of a value stream are usually action-oriented statements or verbs that make up the individual steps involved throughout the scope of the value stream, e.g. Place Order or Make Payment.
Each value stream should have a trigger or starting point and an end result for a client or receiver.
There should be measurable value or benefits at each stage. These are key performance indicators (KPIs). Spot problem areas in the stream.
Value streams usually fall into one of these categories:
Business capabilities are built up to allow the business to perform the activities that bring value to customers. Map capabilities to the value-add activities in the value stream. Business capabilities lie at the top layer of the business architecture:
A business capability map can be thought of as a visual representation of your organization’s business capabilities and represents a view of what your data program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Example business capability map for: Higher Education
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and represents a view of what your data program must support.
Example business capability map for: Local Government
Value streams – the activities we do to provide value to customers – require business capabilities. Value streams are broken down further into value stages.
Business capabilities are built up to allow the business to perform the activities that bring value to customers. Map capabilities to the activities in the value stage to spot opportunities and problems in delivering services and value.
Business processes fulfill capabilities. They are a step-by-step description of who is performing what to achieve a goal. Capabilities consist of networks of processes and the resources – people, technology, materials – to execute them.
Capability = Processes + Software, Infrastructure + People
Align the business objectives of your organization to your value streams (the critical actions that take place within your organization to add value to a customer).
Prioritize a value stream to transform based on the number of priorities aligned to a value stream, and/or the business value (e.g. revenue, EBITDA earnings, competitive differentiation, or cost efficiency).
Decompose the selected value stream into value stages.
Align capabilities level 1 and 2 to value stages. One capability may support several value stages in the stream.
Build a business architecture for the prioritized value stream with a map of business capabilities up to level 2.
NOTE: We can’t map all capabilities all at once: business architecture is an ongoing practice; select key mapping initiatives each year based on business goals.
Business value defines the success criteria of an organization as manifested through organizational goals and outcomes, and it is interpreted from four perspectives:
It’s never a good idea to start with a blank page.
The business capability map available from Info-Tech and with industry standard models can be used as an accelerator. Assemble the relevant stakeholders – business unit leads and product/service owners – and modify the business capability map to suit your organization’s context.
Acceleration path: Customize generic capability maps with the assistance of our industry analysts.
| Business context | Define value streams | Build business capability map |
|---|---|---|
| 1.1 Select key stakeholders 1.2 Collect and understand corporate goals |
2.1 Update or define value streams 2.2 Decompose and analyze selected value stream |
3.1 Build level 1 capability map 3.2 Build level 2 capability map 3.3 Heatmap capability map 3.4 Roadmap |
Use inputs from business goals and strategies to understand priorities.
It is not necessary to have a comprehensive business strategy document to start – with key stakeholders, the business architect should be able to gather a one-page business value canvas or customer journey.
What is business context?
“The business context encompasses an understanding of the factors impacting the business from various perspectives, including how decisions are made and what the business is ultimately trying to achieve. The business context is used by IT to identify key implications for the execution of its strategic initiatives.”
Source: Businesswire, 2018
First, as the CIO, you must engage executive stakeholders and secure their support.
Focus on key players who have high power and high interest in business architecture.
Engage the stakeholders who are impacted the most and have the power to impede the success of business architecture.
For example, if the CFO – who has the power to block funding – is disengaged, business architecture will be put at risk.
Use Info-Tech’s Stakeholder Power Map Template to help prioritize time spent with stakeholders.
A business architecture project may involve the following stakeholders:
You must identify who the stakeholders are for your business architecture work.
Think about:
Avoid these common mistakes:
1-3 hours
Build an accurate depiction of the business.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
A business strategy must articulate the long-term destination the business is moving into. This illustration shapes all the strategies and activities in every other part of the business, including what IT capabilities and resources are required to support business goals. Ultimately, the benefits of a well-defined business strategy increase as the organization scales and as business units or functions are better equipped to align the strategic planning process in a manner that reflects the complexity of the organization.
Using the Business Strategy on a Page canvas, consider the questions in each bucket to elicit the overall strategic context of the organization and uncover the right information to build your digital strategy. Interview key executives including your CEO, CIO, CMO, COO, CFO, and CRO, and review documents from your board or overall organizational strategy to uncover insights.
Info-Tech Insight
A well-articulated and clear business strategy helps different functional and business units work together and ensures that individual decisions support the overall direction of the business.
Examples business objectives:
Info-Tech Insight
CIOs are ideally positioned to be the sponsors of business architecture given that their current top priorities are digital transformation, innovation catalyzation, and business alignment.
1-3 hours
Having a clear understanding of the business is crucial to executing on the strategic IT initiatives.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
|
Vision Where do you want to go? Mission/Mandate What do you do? |
Value Streams Why are you in business? What do you do? |
Key Products & Services What are your top three to five products and services? |
Key Customer Segments Who are you trying to serve or target? |
|
Value Proposition What is the value you deliver to your customers? Future Value Proposition What is your value proposition in three to five years’ time? |
Digital Experience Aspirations How can you create a more effective value stream? |
Business Resilience Aspirations How can you reduce business risks? |
Sustainability (or ESG) Aspirations How can you deliver ESG and sustainability goals? |
|
CEO |
Core Business Goals What are the core business goals to meet business objectives? |
Top Priorities & Initiatives What are the top initiatives and priorities over the planning horizon? |
Performance Insights/Metrics What do we need to achieve? |
|
CMO |
Shared Business Goals What are the shared (operational) business goals to meet business objectives? |
Top Priorities & Initiatives What are the top initiatives and priorities over the planning horizon? |
Performance Insights/Metrics What do we need to achieve? |
|
CFO |
Enabling Business Goals What are the enabling (supporting/enterprise) business goals to meet business objectives? |
Top Priorities & Initiatives What are the top initiatives and priorities over the planning horizon? |
Performance Insights/Metrics What do we need to achieve? |
The BA practice’s supporters are potential champions who will help you market the value of BA; engage with them first to create positive momentum. Map out the concerns of each group of stakeholders so you can develop marketing tactics and communications vehicles to address them.
Example Communication Strategy
| Stakeholder Concerns | Tactics to Address Concerns | Communication Vehicles | Frequency | |
|---|---|---|---|---|
| Supporters (High Priority) |
|
|
|
Bi-Monthly |
| Indifferent (Medium Priority) |
|
|
|
Quarterly |
| Resistors (Medium Priority) |
|
|
|
Tailored to individual groups |
1-2 hours
Now that you have organized and categorized your stakeholders based on their power, influence, interest, and knowledge of business architecture, it is time to brainstorm how you are going to gain their support and participation.
Think about the following:
Avoid these common mistakes:
| Input | Output |
|---|---|
|
|
|
| Materials | Participants |
|
|
Download the Stakeholder Engagement Strategy Template for this project.
CASE STUDY
IndustrySource
Anonymous
| Situation | Complication | Result |
|---|---|---|
|
To achieve success with the business architecture initiative, the bank’s CIO needed to put together a plan to engage the right stakeholders in the process. Without the right stakeholders, the initiative would suffer from inadequate information and thus would run the risk of delivering an ineffective solution. |
The bank’s culture was resistant to change and each business unit had its own understanding of the business strategy. This was a big part of the problem that led to decreasing customer satisfaction. The CIO needed a unified vision for the business architecture practice involving people, process, and technology that all stakeholders could support. |
Starting with enlisting executive support in the form of a business sponsor, the CIO identified the rest of the key stakeholders, in this case, the business unit heads, who were necessary to engage for the initiative. Once identified, the CIO promoted the benefits of business architecture to each of the business unit heads while taking stock of their individual needs. |
1 hour
Using your stakeholder power map as a starting point, focus on the three most important quadrants: those that contain stakeholders you must keep informed, those to keep satisfied, and the key players.
Plot the stakeholders from those quadrants on a stakeholder engagement map.
Think about the following:
Avoid these common mistakes:
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Stakeholder Engagement Strategy Template for this project.
1-2 hours
Now that you have organized and categorized your stakeholders based on their power, influence, interest, and knowledge of business architecture, it is time to brainstorm how you are going to gain their support and participation.
Think about the following:
Avoid these common mistakes:
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Stakeholder Engagement Strategy Template for this project.
| Business context | Define value streams | Build business capability map |
|---|---|---|
|
1.1 Select key stakeholders |
2.1 Update or define value streams |
3.1 Build Level 1 capability map |
This phase will walk you through the following activities:
This phase involves the following participants:
Value streams connect business goals to organization’s value realization activities. They enable an organization to create and capture value in the market place by engaging in a set of interconnected activities.
There are several key questions to ask when endeavoring to identify value streams.
| Key Questions |
|---|
|
| Value Streams | Create or Purchase Product | Manage Inventory | Distribute Product | Sell Product |
|
|
|
|
Value streams – the activities we do to provide value to customers – require business capabilities.
Value streams are broken down further into value stages, for example, Sell Product value stream has value stages Evaluate Options, Place Order, and Make Payment.
Think of value streams as the core operations, the reason for our organization’s being. A professional consulting organization may have a legal team but it does not brand itself as a law firm. A core value stream is providing research products and services – a business capability that supports it is legal counsel.
1-3 hours
Unify the organization’s perspective on how it creates value.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
See your Info-Tech Account Representative for access to the Reference Architecture Template
The stages of a value stream are usually action-oriented statements or verbs that make up the individual steps involved throughout the scope of the value stream, e.g. Place Order or Make Payment.
Each value stream should have a trigger or starting point and an end result for a client or receiver.
There should be measurable value or benefits at each stage.
These are key performance indicators (KPIs).
Spot problem areas in the stream.
Value streams usually fall into one of these categories:
Customer Acquisitions
Identify Prospects > Contact Prospects > Verify Interests
Sell Product
Identify Options > Evaluate Options > Negotiate Price and Delivery Date > Place Order > Get Invoice > Make Payment
Product Delivery
Confirm Order > Plan Load > Receive Warehouse > Fill Order > Ship Order > Deliver Order > Invoice Customer
Product Financing
Initiate Loan Application > Decide on Application > Submit Documents > Review & Satisfy T&C > Finalize Documents > Conduct Funding > Conduct Funding Audits
Product Release
Ideate > Design > Build > Release
Sell Product is a value stream, made up of value stages Identify options, Evaluate options, and so on.
1-3 hours
Once we have a good understanding of our value streams, we need to decide which ones to focus on for deeper analysis and modeling, e.g. extend the business architecture to more detailed level 2 capabilities.
Organization has goals and delivers products or services.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
The first step of creating a value stream is defining it.
The second step is the value stream mapping.
Title
Scope
Objectives
Example Value Streams List
| Title | Scope | Objectives |
| Sell Product | From option identification to payment | Revenue Growth |
| … | … | … |
| … | … | … |
| A Decompose the Value Stream Into Stages | B Add the Customer Perspective |
|
|
| C Add the Expected Outcome | D Define the Entry and Exit Criteria |
|
|
| E Outline the Metrics | F Assess the Stages |
|
|
The first step in creating a value stream map is breaking it up into its component stages.
The stages of a value stream are usually action-oriented statements or verbs that make up the individual steps involved throughout the scope of the value stream.
The Benefit
Segmenting your value stream into individual stages will give you a better understanding of the steps involved in creating value.
The Benefit
Adding the customer’s perspective will inform you of their priorities at each stage of the value stream.
The Benefit
Understanding the organization’s desired outcome at each stage of the value stream will help set objectives and establish metrics.
The Benefit
Establishing the entry and exit criteria for each stage will help you understand how the customer experience flows from one end of the stream to the other.
The Benefit
Setting metrics for each stage will facilitate the tracking of success and inform the business architecture practitioner of where investments should be made.
To determine which specific business capabilities you should seek to assess and potentially refine, you must review performance toward target metrics at each stage of the value stream.
Stages that are not performing to their targets should be examined further by assessing the capabilities that enable them.
| Value Stage | Metric Description | Metric Target | Current Measure | Meets Objective? |
| Evaluate Options | Number of Product Demonstrations | 12,000/month | 9,000/month | No |
| Identify Options | Google Searches | 100K/month | 100K/month | Yes |
| Identify Options | Product Mentions | 1M/month | 1M/month | Yes |
| … | Website Traffic (Hits) | … | … | … |
| Average Deal Size | ||||
| Number of Deals | ||||
| Time to Complete an Order | ||||
| Percentage of Invoices Without Error | ||||
| Average Time to Acquire Payment in Full |
Sell Product
Identify Options > Evaluate Options > Negotiate Price and Delivery Date > Place Order > Get Invoice > Make Payment
The value stage(s) that doesn’t meet its objective metrics should be examined further.
Info-Tech Insight
In the absence of tangible metrics, you will have to make a qualitative judgement about which stage(s) of the value stream warrant further examination for problems and opportunities.
| Business context | Define value streams | Build business capability map |
|---|---|---|
| 1.1 Select key stakeholders 1.2 Collect and understand corporate goals |
2.1 Update or define value streams 2.2 Decompose and analyze selected value stream |
3.1 Build Level 1 capability map 3.2 Build Level 2 capability map 3.3 Heatmap capability map 3.4 Roadmap |
This step will walk you through the following activities:
This step involves the following participants:
Outcomes of this step
The Business Capability Map is the primary visual representation of the organization’s key abilities or services that are delivered to stakeholders. This model forms the basis of strategic planning discussions.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and represents a view of what your data program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Example business capability map for: Higher Education
A business capability map can be thought of as a visual representation of your organization’s business capabilities and represents a view of what your data program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Example business capability map for: Local Government
Source: Lambert, “Practical Guide to Agile Strategy Execution”
1-3 hours
Ensure you engage with the right stakeholders:
Don’t waste your efforts building an inaccurate depiction of the business: The exercise of identifying capabilities for an organization is very introspective and requires deep analysis.
It is challenging to develop a common language that everyone will understand and be able to apply. Invest in the time to ensure the right stakeholders are brought into the fold and bring their business area expertise and understanding to the table.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Align the innovation goals and business objectives of your organization to your value streams (the critical actions that take place within your organization to add value to a customer).
Prioritize a value stream to transform based on the number of priorities aligned to a value stream and/or the business value (e.g. revenue, EBITDA earnings, competitive differentiation, or cost efficiency).
Working alongside a business or enterprise architect, build a reference architecture for the prioritized value stream up to level 2.
Info-Tech Insight
To produce maximum impact, focus on value streams that provide two-thirds of your enterprise value (EBITDA earnings).
1-3 hours
It is only at level 2 and further that we can pinpoint the business capabilities – the exact resources, whether applications or data or processes – that we need to focus on to realize improvements in the organization’s performance and customer experience.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download: See your Account Representative for access to Info-Tech’s Reference Architecture Template
1-3 hours
Determine the organization’s key capabilities.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download: See your Account Representative for access to Info-Tech’s Reference Architecture Template
Note: Illustrative Example
Note: Illustrative Example
Note: Illustrative Example
Note: Illustrative Example
Note: Illustrative Example
| MoSCoW Rank | IT Implication | Value Stream Impacted | Comments/Actions |
|---|---|---|---|
| M | [Implication] | [Value Stream] | |
| M | [Implication] | [Value Stream] | |
| M | [Implication] | [Value Stream] | |
| S | [Implication] | [Value Stream] | |
| S | [Implication] | [Value Stream] | |
| S | [Implication] | [Value Stream] | |
| C | [Implication] | [Value Stream] | |
| C | [Implication] | [Value Stream] | |
| C | [Implication] | [Value Stream] | |
| W | [Implication] | [Value Stream] | |
| W | [Implication] | [Value Stream] | |
| W | [Implication] | [Value Stream] |
1-3 hours
Unify the organization’s perspective on how it creates value.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download: See your Account Representative for access to Info-Tech’s Reference Architecture Template
| Enterprise Architecture Domain | Architectural View | Selection |
|---|---|---|
| Business Architecture | Business strategy map | Required |
| Business Architecture | Business model canvas | Optional |
| Business Architecture | Value streams | Required |
| Business Architecture | Business capability map | Not Used |
| Business Architecture | Business process flows | |
| Business Architecture | Service portfolio | |
| Data Architecture | Conceptual data model | |
| Data Architecture | Logical data model | |
| Data Architecture | Physical data model | |
| Data Architecture | Data flow diagram | |
| Data Architecture | Data lineage diagram |
The Industry Business Reference Architecture Template for your industry is a place for you to collect all of the activity outputs and outcomes you’ve completed for use in next-steps.
Download the Industry Business Reference Architecture Template for your industry
| DIY Toolkit | Guided Implementation | Workshop | Consulting |
|---|---|---|---|
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Diagnostics and consistent frameworks are used throughout all four options
| Name | Role | Organization |
| Ibrahim Abdel-Kader | Research Analyst, Data & Analytics | Info-Tech Research Group |
| Ben Abrishami-Shirazi | Technical Counselor, Enterprise Architecture | Info-Tech Research Group |
| Andrew Bailey | Consulting, Manager | Info-Tech Research Group |
| Dana Dahar | Research & Advisory Director, CIO / Digital Business Strategy | Info-Tech Research Group |
| Larry Fretz | VP | Info-Tech Research Group |
| Shibly Hamidur | Enterprise Architect | Toronto Transit Commission (TTC) |
| Rahul Jaiswal | Principal Research Director, Industry | Info-Tech Research Group |
| John Kemp | Executive Counselor, Executive Services | Info-Tech Research Group |
| Gerald Khoury | Senior Executive Advisor | Info-Tech Research Group |
| Igor Ikonnikov | Principal Advisory Director, Data & Analytics | Info-Tech Research Group |
| Daniel Lambert | VP | Benchmark Consulting |
| Milena Litoiu | Principal Research Director, Enterprise Architecture | Info-Tech Research Group |
| Andy Neill | AVP Data & Analytics, Chief Enterprise Architect | Info-Tech Research Group |
| Rajesh Parab | Research Director, Data & Analytics | Info-Tech Research Group |
| Rick Pittman | VP, Research | Info-Tech Research Group |
| Irina Sedenko | Research Director, Data & Analytics | Info-Tech Research Group |
Andriole, Steve. “Why No One Understands Enterprise Architecture & Why Technology Abstractions Always Fail.” Forbes, 18 September 2020. Web.
“APQC Process Classification Framework (PCF) – Retail.” American Productivity & Quality Center, 9 January 2019. Web.
Brose, Cari. “Who’s on First? Architecture Roles and Responsibilities in SAFe.” Business Architecture Guild, 9 March 2017. Web.
Burlton, Roger, Jim Ryne, and Daniel St. George. “Value Streams and Business Processes: The Business Architecture Perspective.” Business Architecture Guild, December 2019. Web.
“Business Architecture: An overview of the business architecture professional.” Capstera, 5 January 2022. Web.
Business Architecture Guild. “What is Business Architecture?” Business Analyst Mentor, 18 November 2022. Web.
“Business Architecture Overview.” The Business Architecture Working Group of the Object Management Group (OMG), n.d. Web.
“Delivering on your strategic vision.” The Business Architecture Guild, n.d. Web.
Ecker, Grant. “Deploying business architecture.” LinkedIn, 11 November 2021. (Presentation)
IRIS. “Retail Business Architecture Framework and Examples.” IRIS Business Architect, n.d. Web.
IRIS. “What Is Business Architecture?” IRIS Business Architect, 8 May 2014. Web.
IRIS. “Your Enterprise Architecture Practice Maturity 2021 Assessment.” IRIS Business Architect, 17 May 2021. Web.
Khuen, Whynde. “How Business Architecture Breaks Down and Bridges Silos.” Biz Arch Mastery, January 2020. Web.
Lambert, Daniel. “Practical Guide to Agile Strategy Execution.” 18 February 2020.
Lankhorst, Marc, and Bernd Ihnen. “Mapping the BIZBOK Metamodel to the ArchiMate Language.” Bizzdesign, 2 September 2021. Web.
Ramias, Alan, and Andrew Spanyi, “Demystifying the Relationship Between Processes and Capabilities: A Modest Proposal.” BPTrends, 2 February 2015. Web.
Newman, Daniel. “NRF 2022: 4 Key Trends From This Year’s Big Show.” Forbes, 20 January 2022. Web.
Research and Markets. “Define the Business Context Needed to Complete Strategic IT Initiatives: 2018 Blueprint.” Business Wire, 1 February 2018. Web.
Sabanoglu, Tugba. “Retail market worldwide - Statistics & Facts.” Statista, 21 April 2022. Web.
Spacey, John. “Capability vs Process.” Simplicable, 18 November 2016. Web.
“The Definitive Guide to Business Capabilities.” LeanIX, n.d. Web.
TOGAF 9. Version 9.1. The Open Group, 2011. Web.
“What is Business Architecture?” STA Group, 2017. PDF.
Whittie, Ralph. “The Business Architecture, Value Streams and Value Chains.” BA Institute, n.d. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This phase helps the VMI stay focused and aligned by reviewing existing materials, updating the existing maturity assessment, and ensuring that the foundational elements of the VMI are up to date. The main outcomes from this phase are a current maturity assessment and updated or revised Plan documents.
This phase helps you configure, create, and understand the tools and templates used to elevate the VMI. The main outcomes from this phase are a clear understanding of the tools that identify which vendors are important to you, tools and concepts to help you take key vendor relationships to the next level, and tools to help you evaluate and improve the VMI and its personnel.
This phase helps you begin integrating the new tools and templates into the VMI’s operations. The main outcomes from this phase are guidance and the steps required to continue your VMI’s maturation and evolution.
This phase helps the VMI stay aligned with the overall organization, stay current, and improve its strategic value as it evolves. The main outcomes from this phase are ways to advance the VMI’s strategic impact.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Review existing tools and templates and configure new tools and templates.
Updated Maturity Assessment and configured tools and templates.
1.1 Existing Plan document review and new maturity assessment.
1.2 Optional classification models.
1.3 Customer positioning model.
1.4 Two-way scorecards.
Updated Plan documents.
New maturity assessment.
Configured classification model.
Customer positioning for top five vendors.
Configured scorecard and feedback form.
Configure VMI Tools and Templates.
Configured Tools and Templates for the VMI.
2.1 Performance improvement plans (PIPs).
2.2 Relationship improvement plans (RIPs).
2.3 Vendor-at-a-Glance reports.
2.4 VMI Personnel Competency Evaluation Tool.
Configured Performance Improvement Plan.
Configured Relationship Assessment and Relationship Improvement Plan.
Configured 60-Second Report and completed Vendor Calendar for one vendor.
Configured VMI Personnel Competency Evaluation Tool.
Continue configuring VMI Tools and Templates and enhancing VM competencies.
Configured Tools and Templates for the VMI and market intelligence to gather.
3.1 Internal feedback tool.
3.2 VMI ROI calculation.
3.3 Vendor recognition program.
3.4 Assess the Relationship Landscape.
3.5 Gather market intelligence.
3.6 Improve professional skills.
Configured Internal Feedback Tool.
General framework for a vendor recognition program.
Completed Relationship Landscape Assessment (representative sample).
List of market intelligence to gather for top five vendors.
Improve the VMI’s brand awareness and impact on the organization; continue to maintain alignment with the overall organization.
Raising the organization’s awareness of the VMI, and ensuring the VMI Is becoming more strategic.
4.1 Expand professional knowledge.
4.2 Create brand awareness.
4.3 Investigate potential alliances.
4.4 Continue increasing the VMI’s strategic value.
4.5 Review and update (governances, policies and procedures, lessons learned, internal alignment, and leading practices).
Branding plan for the VMI.
Branding plan for individual VMI team members.
EXECUTIVE BRIEF
|
By the time you start using this blueprint, you should have established a solid foundation for your vendor management initiative (VMI) and implemented many or all of the principles outlined in Info-Tech’s blueprint Jump Start Your Vendor Management (the Jump Start blueprint). This blueprint (the Elevate blueprint) is meant to continue the evolutionary or maturation process of your VMI. Many of the items presented here will build on and refer to the elements from the Jump Start blueprint. The goal of the Elevate blueprint is to assist in the migration of your VMI from transactional to strategic. Why? Simply put, the more strategic the VMI, the more value it adds and the more impact it has on the organization as a whole. While the day-to-day, transactional aspect of running a VMI will never go away, getting stuck in transactional mode is a horrible place for the VMI and its team members:
To prevent these tragic things from happening, transform the VMI into a strategic contributor and partner internally. This Elevate blueprint provides a roadmap and guidance to get your journey started. Focus on expanding your understanding of customer/vendor dynamics, improving the skills, competencies, and knowledge of the VMI’s team members, contributing value beyond the savings aspect, and building a solid brand internally and with your vendors. This requires a conscious effort and a proactive approach to vendor management…not to mention treating your internal “clients” with respect and providing great customer service. At the end of the day, ask yourself one question: If your internal clients had to pay for your services, would they? If you can answer yes, you are well on your way to being strategic. If not, you still have some work to do. Long live the strategic VMI! |
|
Phil Bode |
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|
Each year, IT organizations “outsource” tasks, activities, functions, and other items. During 2021:
This leads to more spend, less control, and more risk for IT organizations. Managing this becomes a higher priority for IT, but many IT organizations are ill-equipped to do this proactively. |
As new contracts are negotiated and existing contracts are renegotiated or renewed, there is a perception that the contracts will yield certain results, output, performance, solutions, or outcomes. The hope is that these will provide a measurable expected value to IT and the organization. Often, much of the expected value is never realized. Many organizations don’t have a VMI to help:
|
Vendor Management is a proactive, cross-functional lifecycle. It can be broken down into four phases:
The Info-Tech process addresses all four phases and provides a step-by-step approach to configure and operate your VMI. The content in this blueprint helps you and the VMI evolve to add value and impact to the organization that was started with the Info-Tech blueprint Jump Start Your VMI. |
The VMI must continue to mature and evolve, or it will languish, atrophy, and possibly be disbanded.
Spend on managed service providers and as-a-service providers continues to increase. In addition, IT services vendors continue to be active in the mergers and acquisitions arena. This increases the need for a VMI to help with the changing IT vendor landscape.
|
38% 2021 |
16% 2021 |
47% 2021 |
|
Spend on As-a-Service Providers |
Spend on Managed Services Providers |
IT Services Merger & Acquisition Growth (Transactions) |
When organizations execute, renew, or renegotiate a contract, there is an “expected value” associated with that contract. Without a robust VMI, most of the expected value will never be realized. With a robust VMI, the realized value significantly exceeds the expected value during the contract term.
A sound, cyclical approach to vendor management will help ensure your VMI meets your needs and stays in alignment with your organization as they both change (i.e. mature and evolve).
|
Phase 1 - Plan |
Phase 2 - Build |
Phase 3 - Run |
Phase 4 – Review |
|
|---|---|---|---|---|
|
Phase Steps |
1.1 Review and Update Existing Plan Materials |
2.1 Vendor Classification Models 2.2 Customer Positioning Model 2.3 Two-Way Scorecards 2.4 Performance Improvement Plan (PIP) 2.5 Relationship Improvement Plan (RIP) 2.6 Vendor-at-a-Glance Reports 2.7 VMI Personnel Competency Evaluation Tool 2.8 Internal Feedback Tool 2.9 VMI ROI Calculation 2.10 Vendor Recognition Program |
3.1 Classify Vendors & Identify Customer Position 3.2 Assess the Relationship Landscape 3.3 Leverage Two-Way Scorecards 3.4 Implement PIPs and RIPs 3.5 Gather Market Intelligence 3.6 Generate Vendor-at-a-Glance Reports 3.7 Evaluate VMI Personnel 3.8 Improve Professional Skills 3.9 Expand Professional Knowledge 3.10 Create Brand Awareness 3.11 Survey Internal Clients 3.12 Calculate VMI ROI 3.13 Implement Vendor Recognition Program |
4.1 Investigate Potential Alliances 4.2 Continue Increasing the VMI’s Strategic Value 4.3 Review and Update |
|
Phase Outcomes |
This phase helps the VMI stay focused and aligned by reviewing existing materials, updating the existing maturity assessment, and ensuring that the foundational elements of the VMI are up-to-date. |
This phase helps you configure, create, and understand the tools and templates used to elevate the VMI. |
This phase helps you begin integrating the new tools and templates into the VMI’s operations. |
This phase helps the VMI stay aligned with the overall organization, stay current, and improve its strategic value as it evolves. |
|
Insight 1 |
An organization’s vendor management initiative must continue to evolve and mature to reach its full strategic value. In the early stages, the vendor management initiative may be seen as transactional, focusing on the day-to-day functions associated with vendor management. The real value of a VMI comes from becoming strategic partner to other functional groups (departments) within your organization. |
|---|---|
|
Insight 2 |
Developing vendor management personnel is critical to the vendor management initiative’s evolution and maturation. For the VMI to mature, its personnel must mature as well. Their professional skills, competencies, and knowledge must increase over time. Failure to accentuate personal growth within the team limits what the team can achieve and how the team is perceived. |
|
Insight 3 |
Vendor management is not about imposing your will on vendors; it is about understanding the multifaceted dynamics between your organization and your vendors and charting the appropriate path forward. Resource allocation and relationship expectations flow from these dynamics. Each critical vendor requires an individual plan to build the best possible relationship and to leverage that relationship. What works with one vendor may not work or even be possible with another vendor – even if both vendors are critical to your success. |
The four phases of maturing and evolving your vendor management initiative are supported with configurable tools, templates, and checklists to help you stay aligned internally and achieve your goals.
VMI Tools and Templates
Continue building your foundation for your VMI and configure tools and templates to help you manage your vendor relationships.
Info-Tech’s
A suite of tools and templates to help you upgrade and evolve your vendor management initiative.
|
IT Benefits |
Business Benefits |
|---|---|
|
|
|
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
|---|---|---|---|
| “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” | “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” | “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” | “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.” |
| Phase 1 | Phases 2 and 3 | Phase 4 | |
|---|---|---|---|
|
Call #1: Review status of existing plan materials. Call #2: Conduct a new maturity assessment. |
Call #3: Review optional classification models. Call #4: Determine customer positioning for top vendors. Call #5: Configure vendor Scorecards and vendor feedback forms. Call #6: Discuss PIPs, RIPs, and vendor-at-a-glance reports. |
Call #7: VMI personnel competency evaluation tool. Call #8: Create internal feedback tool and discuss ROI. Call #9: Identify vendor recognition program attributes and assess the relationship landscape. Call #10: Gather market intelligence and create brand awareness. |
Call #11: Identify potential vendor alliances, review the components of a strategic VMI, and discuss the continuous improvement loop. |
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between 6 to 12 calls over the course of 3 to 6 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
|
Day 1 |
Day 2 |
Day 3 |
Day 4 |
|
|---|---|---|---|---|
|
Plan/Build Run |
Build/Run |
Build/Run |
Run/Review |
|
|
Activities |
1.1 Existing Plan document review and new maturity assessment. 1.2 Optional classification models. 1.3 Customer positioning model. 1.4 Two-way scorecards. |
2.1 Performance improvement plans (PIPs). 2.2 Relationship improvement plans (RIPs). 2.3 Vendor-at-a-glance reports. 2.4 VMI personnel competency evaluation tool. |
3.1 Internal feedback tool. 3.2 VMI ROI calculation. 3.3 Vendor recognition program. 3.4 Assess the relationship landscape. 3.5 Gather market intelligence. 3.6 Improve professional skills. |
4.1 Expand professional knowledge. 4.2 Create brand awareness. 4.3 Investigate potential alliances. 4.4 Continue increasing the VMI’s strategic value. 4.5 Review and update (governances, policies and procedures, lessons learned, internal alignment, and leading practices). |
|
Deliverables |
|
|
|
|
Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
| 1.1 Review and update existing Plan materials | 2.1 Vendor classification models 2.2 Customer positioning model 2.3 Two-way scorecards 2.4 Performance improvement plan (PIP) 2.5 Relationship improvement plan (RIP) 2.6 Vendor-at-a-glance reports 2.7 VMI personnel competency evaluation tool 2.8 Internal feedback tool 2.9 VMI ROI calculation 2.10 Vendor recognition program | 3.1 Classify vendors and identify customer position 3.2 Assess the relationship landscape 3.3 Leverage two-way scorecards 3.4 Implement PIPs and RIPs 3.5 Gather market intelligence 3.6 Generate vendor-at-a-glance reports 3.7 Evaluate VMI personnel 3.8 Improve professional skills 3.9 Expand professional knowledge 3.10 Create brand awareness 3.11 Survey internal clients 3.12 Calculate VMI ROI 3.13 Implement vendor recognition program | 4.1 Investigate potential alliances 4.2 Continue increasing the VMI’s strategic value 4.3 Review and update |
This phase will walk you through the following activities:
This phase helps the VMI stay focused and aligned by reviewing existing materials, updating the existing maturity assessment, and ensuring that the foundational elements of the VMI are up-to-date. The main outcomes from this phase are a current maturity assessment and updated or revised Plan documents.
This phase involves the following participants:
Phase 1 – Plan revisits the foundational elements from the Info-Tech blueprint Jump Start Your Vendor Management Initiative. As the VMI continues to operate and mature, looking backward periodically provides a new perspective and helps the VMI move forward:
Keep an eye on the past as you begin looking toward the future.
At this point, the basic framework for your VMI should be in place. However, now is a good time to correct any oversights in your foundational elements. Have you:
If any of these elements is missing, revisit the Info-Tech blueprint Jump Start Your Vendor Management Initiative to complete these components. If they exist, review them and make any required modifications.
Download the Info-Tech blueprint Jump Start Your Vendor Management Initiative
1 – 6 Hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech blueprint Jump Start Your Vendor Management Initiative
Download the Jump - Phase 1 Tools and Templates Compendium
Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
| 1.1 Review and update existing Plan materials | 2.1 Vendor classification models 2.2 Customer positioning model 2.3 Two-way scorecards 2.4 Performance improvement plan (PIP) 2.5 Relationship improvement plan (RIP) 2.6 Vendor-at-a-glance reports 2.7 VMI personnel competency evaluation tool 2.8 Internal feedback tool 2.9 VMI ROI calculation 2.10 Vendor recognition program | 3.1 Classify vendors and identify customer position 3.2 Assess the relationship landscape 3.3 Leverage two-way scorecards 3.4 Implement PIPs and RIPs 3.5 Gather market intelligence 3.6 Generate vendor-at-a-glance reports 3.7 Evaluate VMI personnel 3.8 Improve professional skills 3.9 Expand professional knowledge 3.10 Create brand awareness 3.11 Survey internal clients 3.12 Calculate VMI ROI 3.13 Implement vendor recognition program | 4.1 Investigate potential alliances 4.2 Continue increasing the VMI’s strategic value 4.3 Review and update |
This phase will walk you through the following activities:
This phase helps you configure, create, and understand the tools and templates used to elevate the VMI. The main outcomes from this phase are a clear understanding of the tools that identify which vendors are important to you, tools and concepts to help you take key vendor relationships to the next level, and tools to help you evaluate and improve the VMI and its personnel.
This phase involves the following participants:
Phase 2 – Build is similar to its counterpart in the Info-Tech blueprint Jump Start Your Vendor Management Initiative; this phase focuses on tools, templates, and concepts that help the VMI increase its strategic value and impact. The items referenced in this phase will require your customization or configuration to integrate them within your organization and culture for maximum effect.
One goal of this phase is to provide new ways of looking at things and alternate approaches. (For example, two methods of classifying your vendors are presented for your consideration.) You don’t live in a one-size-fits-all world, and options allow you (or force you) to evaluate what’s possible rather than running with the herd. As you review this phase, keep in mind that some of the concepts presented may not be applicable in your environment…or it may be that they just aren’t applicable right now. Timing, evolution, and maturity will always be factors in how the VMI operates.
Another goal of this phase is to get you thinking about the value the VMI brings to the organization, and just as important, how to capture and report it. Money alone may be at the forefront of most people’s minds when return on investment is brought up, but there are many ways to measure a VMI’s value and impact. This Phase will help you in your pursuit.
Lastly, a VMI must focus on its internal clients, and that starts with the VMI’s personnel. The VMI is a reflection of its team members – what they do, say, and know will determine how the VMI is perceived…and used.
The classification model in the Info-Tech blueprint Jump Start Your Vendor Management Initiative is simple and easy to use. It provides satisfactory results for the first one or two years of the VMI’s life. After that, a more sophisticated model should be used, one with more parameters or flexibility to accommodate the VMI’s new maturity.
Two models are presented on the following pages. The first is a variation of the COST model used in the Jump Start Your Vendor Management Initiative blueprint. The second is the MVP model, which segments vendors into three categories instead of four and eliminates the 50/50 allocation constraint inherent in a 2x2 model.
|
If you used the COST classification model in the Jump Start Your Vendor Management Initiative blueprint, you are familiar with its framework: vendors are plotted into a 2x2 matrix based on their spend and switching costs and their value to your operation. The simple variation of this model uses three variables to assess the vendor’s value to your operation and two variables to determine the vendor’s spend and switching cost implications. The COST classification model presented here sticks to the same basic tenets but adds to the number of variables used to plot a vendor’s position within the matrix. Six variables are used to define a vendor’s value and three variables are used to set the spend and switching cost. This provides greater latitude in identifying what makes a vendor important to you. |
|
Another option for classifying vendors is the MVP classification model. In this model, vendors fall into one of three categories: minor, valued, or principal. Similar to the COST vendor classification model, the MVP classification model requires a user to evaluate statements or questions to assess a vendor’s importance to the organization. In the MVP approach, each question/statement is weighted, and the potential responses to each question/statement are assigned points (100, 33, or 10) based on their impact. Multiplying the weight (expressed as a percentage) for each question/statement by the response points for each question/statement yields a line-item score. The total number of points obtained by a vendor determines its classification category. A vendor receiving a score of 75 or greater would be a principal vendor (similar to a strategic vendor under the COST model); 55 to 74 points would be a valued vendor (similar to operational or tactical vendor); less than 55 points would be a minor vendor (similar to a commodity vendor). |
By now, you may be asking yourself, “Which model should I use? What is the advantage of the MVP model?” Great questions! Both models work well, but the COST model has a limitation inherent in any basic 2x2 model. Since two axes are used in a 2x2 approach, the effective weighting for each axis is 50%. As a result, the weights assigned to an individual element are reduced by 50%. A simple but extreme example will help clarify this issue (hopefully).
Suppose you wanted to use an element such as How integrated with our business processes are the vendor's products/services? and weighted it 100%. Under the 2x2 matrix approach, this element only moves the X-axis score; it has no impact on the Y-axis score. The vendor in this hypothetical could max out the X-axis under the COST model, but additional elements would be needed for the vendor to rise from the tactical quadrant to the strategic quadrant. In the MVP model, if the vendor maxed out the score on that one element (at 100%), the vendor would be at the top of the pyramid and would be a principal vendor.
One model is not necessarily better than the other. Both provide an objective way for you to determine the importance of your vendors. However, if you are using elements that don’t fit neatly into the two axes of the COST model, consider using the MVP model. Play with each and see which one works best in your environment, knowing you can always switch at a later point.
15 – 45 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate - COST Model Vendor Classification Tool
15 – 45 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – MVP Model Vendor Classification Tool
|
Now that you have configured your choice of vendor classification model (or decided to stick with your original model), it’s time to think about the other side of the coin: How do your vendors view your organization. Why is this important? Because the VMI will have only limited success if you are trying to impose your will on your vendors without regard for how they view the relationship from their perspective. For example, if the vendor is one of your strategic (COST Model) or principal (MVP Model) vendors, but you don’t spend much money with them, you are difficult to work with, and there is no opportunity for future growth, you may have a difficult time getting the vendor to show up for BAMs (business alignment meetings), caring about scorecards, or caring about the relationship period. Our experience at Info-Tech interacting with our members through vendor management workshops, guided implementations, and advisory calls has led us to a significant conclusion on this topic: Most customers tend to overvalue their importance to their vendors. To open your eyes about how your vendors actually view your account, use Info-Tech’s OPEN Model Customer Positioning Tool. (It is based on the supplier preferencing model pioneered by Steele & Court in 1996 in which the standard 2x2 matrix tool for procurement [and eventually vendor management] was repurposed to provide insights from the vendor’s perspective.) For our purposes, think of the OPEN model for customer positioning as a mirror’s reflection of the COST model for vendor classification. The OPEN model provides a more objective way to determine your importance to your vendors. Ultimately, your relationship with each vendor will be plotted into the 2x2 grid, and it will indicate whether your account is viewed as an opportunity, preferred, exploitable, or negligible. |
|
As with the vendor classification models discussed in Step 2.1, the two-way scorecards presented here are an extension of the scorecard and feedback material from the Jump Start Your Vendor Management Initiative blueprint. The vendor scorecard in this blueprint provides additional flexibility and sophistication for your scorecarding approach by allowing the individual variables (or evidence indicators) within each measurement category to be evaluated and weighted. (The prior version only allowed the evaluation and weighting at the category level.) On the vendor feedback side, the next evolution is to formalize the feedback and document it in its own scorecard format rather than continuing to list questions in the BAM agenda. The vendor feedback template included with this blueprint provides a sample approach to quantifying the vendor’s feedback and tracking the information. The fundamentals of scorecarding remain the same:
|
15 – 60 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
15 – 60 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
It is not uncommon to see performance dips from even the best vendors. However, when poor performance becomes a trend, the vendor manager can work with the vendor to create and implement a performance improvement plan (PIP).
Performance issues can come from a variety of sources:
PIPs should focus on at least a few key areas:
PIPs are most effective when the vendor is an operational, strategic, or tactical vendor (COST model) or a principal or valued vendor (MVP model) and when you are an opportunity or preferred customer (OPEN model).
15 – 30 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
Relationships are often taken for granted, and many faulty assumptions are made by both parties in the relationship: good relationships will stay good, bad relationships will stay bad, and relationships don’t require any work. In the vendor management space, these assumptions can derail the entire VMI and diminish the value added to your organization by vendors.
To complicate matters, relationships are multi-faceted. They can occur:
Improving or maintaining a relationship will not happen by accident. There must be a concerted effort to achieve the desired results (or get as close as possible). A relationship improvement plan can be used to improve or maintain a relationship with the vendor and the individuals who make up the vendor’s organization.
Improving relationships (or even maintaining them) requires a plan. The first step is to understand the current situation: Is the relationship good, bad, or somewhere in between? While the analysis will be somewhat subjective, it can be made more objective than merely thinking about relationships emotionally or intuitively. Relationships can be assessed based on the presence and quality of certain traits, factors, and elements. For example, you may think communication is important in a relationship. However, that is too abstract and subjective; to be more objective, you would need to identify the indicators or qualities of good communication. For a vendor relationship, they might include (but wouldn’t necessarily be limited to):
Evaluating these statements on a predefined and consistent scale establishes the baseline necessary to conduct a gap analysis. The second half of the equation is the future state. Using the same criteria, what would or should the communication component look like a year from now? After that is determined, a plan can be created to improve the deficient areas and maintain the acceptable areas.
Although this example focused on one category, the same methodology can be used for additional categories. It all starts with the simple question that requires a complex answer, “What traits are important to you and are indicators of a good relationship?”
15 – 60 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Relationship Assessment and Improvement Plan tool
Executives and stakeholders (“E&S”) discuss vendors during internal meetings and often meet directly with vendors as well. Having a solid working knowledge of all the critical vendors used by an organization is nearly impossible for E&S. Without situational awareness, though, E&S can appear uninformed, can be at the mercy of others with better information, and can be led astray by misinformation. To prevent these and other issues from derailing the E&S, two essential vendor-at-a-glance reports can be used.
The first report is the 60-Second Report. As the name implies, the report can be reviewed and digested in roughly a minute. The report provides a lot of information on one page in a combination of graphics, icons, charts, and words.
The second report is a vendor calendar. Although it is a simple document, the Vendor Calendar is a powerful communication tool to keep E&S informed of upcoming events with a vendor. The purpose is not to replace the automated calendaring systems (e.g. Outlook), but to supplement them.
Combined, the 60-Second Report and the Vendor Calendar provide E&S with an overview of the information required for any high-level meeting with a vendor or to discuss a vendor.
30 – 90 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
15 – 30 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
|
By now, you have built and begun managing the VMI’s 3-year roadmap and 90-day plans to help you navigate the VMI’s day-to-day operational path. To complement these plans, it is time to build a roadmap for the VMI’s personnel as well. It doesn’t matter whether VMI is just you, you and some part-time personnel, a robust and fully staffed vendor management office, or some other point on the vendor management spectrum. The VMI is a reflection of its personnel, and they must improve their skills, competencies, and knowledge (“S/C/K”) over time for the VMI to reach its potential. As the adage says, “What got you here won’t get you there.” To get there requires a plan that starts with creating an inventory of the VMI’s team members’ S/C/K. Initially, focus on two items:
Conducting an assessment of and developing an improvement plan for each team member will be addressed later in this blueprint. (See steps 3.7 – Evaluate VMI Personnel, 3.8 – Improve Professional Skills, and 3.9 - Expand Professional Knowledge.) |
15 – 60 Minutes
| Input | Output |
|
An assessment and inventory of competencies, skills, knowledge, and other intellectual assets by VMI team member |
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium.
|
*Adapted from “Best Practices for Every Step of Survey Creation” from surveymonkey.com and “The 9 Most Important Survey Design Tips & Best Practices” by Swetha Amaresan. |
As part of the vendor management lifecycle, the VMI conducts an annual review to assesses compliance with policies and procedures, to incorporate changes in leading practices, to ensure that lessons learned are captured and leveraged, to validate that internal alignment is maintained, and to update governances as needed. As the VMI matures, the annual review process should incorporate feedback from those the VMI serves and those directly impacted by the VMI’s efforts. Your internal clients and others will be able to provide insights on what the VMI does well, what needs improvement, what challenges arise when using the VMI’s services, and other issues. A few best practices for creating surveys are set out below:*
|
|
4. Pay attention to your vocabulary and phrasing; use simple words. The goal is to communicate effectively and solicit feedback, and that all starts with the respondents being able to understand what you are asking or seeking. 5. Use response scales and keep the answer choices balanced. You want the respondents to find an answer that matches their feedback. For example, potential answers such as “strongly agree, agree, neutral, disagree, strongly disagree” are better than “strongly agree, agree, other.” 6. To improve your response rate, keep your survey short. Most people don’t like surveys, but they really hate long surveys. Make every question count, and keep the average response time to a maximum of a couple of minutes. 7. Watch out for “absolutes;” they can hurt the quality of your responses. Avoid using language such as always, never, all, and every in your questions or statements. They tend to polarize the evaluation and make it feel like an all-or-nothing situation. 8. Ask one question at a time or request evaluation of one statement at a time. Combining two topics into the same question or statement (double-barreled questions or statements) makes it difficult for the respondent to determine how to answer if both parts require different answers, for example, “During your last interaction with the VMI, how would you rate our assistance and friendliness?” |
15 – 60 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate –Tools and Templates Compendium
After the VMI has been operating for a year or two, questions may begin to surface about the value the VMI provides. “We’re making an investment in the VMI. What are we getting in return?” “Does the VMI provide us with any tangible benefits, or is it another mandatory area like Internal Audit?” To keep the naysayers at bay, start tracking the value the VMI adds to the organization or the return on investment (ROI) provided.
The easy thing to focus on is money: hard-dollar savings, soft-dollar savings, and cost avoidance. However, the VMI often plays a critical role in vendor-facing activities that lead to saving time, improving performance, and managing risk. All of these are quantifiable and trackable. In addition, internal customer satisfaction (step 2.8 and step 3.11) can provide examples of the VMI’s impact beyond the four pillars of money, time, performance, and risk.
VMI ROI is a multifaceted and complex topic that is beyond the scope of this blueprint. However, you can do a deep (or shallow) dive on this topic by downloading and reading Info-Tech’s blueprint Capture and Market the ROI of Your VMO to plot your path for tracking and reporting the VMI’s ROI or value.
Download the Info-Tech blueprint Capture and Market the ROI of Your VMO
2 – 4 Hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech blueprint Capture and Market the ROI of Your VMO
A vendor recognition program can provide many benefits to your organization. Obtaining those benefits requires a solid plan and the following foundational elements:
As with any project, there are advantages and disadvantages with implementing and operating a vendor recognition program.
Advantages:
Just as a coin has two sides, there are two sides to a vendor recognition program. Advantages must be weighed against disadvantages, or at the very least, you must be aware of the potential disadvantages.
Disadvantages:
There is no one-size-fits-all approach to creating a vendor recognition program. Your program should align with your goals. For example, do you want to drive performance and collaboration, or do you want to recognize vendors that exceed your expectations? While these are not mutually exclusive, the first step is to identify your goals. Next, focus on whether you want a formal or informal program. An informal program could consist of sending thank-you emails or notes to vendor personnel who go above and beyond; a formal program could consist of objective criteria announced and measured annually, with the winners receiving plaques, publicity, and/or recognition at a formal award ceremony with your executives. Once you have determined the type of program you want, you can begin building the framework.
Take a “crawl, walk, run” approach to designing, implementing, and running your vendor recognition program. Start small and build on your successes. If you try something and it doesn’t work the way you intended, regroup and try again.
The vendor recognition program may or may not end up residing in the VMI. Regardless, the VMI can be instrumental in creating the program and reinforcing it with the vendors. Even if the program is run and operated by the VMI, other departments will need to be involved. Seek input from the legal and marketing departments to build a durable program that works for your environment and maximizes its impact.
Lastly, don’t overlook the simple gestures…they go a long way to making people feel appreciated in today’s impersonal world. A simple (but specific) thank-you can have a lasting impact, and not everything needs to be about the vendor’s organization. People make the organization “go,” not the other way around.
30 – 90 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
|
Phase 1 |
Phase 2 |
Phase 3 |
Phase 4 |
|---|---|---|---|
| 1.1 Review and update existing Plan materials |
2.1 Vendor classification models 2.2 Customer positioning model 2.3 Two-way scorecards 2.4 Performance improvement plan (PIP) 2.5 Relationship improvement plan (RIP) 2.6 Vendor-at-a-glance reports 2.7 VMI personnel competency evaluation tool 2.8 Internal feedback tool 2.9 VMI ROI calculation 2.10 Vendor recognition program |
3.1 Classify vendors and identify customer position 3.2 Assess the relationship landscape 3.3 Leverage two-way scorecards 3.4 Implement PIPs and RIPs 3.5 Gather market intelligence 3.6 Generate vendor-at-a-glance reports 3.7 Evaluate VMI personnel 3.8 Improve professional skills 3.9 Expand professional knowledge 3.10 Create brand awareness 3.11 Survey internal clients 3.12 Calculate VMI ROI 3.13 Implement vendor recognition program |
4.1 Investigate potential alliances 4.2 Continue increasing the VMI’s strategic value 4.3 Review and update |
This phase will walk you through the following activities:
This phase helps you begin integrating the new tools and templates into the VMI’s operations. The main outcomes from this phase are guidance and the steps required to continue your VMI’s maturation and evolution.
This phase involves the following participants:
The review and assessment conducted in Phase 1 – Plan and the tools and templates created and configured during Phase 2 – Build are ready for use and incorporation into your operations. As you trek through Phase 3 – Run, a couple of familiar concepts will be reviewed (vendor classification and scorecarding), and additional details on previously introduced concepts will be provided (customer positioning, surveying internal clients); in addition, new ideas will be presented for your consideration:
The methodology used to classify your vendors in the blueprint Jump Start Your Vendor Management Initiative applies here as well, regardless of whether you use the COST model or the MVP model. Info-Tech recommends using an iterative approach initially to validate the results from the model you configured in step 2.1.
Remember to share the results with executives and stakeholders. Switching from one classification model to another may lead to concerns or questions. As always, obtain their buy-in on the final results.
If you use the MVP model, the same features will be applicable and the same processes will be followed after classifying your vendors, despite the change in nomenclature. (Strategic vendors are the equivalent of principal vendors; high operational and high tactical vendors are the equivalent of valued vendors; and all other vendors are the equivalent of minor vendors.)
|
After classifying your vendors, run your top 25 vendors through the OPEN Model Customer Positioning Tool. The information you need can come from multiple sources, including:
At first blush, the results can run the emotional and logical gamut: shocking, demeaning, degrading, comforting, insightful, accurate, off-kilter, or a combination of these and other reactions. To a certain extent, that is the point of the activity. As previously stated, customers often overestimate their importance to a vendor. To be helpful, your perspective must be as objective as possible rather than the subjective view painted by the account team and others within the vendor (e.g. “You’re my favorite client,” “We love working with you,” “You’re one of our key accounts,” or “You’re one of our best clients.”) The vendor often puts customers on a pedestal that is nothing more than sales puffery. How a vendor treats you is more important than them telling you how great you are. Use the OPEN model results and the material on the following pages to develop a game plan as you move forward with your vendor-facing VMI activities. The outcomes of the OPEN model will impact your business alignment meetings, scorecards, relationships, expectations, and many other facets of the VMI. |
The OPEN Model Customer Positioning Tool can be adapted for use at the account manager level to determine how important your account is to the account manager.
Opportunity
Low value and high attractiveness
Characteristics and potential actions by the vendor
Customer strategies
Preferred
High value and high attractiveness
Characteristics and potential actions by the vendor
Customer strategies
Exploitable
High value and low attractiveness
Characteristics and potential actions by the vendor
Customer strategies
Negligible
Low value and low attractiveness
Characteristics and potential actions by the vendor
Customer strategies
In summary, vendor actions are understandable and predictable. Learning about how they think and act is invaluable. As some food for thought, consider this snippet from an article aimed at vendors:
“The [customer positioning] grid or matrix is, in itself, a valuable snapshot of the portfolio of customers. However, it is what we do with this information that governs how effective the tool is. It can be used in many ways:
After classifying your vendors (COST or MVP model) and identifying your positioning for the top vendors via the OPEN Model Customer Positioning Tool, the next step is to assess the relationship landscape. For key vendors (strategic, high operational, and high tactical under the COST model and principal and valued under the MVP model), look closer at the relationships that currently exist:
This information will provide a more holistic view of the dynamics at work (or just beneath the surface) beyond the contract and operational relationships. It will also help you understand any relationship leverage that may be in play…now or in the future…from each party’s perspective.
10 - 30 Minutes per vendor
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate – Tools and Templates Compendium
As you roll out your new, enhanced scorecards, the same principles apply. Only a couple of modifications need to be made to your processes.
For the vendor scorecards, the VMI will still be driving the process, and internal personnel will still be completing the scorecards. An email or short orientation meeting for those involved will ease the transition from the old format to the new format. Consider creating a FAQ (frequently asked questions) for the new template, format, and content; you’ll be able to leverage it via the email or meeting to answer questions such as: What changed? Why did it change? Why are we doing this? In addition, making a change to the format and content may generate a need for new or additional internal personnel to be part of the scorecarding process. A scorecarding kick-off meeting or orientation meeting will ensure that the new participants buy into the process and acclimate to the process quickly.
For the vendor feedback, the look and feel is completely new. The feedback questions that were part of the BAM agenda have been replaced by a more in-depth approach that mirrors the vendor scorecards. Consider conducting a kick-off meeting with each participating vendor to ensure they understand the importance of the feedback form and the process for completing it. Remember to update your process to remind the vendors to submit the feedback forms three to five business days prior to the BAM (and update your BAM agenda). You will want time to review the feedback and identify any questions or items that need to be clarified. Lastly, set aside some extra time to review the feedback form in the first BAM after you shift to the formal format.
Underperforming vendors are similar to underperforming employees. There can be many reasons for the lackluster performance, and broaching the subject of a PIP may put the vendor on the defensive. Consider working with the human resources department (or whatever it is called in your organization) to learn some of the subtle nuances and best practices from the employee PIP realm that can be used in the vendor PIP realm.
When developing the PIP, make sure you:
Not all performance issues require a PIP; some can be addressed one-on-one with the vendor’s account manager, project manager, or other personnel. The key is to identify meaningful problems and use a PIP to resolve them when other measures have failed or when more formality is required.
A PIP is a communication tool, not a punishment tool. When used properly, PIPs can improve relationships, help avoid lawsuits, and prevent performance issues from having a significant impact on your organization.
After assessing the relationship landscape in step 3.2 and configuring the Relationship Assessment and Improvement Plan Tool in step 2.5, the next step is to leverage that information: 1) establish a relationship baseline for each critical vendor; and 2) develop and implement a plan for each to maintain or improve those relationships.
The Relationship Assessment and Improvement Plan Tool provides insights into the actual status of your relationships. It allows you to quantify and qualify those relationships rather than relying on intuition or instinct. It also pinpoints areas that are strong and areas that need improvement. Identify your top seven relationship priorities and build your improvement/maintenance plan around those to start. (This number can be expanded if some of your priorities are low effort or if you have several people who can assist with the implementation of the plan.) Decide which relationship indicators need a formal plan, which ones require only an informal plan, and which ones involve a hybrid approach. Remember to factor in the maintenance aspect of the relationship – if something is going well, it can still be a top priority to ensure that the relationship component remains strong.
Similar to a PIP, your RIP can be very formal with action items and deadlines. Unlike a PIP, the RIP is typically not shared with the vendor. (It can be awkward to say, “Here are the things we’re going to do to improve our relationship, vendor.”)
The level of formality for your plan will vary. Customize your plan for each vendor. Relationships are not formulaic, although they can share traits. Keep in mind what works with one person or one vendor may not work for another. It’s okay to revisit the plan if it is not working and make adjustments.
What is market intelligence?
Market intelligence is a broad umbrella that covers a lot of topics, and the breadth and depth of those topics depend on whether you sit on the vendor or customer side of the equation. Even on the customer side, the scope and meaning of market intelligence are defined by the role served by those gathering market intelligence. As a result, the first step for the VMI is to set the boundaries and expectations for its role in the process. There can be some overlap between IT, procurement/sourcing, and the VMI, for example. Coordinating with other functional areas is a good idea to avoid stepping on each other’s toes or expending duplicate resources unnecessarily.
For purposes of this blueprint, market intelligence is defined as gathering, analyzing, interpreting, and synthesizing data and information about your critical vendors (high operational, high tactical, and strategic under the COST model or valued and principal under the MVP model), their competitors, and the industry. Market intelligence can be broken into two basic categories: individual vendors and the industry as a whole. For vendors, it generally encompasses data and information about products and services available, each vendor’s capabilities, reputation, costs, pricing, advantages, disadvantages, finances, location, risks, quality ratings, standard service level agreements (SLAs) and other metrics, supply chain risk, total cost of ownership, background information, and other points of interest. For the industry, it can include the market drivers, pressures, and competitive forces; each vendor’s position in the industry; whether the industry is growing, stable, or declining; whether the industry is competitive or led by one or two dominant players; and the potential for disruption, trends, volatility, and risk for the industry. This represents some of the components of market intelligence; it is not intended to be an exhaustive list.
Market intelligence is an essential component of a VMI as it matures and strives to be strategic and to provide significant value to the organization.
What are the benefits of gathering market intelligence?
Depending on the scope of your research, there are many potential uses, goals, and benefits that flow from gathering market intelligence:
What are some potential sources of information for market intelligence?
For general information, there are many places to obtain market intelligence. Here are some common resources:
Keep in mind the source of the information may be skewed in favor of the vendor. For example, vendor marketing materials may paint a rosier picture of the vendor than reality. Using multiple sources to validate the data and information is a leading practice (and common sense).
For specific information, many VMIs use a third-party service. Third-party services can dedicate more resources to research since that is their core function. However, the information obtained from any third party should be used as guidance and not as an absolute. No third-party service has access to every deal, and market conditions can change often and quickly.
Some additional thoughts on market intelligence
Much of the guidance provided on reports in the blueprint Jump Start Your Vendor Management Initiative holds true for the 60-Second Report and the Vendor Calendar.
These reports should be kept confidential. Consider using a “confidential” stamp, header, watermark, or other indicator to highlight that the materials are sensitive and should not be disclosed outside of your organization without approval.
Using the configured VMI personnel assessment tool (Elevate – Tools and Templates Compendium tab 2.7.1 or 2.7.2), evaluate each VMI employee’s skills, competencies, and knowledge (S/C/K) against the established minimum level required/desired field for each. Use this tool for full-time and part-time team members to obtain a complete inventory of the VMI’s S/C/K.
After completing the assessment, you will be able to identify areas where personnel exceed, meet, or fail to meet the minimum level required/desired using the included dashboards. This information can be used to create a development plan for areas of deficiency or areas where improvement is desired for career growth.
As an alternative, you can assess VMI personnel using their job descriptions. Tab 2.7.3 of the Tools and Templates Compendium is set up to perform this type of analysis and create a plan for improvement when needed. Unlike Tabs 2.7.1 and 2.7.2, however, the assessment does not provide a dashboard for all employee evaluations. Tab 2.7.3 is intended to focus on the different roles and responsibilities for each employee versus the VMI as a whole.
Lastly, you can use Tab 2.7.4 to evaluate potential VMI personnel during the interview process. Load the roles and responsibilities into the template, and evaluate all the candidates on the same criteria. A dashboard at the bottom of the template quantifies the number of instances each candidate exceeds, meets, and fails to meet the criteria. Used together, the evaluation matrix and dashboard will make it easier to identify each candidate’s strengths and weaknesses (and ultimately select the best new VMI team member).
|
To be an effective member of the VMI requires proficiency in many areas. Some basic skills like computer skills, writing, and time management are straightforward. Others are more nebulous. The focus of this step is on a few of the often-overlooked skills lurking in the shadows:
For the VMI to be viewed as a strategic and integral part of the organization, these skills (and others) are essential. Although this blueprint cannot cover all of them, some leading practices, tips, and techniques for each of the skills listed above will be shared over the next several pages. |
Communication is the foundational element for the other professional skills covered in this Step 3.8. By focusing on seven key areas, you can improve your relationships, influence, emotional intelligence quotient, diplomacy, and impact when interacting with others. The concepts for the seven focal points presented here are the proverbial tip of the iceberg. Continue learning about these areas, and recognize that mastering each will require time and practice.
2. Speaking
3. Body Language.
4. Personality.
5. Style.
6. Learning
7. Actions and inactions.
Diplomacy can be defined many ways, but this one seems to fit best for the purposes of vendor management: The ability to assert your ideas or opinions, knowing what to say and how to say it without damaging the relationship by causing offense.1 At work, diplomacy can be about getting internal or external parties to work together, influencing another party, and conveying a message tactfully. As a vendor manager, diplomacy is a necessary skill for working with your team, your organization, and vendors.
To be diplomatic, you must be in tune with others and understand many things about them such as their feelings, opinions, ideas, beliefs, values, positions, preferences, and styles. To achieve this, consider the following guidance:2
Whenever things get tense, take a deep breath, take a break, or stop the communication (based on the situation and what is appropriate). Being diplomatic can be taxing, and it is better to step back than to continue down a wrong path due to stress, emotion, being caught off guard, etc.
Relationship building and networking cannot be overvalued. VMI personnel interact with many areas and people throughout the organization, and good relationships are essential. Building and maintaining relationships requires hard work and focusing on the right items. Although there isn’t a scientific formula or a mathematical equation to follow, key elements are present in all durable relationships.
Focus on building relationships at all levels within your organization. People at every level may have data or information you need, and your relationship with them may be the deciding factor in whether you get the information or not. At other times, you will have data and information to give, and the relationship may determine how receptive others are to your message. Some relationship fundamentals are provided below and continue on the next page.1,2
Most people don’t get excited about meetings, but they are an important tool in the toolbox. Unfortunately, many meetings are unnecessary and unproductive. As a result, meeting invites often elicit an audible groan from invitees. Eliminating meetings completely is not a practical solution, which leaves one other option: improving them.
You may not be in charge of every meeting, but when you are, you can improve their productivity and effectiveness by making a few modifications to your approach. Listed below are ten ideas for getting the most out of your meetings:*
5. Use video when anyone is attending virtually. This helps prevent anonymity and increases engagement.
6. Start and end meetings on time. Running over impacts other meetings and commitments; it also makes you look ineffective and increases stress levels for attendees.
7. If longer meetings are necessary, build in a short break or time for people to stand up and stretch. Don’t say, “If you need a break or to stand up during the meeting, feel free.” Make it a planned activity.
8. Keep others engaged by facilitating and drawing specific people into the conversation; however, don’t ask people to contribute on topics that they know nothing about or ask generally if anyone has any comments.
9. Leverage technology to help with the meeting; have someone monitor the chat for questions and concerns. However, the chat should not be for side conversations, memes, and other distractions.
10. End the meeting with a short recap, and make sure everyone knows what was decided/accomplished, what next steps are, and which action items belong to which people.
Emotional intelligence (otherwise known as emotional intelligence quotient or EQ) is the ability to understand, use, and manage your own emotions in positive ways to relieve stress, communicate effectively, empathize with others, overcome challenges and defuse conflict.1 This is an important set of skills for working with vendors and internal personnel. Increasing your EQ will help you build better relationships and be seen as a valuable teammate…at all levels within your organization.
Improving this skill dovetails with other skills discussed in this step 3.8, such as communication and diplomacy. Being well versed in the concepts of EQ won’t be enough. To improve requires a willingness to be open – open to feedback from others and open to new ideas. It also requires practice and patience. Change won’t happen overnight, but with some hard work and perseverance, your EQ can improve.
There are many resources that can help you on your journey, and here are some tips to improve your EQ:2
Tips to improve your EQ (continued from previous page):
Things to avoid:1
Skills such as influence and persuasion are important (even necessary) for vendor managers. (Don’t confuse this with the dark arts version – manipulation.) A good working definition is provided by the Center for Creative Leadership: Influence is the ability to affect the behavior of others in a particular direction, leveraging key tactics that involve, connect, and inspire them.* Influence and persuasion are not about strongarming or blackmailing someone to get your way. Influence and persuasion are about presenting issues, facts, examples, and other items in a way that moves people to align with your position. Sometimes you will be attempting to change a person’s mind, and other times you will be moving them from a neutral stance to agreeing to support your position.
Building upon the basic communication skills discussed at the start of this step, there are some ways to improve your ability to influence and persuade others. Here are some suggestions to get you started:*
3. Build and maintain trust – trust has two main components: competency and character. In item 2 on the previous page, competency trust was discussed from the perspective of knowledge and expertise. For character trust, you need to be viewed as being above reproach. You are honest and ethical; you follow through and honor your commitments. Once both types of trust are in place, eyes and ears will be open and more receptive to your messages. Bottom line: You can’t influence or persuade people if they don’t trust you.
4. Grow and leverage networks – the workplace is a dynamic atmosphere, and it requires almost constant networking to ensure adequate contacts throughout the organization are maintained. Leveraging your network is an artform, and it must be used wisely. You don’t want to wear out your welcome by asking for assistance too often.
As you prepare your plan to influence or persuade someone, ask yourself the following questions:*
To function in their roles, VMI personnel must be well versed in the concepts and terminology associated with vendor management. To be strategic and to develop relationships with other departments, divisions, agencies, and functional groups, VMI personnel must also be familiar with the concepts and terminology for functions outside the VMI. Although a deep dive is beyond the scope of this blueprint, understanding basic concepts within each of the topics below is critical:
It isn’t necessary to be an expert in these subjects, but VMI personnel must be able to talk with their peers intelligently. For example, a vendor manager needs to have a general background in contract terms and conditions to be able to discuss issues with legal, finance, procurement, and project management groups. A well-rounded and well-versed VMI team member can rise to the level of trusted advisor and internal strategic partner rather than wallowing in the operational or transactional world.
Finance and accounting terms and concepts are commonplace in every organization. They are the main language of business – they are the way for-profit businesses keep score. Regardless of whether your organization is a for-profit, non-profit, governmental, or other entity, finance and accounting run through the veins of your organization as well. In addition to the customer side of the equation, there is the vendor side of the equation: Every vendor you deal with will be impacted financially by working with you.
Having a good grasp of finance and accounting terms and concepts will improve your ability to negotiate, talk to finance and accounting personnel (internal and external), conduct ongoing due diligence on your critical vendors, review contracts, and evaluate vendor options, to name just a few of the benefits.
The concepts listed on the following pages are some of the common terms applicable to finance and accounting. It is not intended to be an exhaustive list. Continue to learn about these concepts and identify others that allow you to grow professionally.
Finance and accounting terms and concepts
|
Finance and accounting terms and concepts (cont’d) |
|
|---|---|
|
|
|
Whether your organization has a formal project management office (PMO) or not, project management practices are being used by those tasked with making sure software and software as a service implementations go smoothly, technology refreshes are rolled out without a hitch, and other major activities are successful. Listed below are some common competencies/skills used by project managers to make sure the job gets done right.
|
|
|
The concepts listed below are common project management terms and concepts.1, 2 This list is not intended to be exhaustive. Look internally at your project management processes and operations to identify the concepts applicable in your environment and any that are missing from this list. | |
|
|
|
Contracts and contract lifecycle management (CLM) are two separate but related topics. It is possible to have contracts without a formal CLM process, but you can’t have CLM without contracts. This portion of step 3.9 provides some general background on each topic and points you to blueprints that cover each subject in more detail.
IT contracts tend to be more complicated than other types of contracts due to intellectual property (IP) rights being associated with most IT contracts. As a result, it is necessary to have a basic understanding of IP and common IT contract provisions.
There are four main areas of IP: copyrights, patents, trademarks, and trade secrets. Each has its own nuances, and people who don’t work with IP often mistake one for another or use the terms interchangeably. They are not interchangeable, and each affords a different type of protection when available (e.g. something may not be capable of being patented, but it can be copyrighted).
For contract terms and conditions, vendor managers are best served by understanding both the business side and the legal side of the provisions. In addition, a good contract checklist will act as a memory jogger whether you are reviewing a contract or discussing one with legal or a vendor. For more information on contract provisions, checklists, and playbooks, download the Info-Tech blueprints identified to the left.
Download the Info-Tech blueprint Understand Common IT Contract Provisions to Negotiate More Effectively
Download the Info-Tech blueprint Improve Your Statements of Work to Hold Your Vendors Accountable
CLM is a process that helps you manage your agreements from cradle to grave. A robust CLM process eases the challenges of managing hundreds or even thousands of contracts that affect the day-to-day business and could expose your organization to various types of vendor-related risk.
Managing a few contracts through the contracting process is easy, but as the number of contracts grows, managing each step of the process for each contract becomes increasingly difficult and time consuming. That’s where CLM and CLM tools can help. Here is a high-level overview of the CLM process:
For more information on CLM, download the Info-Tech blueprint identified to the left.
Download the Info-Tech Blueprint Design and Build an Effective Contract Lifecycle Management Process
Almost every organization has a procurement or sourcing department. Procurement/sourcing is often the gatekeeper of the processes used to buy equipment and services, lease equipment, license software, and acquire other items. There are many different types of procurement/sourcing departments and several points of maturity within each type. As a result, the general terms listed on the next page may or may not be applicable within your organization. (Or your organization may not have a procurement/sourcing department at all!)
Identifying your organization’s procurement/sourcing structure is the best place to start. From there, you can determine which terms are applicable in your environment and dive deeper on the appropriate concepts as needed.
|
Procurement sourcing terms and concepts |
|
|
|
Whether you consider conflict management a skill, knowledge, or something in between, there is no denying that vendor managers are often engaged to resolve conflicts and disputes. At times, the VMI will be a “disinterested third party,” sitting somewhere between the vendor and an internal department, line of business, agency, or other functional designation. The VMI also may be one of the parties involved in the dispute or conflict. As a result, a little knowledge and a push in the right direction will help you learn more about how to handle situations where two parties don’t agree.
To begin with, there are four levels of “formal” dispute resolution. You may be intimately aware of all of them or only have cursory knowledge of how they work and the purpose they serve:
Their use often can be controlled or limited either contractually or by your organization’s preferences. They may be exclusive or used in combination with one another (e.g. negotiation first, and if things aren’t resolved, arbitration). Look at your contracts and legal department for guidance. It’s important to understand when and how these tools are used and what is expected (if anything) from the VMI.
|
Another factor in the conflict management and informal dispute resolution process is the people component. Perhaps the most famous or well-known model on this topic is the Thomas-Kilmann conflict resolution model. It attempts to bring clarity to the five different personality types you may encounter when resolving differences. As the graphic indicates, it is not purely a black-and-white endeavor; it is comprised of various shades of grey. The framework presented by Mr. Thomas and Mr. Kilmann provides insights into how people behave and how to engage them based on personality characteristics and attributes. The model sorts people into one of five categories:
Although it is not an absolute science since people are unpredictable at times, the Thomas-Kilmann model provides great insights into human behavior and ways to work with the personality types listed. |
Although the topic is vastly greater than being presented here, the last consideration is a sound process to follow when the conflict or dispute will be handled informally (at least to start). The simple process presented below works with vendors, but it can be adapted to work with internal disputes as well. The following process assumes that the VMI is attempting to facilitate a dispute between an internal party and a vendor.
Step 1. Validate the person and the issue being brought to you; don’t discount the person, their belief, or their issue. Show genuine interest and concern.
Step 2. Gather and verify data; not all issues brought forward can be pursued or pursued as presented. For example, “The vendor is always late with its reports” may or may not be 100% accurate as presented.
Step 3. Convert data gathered into useful and relatable information. To continue the prior example, you may find that the vendor was late with the reports on specified dates, and this can be converted into “the vendor was late with its reports 50% of the time during the last three months.”
Step 4. Escalate findings internally to the appropriate stakeholders and executives as necessary so they are not blindsided if a vendor complains or goes around you and the process. In addition, they may want to get involved if it is a big issue, or they may tell you to get rid of it if it is a small issue.
Step 5. Engage the vendor once you have your facts and present the issues without judgment. Ask the vendor to do its own fact gathering.
Step 6. Schedule a meeting to review of the situation and hear the vendor’s version of the facts…they may align, or they may not.
Step 7. Resolve any differences between your facts/information and the vendor’s. There may be extenuating circumstances, oversights, different data, or other items that come to light.
Step 8. Attempt to resolve the problem and prevent further occurrences through root cause analysis and collaborative problem-solving techniques.
Develop your own process and make sure it stays neutral. The process should not put the vendor (or any party) on the defensive. The process is to help the parties reach resolution…not to assign blame.
Working with the account or sales team from your critical vendors can be challenging. A basic understanding of account team operations and customer/vendor dynamics will go a long way to improving your interactions (and even vendor performance) over time.
Sales basics
Improving sales and account team dynamics with your organization
Improving sales and account team dynamics with your organization (continued)
For more information on this topic, download the Info-Tech blueprint Evaluate Your Vendor Account Team to Optimize Vendor Relations.
Branding isn’t just for companies. It is for departments (or whatever you call them at your place of employment) and individuals working in those departments. With a little work and even less money, you can create a meaningful brand for the VMI. While you are at it, you may want to encourage the VMI’s team members to focus a little attention on their personal brands since the VMI and its personnel are intertwined. First, let's define “brand.”
Ask 50 people, “How do you define ‘brand’?” and you are likely to get 50 different answers. For the purposes of this blueprint, the following definition provides some guiderails by describing what a brand is and isn’t: “A brand is not a logo. A brand is not an identity. A brand is not a product. A brand is a person’s gut feeling about a product, service, or organization.”1 Let’s expand the definition of “a brand is…” to include departments and individuals since that’s the focus of this step, and it doesn’t violate the spirit of the original definition. A further expansion could include the goodwill associated with the product, service, organization, department, or individual.
Dedicating time and other resources to proactively creating and nurturing the VMI’s brand has many advantages:
As you embark on creating a brand for the VMI and raising awareness, here are a few considerations to keep in mind:
As previously mentioned, brands are for individuals as well. In fact, everybody has a brand associated with them…for better or worse...whether they have consciously created and molded it or not. Focusing on the individual brand at this point offers the VMI and its team members the opportunity to enhance the brand for both. After all, the VMI is a reflection of its personnel.
Here are some things VMI team members can do to enhance their brand:
30 – 90 Minutes
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Info-Tech Elevate - Tools and Templates Compendium
As you deploy your surveys, timing must be considered. For annual surveys, avoid busy seasons such as mid to late December (especially if your organization’s fiscal year is a calendar year). Give people time to recover from any November holidays, and survey them before they become distracted by December holidays (if possible). You may want to push the annual survey until January or February when things have settled back into a normal routine. Your needs for timing and obtaining the results must be balanced against the time constraints and other issues facing the potential respondents.
For recency surveys, timing can work to your advantage or disadvantage. Send the survey almost immediately after providing assistance. If you wait more than a week or two, memories will begin to fade, and the results will trend toward the middle of the road.
Regardless of whether it is an annual survey or a recency survey, distributing the surveys to a big enough sample size will be tough. Combine that with low response rates and the results may be skewed. Take what you can get and look for trends over time. Some people may be tough critics; if possible, send the survey to the same people (and incorporate new ones) to see if the tough graders’ responses are remaining true over time. Another way to mitigate some of the tough critics is to review their answers to the open-ended questions. For example, a tough grader may respond with a “4 – helpful” when you were expecting a “5 – very helpful;” the narrative portion of the survey may be consistent with that answer, or it may provide what you were looking for: “The VMI was great to work with on this project.” When confined to a scale, some respondents won’t give the top value/assessment no matter what, but they will sing your praises in a question that requires a narrative response. Taken together, you may get a slightly different picture – one that often favors you.
|
After you have received a few responses to your surveys (recency and annual), review the results against your expectations and follow up with some of the respondents. Were the questions clear? Were the answer choices appropriate? Ultimately, you have to decide if the survey provided the meaningful feedback you were looking for. If not, revise the questions and answers choices as needed. (Keep in mind, you are not looking for “feelgood fluff.” You are looking for feedback that will reinforce what you are doing well and show areas for improvement.) Once you have the results, it’s time to share them with the executives and stakeholders. When creating a report, consider the following guidance:
|
Calculating ROI begins with establishing baselines: what is the current situation? Once those are established, you can begin tracking the impact made by the VMI by looking at the differences between the baseline and the end result. For example, if the VMI is tracking money saved, it is critical to know the baseline amounts (e.g. the initial quote from the vendor, the budgeted amount). If time is being measured, it is important to understand how much time was previously spent on items (e.g. vendor meetings to address concerns, RFPs).
The blueprint Capture and Market the ROI of Your VMO will lead you through the process, but there are a couple of key things to remember: 1) some results will be quick and easy – the low-hanging fruit, things that have been ignored or not done well, eliminating waste, and streamlining inefficiencies; and 2) other things may take time to come to fruition. Be patient and make sure you work with finance or others to bring credibility to your calculations.
When reporting the ROI, remember to include the results of the survey from step 3.11. They are not always quantifiable, but they help executives and stakeholders see the complete picture, and the stories or examples make the ROI “personal” to the organization.
Reporting can be a challenge. VMIs often underestimate their value and don’t like self-promotion. While you don’t want to feel like you operate in justification mode, many eyes will be on the VMI. The ROI report helps validate and promote the VMI, and it helps build brand awareness for the VMI.
As indicated in step 2.10, take a “crawl, walk, run” approach to your vendor recognition program. Start off small and grow the program over time. Based on the scope of the program, decide how you’ll announce and promote it. Work with marketing, IT, and others to ensure a consistent message, to leverage technology (e.g. your website), and to maximize awareness.
For a formal program, you may want to hold a kickoff meeting to introduce the program internally and externally. The external kickoff can be handled in a variety of ways depending on available resources and the extent of the program. For example, a video can be produced and shared with eligible vendors, an email from the VMI or an executive can be used, or the program can be rolled out through BAMs if only BAM participants are eligible for the program. If you are taking an informal approach to the vendor recognition program, you may not need an external kickoff at all.
For a formal program, collect information periodically throughout the year rather than waiting until the end of the year; however, some data may not be available or relevant until the end of the measurement period. For subjective criteria, the issue of recency may be an issue, and memories will fade over time. (Be careful the subjective portion doesn’t turn into a popularity contest.)
If the vendor recognition program is not meeting your goals adequately, don’t be afraid to modify it or even scrap it. At some point, you may have to do a partial or total reboot of the program. Creating and maintaining a “lessons learned” document will make a reboot easier and better if it is necessary. Remember: While a vendor recognition program has many potential benefits, your main goals must be achieved or the program adds little or no value.
Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
| 1.1 Review and update existing Plan materials | 2.1 Vendor classification models 2.2 Customer positioning model 2.3 Two-way scorecards 2.4 Performance improvement plan (PIP) 2.5 Relationship improvement plan (RIP) 2.6 Vendor-at-a-glance reports 2.7 VMI personnel competency evaluation tool 2.8 Internal feedback tool 2.9 VMI ROI calculation 2.10 Vendor recognition program | 3.1 Classify vendors and identify customer position 3.2 Assess the relationship landscape 3.3 Leverage two-way scorecards 3.4 Implement PIPs and RIPs 3.5 Gather market intelligence 3.6 Generate vendor-at-a-glance reports 3.7 Evaluate VMI personnel 3.8 Improve professional skills 3.9 Expand professional knowledge 3.10 Create brand awareness 3.11 Survey internal clients 3.12 Calculate VMI ROI 3.13 Implement vendor recognition program | 4.1 Investigate potential alliances 4.2 Continue increasing the VMI’s strategic value 4.3 Review and update |
This phase will walk you through the following activities:
This phase helps the VMI stay aligned with the overall organization, stay current, and improve its strategic value as it evolves. The main outcomes from this phase are ways to advance the VMI’s strategic impact.
This phase involves the following participants:
The emphasis of this final phase is on the VMI’s continued evolution.
Chances are you’ve seen a marketing or business alliance at work in your personal life. If you’ve visited a Target store or a Barnes and Noble store, you’ve more than likely walked past the Starbucks counter. The relationship is about more than the landlord-tenant agreement, and the same business concept can exist in non-retail settings. Although they may not be as common in the customer-IT vendor space, alliances can work here as well.
Definition
For vendor management purposes, an alliance is a symbiotic relationship between two parties where both benefit beyond the traditional transactional (i.e. buyer-seller) relationship.
Characteristics
Benefits
Risks
Keys to success
The purpose of this step is not to make you an expert on alliances or to encourage you to rush out of your office, cubicle, bedroom, or other workspace looking for opportunities. The purpose is to familiarize you with the concepts, to encourage you to keep your eyes open, and to think about relationships from different angles. How will you make the most of your vendors’ expertise, resources, market, and other things they bring to the table?
Although they are not synonymous concepts, increasing the VMI’s maturity and increasing the VMI’s strategic value can go hand in hand. Evolving the VMI to be strategic allows the organization to receive the greatest benefit for its investment. This isn’t to say that all work the VMI does will be strategic. It will always live in two places – the transactional world and the strategic world – even when it is fully mature and operating strategically. Just like any job, there are transactional tasks and activities that must be done, and some of them are foundational elements for being strategic (e.g. conducting research, preparing reports, and classifying vendors). The VMI must evolve and become strategic for many reasons: staying in the transactional world limits the VMI’s contributions, results, influence and impact; team members will have less job satisfaction and enjoyment and lower salaries; ultimately, the justification for the VMI could disappear.
To enhance the VMI’s (and, as applicable, its personnel’s) strategic value, continue:
|
Indicators of a transactional VMI: |
Indicators of a strategic VMI: |
|---|---|
|
|
The vendor management lifecycle is continuous and more chaotic than linear, but the chaos mostly stays within the boundaries of the “plan, build, run, and review” framework outlined in this blueprint and the blueprint Jump Start Your Vendor Management Initiative. Two of the goals of managing the lifecycle are: 1) to adapt to a changing world; and 2) to improve the VMI and its impact over time. To do this, keep following the guidance in this phase, but don’t forget about the direction provided in phase 4 of the blueprint Jump Start Your Vendor Management Initiative:
Continue reviewing and updating the VMI’s risk footprint. Add risk categories and scope as needed (measurement, monitoring, and reporting). Review Info-Tech’s vendor management-based series of risk blueprints for further information (Identify and Manage Reputational Risk Impacts on Your Organization and others).
It is easy for business owners to lose sight of things. There is a saying among entrepreneurs about remembering to work on the business rather than working exclusively in the business. For many entrepreneurs, it is easy to get lost in the day-to-day grind and to forget to look at the bigger picture. A VMI is like a business in that regard – it is easy to focus on the transactional work and lose sight of maturing or evolving the VMI. Don’t let this happen!
Leverage the tools and templates from this blueprint and adapt them to your environment as needed. Unlike the blueprint Jump Start Your Vendor Management Initiative, some of the concepts presented here may take more time, resources, and evolution before you are ready to deploy them. Continue using the three-year roadmap and 90-day plans from the Jump Start Your Vendor Management Initiative blueprint, and add components from this blueprint when the time is right. The two blueprints are designed to work in concert as you move forward on your VMI journey.
Lastly, focus on getting a little better each day, week, month, or year: better processes, better policies and procedures, better relationships with vendors, better relationships with internal clients, better planning, better anticipation, better research, better skills, competencies, and knowledge for team members, better communication, better value, and better impact. A little “better” goes a long way, and over time it becomes a lot better.
Contact your account representative for more information.
workshops@infotech.com
1-888-670-8889
Jump Start Your Vendor Management Initiative
IT (and the organization as a whole) are more reliant on vendors than ever before, and vendor management has become increasingly necessary to manage the relationships and manage the risks. Implementing a vendor management initiative is no longer a luxury...it is a necessity.
Capture and Market the ROI of Your VMO
Calculating the impact or value of a vendor management office (VMO) can be difficult without the right framework and tools. Let Info-Tech’s tools and templates help you account for the contributions made by your VMO.
Evaluate Your Vendor Account Team to Optimize Vendor Relations
Understanding your vendor team’s background, experience, and strategic approach to your account is key to the management of the relationship, the success of the vendor agreement, and, depending on the vendor, the success of your business.
Identify and Manage Financial Risk Impacts on Your Organization
Vendors’ failure to perform, including security and compliance violations, can have significant financial consequences. Good vendor management practices help organizations understand the costs of those actions.
Amaresan, Swetha. “The 9 Most Important Survey Design Tips & Best Practices.” HubSpot. Accessed 13 July 2022.
“Best Practices for Every Step of Survey Creation.” Survey Monkey. Accessed 13 July 2022.
Brevig, Armand. ”Here Is a Quicker Way of Getting Better Supply Market Insights.” Procurement Cube, 30 July 2020. Accessed 19 May 2022.
Cain, Elna. “9 Simple Ways on How to Improve Your Writing Skills.” Elna Cain, 20 Nov. 2018. Accessed 5 June 2020.
Colwell, Tony. “How to Select Strategic Suppliers Part 1: Beware the Supplier's Perspective.” Accuity Consultants, 7 Feb 2012. Accessed 19 May 2022.
“50 Tips for Improving Your Emotional Intelligence.” RocheMartin, 12 Jan. 2022. Accessed 25 July 2022.
“4 Ways to Strengthen Your Ability to Influence Others.” Center for Creative Leadership, 24 Nov. 2020. Accessed 20 July 2022.
Ferreira, Nicole Martins. “10 Personal Branding Tips That’ll Elevate Your Business In 2022.” Oberlo, 21 Mar. 2022. Accessed 24 May 2022.
Gartlan, Dan. “4 Essential Brand Components.” Stevens & Tate, 25 Nov. 2019. Accessed 24 May 2022.
Geller & Company. “World-Class Procurement — Increasing Profitability and Quality.” Spend Matters, 2003. Accessed 4 March 2022.
Gumaste, Pavan. “50 Project Management Terms You Should Know.” Whiz Labs, 2018. Accessed 22 July 2022.
Hertzberg, Karen. “How to Improve Writing Skills in 15 Easy Steps.” Grammarly, 15 June 2017. Accessed 5 June 2020.
“Improving Emotional Intelligence (EQ).” HelpGuide, 2022. Accessed 25 July 2022.
“ISG Index 4Q 2021.” Information Services Group, Inc., 2022. Web.
Lehoczky, Etelka. “How To Improve Your Writing Skills At Work.” Forbes, 9 Mar. 2016. Accessed 5 June 2020.
Liu, Joseph. “5 Ways To Build Your Personal Brand At Work.” Forbes, 30 Apr. 2018. Accessed 24 May 2022.
Lloyd, Tracy. “Defining What a Brand Is: Why Is It So Hard?” Emotive Brand, 18 June 2019. Accessed 28 July 2022.
Nielson, Megan. “The Basic Tenants of Diplomatic Communication.” Communiqué PR, 22 October 2020. Accessed 23 May 2022
“Positioning Yourself in the Market.” New Zealand Ministry of Business, Innovation & Employment, 2021. Accessed 19 May 2022.
Rogelberg, Steven G. “The Surprising Science Behind Successful Remote Meetings.” sloanreview.mit.edu. 21 May 2020. Accessed 19 July 2022.
“Rule No 5: All Customers/Suppliers Have a Different Value to You.” newdawnpartners.com. Accessed 19 May 2022.
Shute, Benjamin. “Supplier Relationship Management: Is Bigger Always Better?” Comprara, 24 May 2015. Accessed 19 May 2022.
Steele, Paul T. and Brian H. Court. Profitable Purchasing Strategies: A Manager's Guide for Improving Organizational Competitiveness Through the Skills of Purchasing. McGraw-Hill, 1996.
“Take the Thomas-Kilmann Conflict Mode Instrument (TKI).” Kilmann Diagnostics, 2018. Accessed 20 Aug. 2020.
Tallia, Alfred F. MD, MPH, et al. ”Seven Characteristics of Successful Work Relationships.” Fam Pract Manag. 2006 Jan;13(1):47-50.
“The Art of Tact and Diplomacy.” skillsyouneed.com. Accessed 23 May 2022.
“13 Key Traits of Strong Professional Relationships.” success.com. Accessed 4 Feb. 2022.
Wilson, Fred. “Top 40 Project Management Terms and Concepts of 2022.” nTask, 25 Feb. 2019. Accessed 24 July 2022.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify gaps, establish a list of dashboards and reports to enhance, and set out a roadmap for your dashboard and reporting enhancement project.
Gain an understanding of how to design effective dashboards and reports.
Officially close and evaluate the PPM dashboard and reporting enhancement project and transition to an ongoing and sustainable PPM dashboard and reporting program.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
PPM dashboards and reports will only be effective and valuable if they are designed to meet your organization’s specific needs and priorities.
Conduct a decision-support review and a thorough dashboard and report audit to identify the gaps your project will address.
Take advantage of the planning stage to secure sponsor and stakeholder buy-in.
Current-state assessment of satisfaction with PPM decision-making support.
Current-state assessment of all existing dashboards and reports: effort, usage, and satisfaction.
A shortlist of dashboards and reports to improve that is informed by actual needs and priorities.
A shortlist of dashboards and reports to create that is informed by actual needs and priorities.
The foundation for a purposeful and focused PPM dashboard and reporting program that is sustainable in the long term.
1.1 Engage in PPM decision-making review.
1.2 Perform a PPM dashboard and reporting audit and gap analysis.
1.3 Identify dashboards and/or reports needed.
1.4 Plan the PPM dashboard and reporting project.
PPM Decision-Making Review
PPM Dashboard and Reporting Audit
Prioritized list of dashboards and reports to be improved and created
Roadmap for the PPM dashboard and reporting project
Once the purpose of each PPM dashboard and report has been identified (based on needs and priorities) it is important to establish what exactly will be required to produce the desired outputs.
Gathering stakeholder and technical requirements will ensure that the proposed and finalized designs are realistic and sustainable in the long term.
Dashboard and report designs that are informed by a thorough analysis of stakeholder and technical requirements.
Dashboard and report designs that are realistically sustainable in the long term.
2.1 Review the best practices and science behind effective dashboards and reporting.
2.2 Gather stakeholder requirements.
2.3 Gather technical requirements.
2.4 Build wireframe options for each dashboard or report.
2.5 Review options: requirements, feasibility, and usability.
2.6 Finalize initial designs.
2.7 Design and record the input, production, and consumption workflows and processes.
List of stakeholder requirements for dashboards and reports
Wireframe design options
Record of the assessment of each wireframe design: requirements, feasibility, and usability
A set of finalized initial designs for dashboards and reports.
Process workflows for each initial design
Ensure that enhanced dashboards and reports are actually adopted in the long term by carefully planning their roll-out to inputters, producers, and consumers.
Plan to train all stakeholders, including report consumers, to ensure that the reports generate the decision support and PPM value they were designed to.
An informed, focused, and scheduled plan for rolling out dashboards and reports and for training the various stakeholders involved.
3.1 Plan for external resourcing (if necessary): vendors, consultants, contractors, etc.
3.2 Conduct impact analysis: risks and opportunities.
3.3 Create an implementation and training plan.
3.4 Determine PPM dashboard and reporting project success metrics.
External resourcing plan
Impact analysis and risk mitigation plan
Record of the PPM dashboard and reporting project success metrics
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify and validate goals and collaboration tools that are used by your users, and the collaboration capabilities that must be supported by your desired ECS.
Map a path forward by creating a collaboration capability map and documenting your ECS requirements.
Effectively engage everyone to ensure the adoption of your new ECS. Engagement is crucial to the overall success of your project.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Create a vision for the future of your ECS.
Validate and bolster your strategy by involving your end users.
1.1 Prioritize Components of Your ECS Strategy to Improve
1.2 Create a Plan to Gather Requirements From End Users
1.3 Brainstorm the Collaboration Services That Are Used by Your Users
1.4 Focus Group
Defined vision and mission statements
Principles for your ECS
ECS goals
End-user engagement plan
Focus group results
ECS executive presentation
ECS strategy
Streamline your collaboration service portfolio.
Documented the business requirements for your collaboration services.
Reduced the number of supported tools.
Increased the effectiveness of training and enhancements.
2.1 Create a Current-State Collaboration Capability Map
2.2 Build a Roadmap for Desired Changes
2.3 Create a Future-State Capability Map
2.4 Identify Business Requirements
2.5 Identify Use Requirements and User Processes
2.6 Document Non-Functional Requirements
2.7 Document Functional Requirements
2.8 Build a Risk Register
Current-state collaboration capability map
ECS roadmap
Future-state collaboration capability map
ECS business requirements document
Ensure the system is supported effectively by IT and adopted widely by end users.
Unlock the potential of your ECS.
Stay on top of security and industry good practices.
Greater end-user awareness and adoption.
3.1 Develop an IT Training Plan
3.2 Develop a Communications Plan
3.3 Create Initial Marketing Material
IT training plan
Communications plan
App marketing one-pagers
The shift from isolated, task-based automations in your pilot to value-oriented, scaled automations brings new challenges and barriers to your organization such as:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This research walks you through the level setting of your scaled business process automation (BPA) expectations, factors to consider in defining your scaled BPA journey, and assessing your readiness to scale BPA.
Use this tool to identify key gaps in the people, processes, and technologies you need to support the scaling of business process automation (BPA). It also contains a canvas to facilitate your discussions around business process automation with your stakeholders and BPA teams.
Business and IT must work together to ensure the right automations are implemented and BPA is grown and matured in a sustainable way. However, many organizations are not ready to make this commitment. Managing the automation demand backlog, coordinating cross-functional effort and organizational change, and measuring BPA value are some of the leading factors challenging scaling BPA.
Pilot BPA with the intent to scale it. Pilots are safe starting points to establish your foundational governance and management practices and build the necessary relationships and collaborations for you to be successful. These factors will then allow you to explore more sophisticated, complicated, and innovative opportunities to drive new value to your team, department, and organization.

Andrew Kum-Seun
Research Director,
Application Delivery and Management
Info-Tech Research Group
The shift from isolated, task-based automations in your pilot to value-oriented and scaled automations brings new challenges and barriers to your organization:
Take a value-first approach in your scaling business process automation (BPA) journey. Low-risk, task-oriented automations are good starting points to introduce BPA but constrain the broader returns your organization wants. Business value can only scale when everything and everyone in your processes are working together to streamline the entire value stream rather than the small gains from optimizing small, isolated automations.
See Info-Tech's Build a Winning Business Process Automation Playbook blueprint for more information.
Design and communicate your approach to scale business process automation with Info-Tech's Scale Business Process Automation Readiness Assessment:

1.1.1 Define Your Scaling Objectives
This step involves the following participants:
Scaling BPA objectives
As industries evolve and adopt more tools and technology, their products, services, and business operating models become more complex. Task- and desktop-based automations are often not enough. More sophisticated and scaled automations are needed to simplify and streamline the process from end-to-end of complex operations and align them with organizational goals.
The value of scaling BPA is dependent on the organization's ability to scale with it. In other words, stakeholders should see an increase in business value without a substantial increase in resources and operational costs (e.g., there should be little difference if sending out 10 emails versus 1000).
Source: Stefanini Group
Pilot BPA implementations often involve the processes that are straightforward to automate or are already shortlisted to optimize. However, these low-hanging fruits will run out. Discovering new BPA opportunities can be challenged for a variety of reasons, such as:
BPA is not a cheap investment. A single RPA bot, for example, can cost between $5,000 to $15,000. This cost does not include the added cost for training, renewal fees, infrastructure set up and other variable and reoccurring costs that often come with RPA delivery and support (Blueprint). This reality can motivate BPA owners to favor existing technologies over other cheaper and more effective alternatives in an attempt boost their return on investment.
Good technical skills and tools, and the right mindset are critical to ensure BPA capabilities are deployed effectively. Low-code no-code (LCNC) can help but success isn't guaranteed. Lack of experience with low-code platforms is the biggest obstacle in low-code adoption according to 60% of respondents (Creatio). The learning curve has led some organizations to hire contractors to onboard BPA teams, hire new employees, or dedicate significant funding and resources to upskill internal resources.
How can I improve myself? | How can we improve my team? | How can we improve my organization? | |
|---|---|---|---|
Objectives |
|
|
|
Goals |
|
|
|
Key Question: Are stakeholders satisfied with how the BPA practice is meeting their automation needs?
Examples of Metrics:
Key Question: How do your automation solutions perform and meet your quality standards?
Examples of Metrics:
Key Question: How has automation improved the value your employees, teams, and the organization delivers?
Examples of Metrics:
Increase in revenue generation
Reduction in operational costs
Expansion of business capabilities with minimal increases in costs and risks
5 minutes
Scaled BPA value canvas
Record the results in the 2. Value Canvas Tab in the Scale Business Process Automation Readiness Assessment.

An application portfolio strategy details the direction, activities, and tactics to deliver on the promise of your application portfolio. It often includes:
See our Application Portfolio Management Foundations blueprint for more information.

Expected Outcome From Your Pilot: Your pilot would have recognized the roles that know how to effectively apply good BPA practices (e.g., process analysis and optimization) and are familiar with the BPA toolset. These individuals are prime candidates who can standardize your Build a Winning Business Process Automation Playbook, upskill interested teams, and build relationships among those involved in the delivery and use of BPA.
1.2.1 Discuss Your BPA Opportunities
1.2.2 Lay Out Your Scaling BPA Journey
This step involves the following participants:
A successful scaled BPA practice requires a continuous demand for BPA capabilities and the delivery of minimum viable automations (MVA) held together by a broader strategic roadmap.

An MVA focuses on a single and small process use case, involves minimal possible effort to improve, and is designed to satisfy a specific user group. Its purpose is to maximize learning and value and inform the further scaling of the BPA technology, approach, or practice.
See our Build a Winning Business Process Automation Playbook blueprint for more information.
Your scaling BPA recipe (approach) can involve multiple different flavors of various quantities to fit the needs and constraints of your organization and workers.
What and how many ingredients you need is dependent on three key questions:
Record the results in the 3. Scaled BPA Journey Tab in the Scale Business Process Automation Readiness Assessment.
![]() | Continuous business process optimization and automation |
![]() | Scope of Info-Tech's Build Your Business Process Automation Playbook blueprint |

Optimizing your scaled BPA practices and applying continuous improvements starts with monitoring the process after implementation.
Purpose of Monitoring
Metrics
Metrics are an important aspect of monitoring and sustaining the scaled practice. The metrics will help determine success and find areas where adjustments may be needed.
Hold retrospectives to identify any practice issues to be resolved or opportunities to undertake
The retrospective gives your organization the opportunity to review themselves and brainstorm solutions and a plan for improvements to be actioned. This session is reoccurring, typically, after key milestones. While it is important to allow all participants the opportunity to voice their opinions, feelings, and experiences, retrospectives must be positive, productive, and time boxed.
Prepare to Scale BPA
1.3.1 Assess Your Readiness to Scale BPA
This step involves the following participants:
"While most organizations are advised to start with automating the 'low hanging fruit' first, the truth is that it can create traps that will impede your ability to achieve RPA at scale. In fact, scaling RPA into the organizational structure is fundamentally different from implementing a conventional software product or other process automation."
– Blueprint
Degree of Required BPA Support
Technology Integration & Compatibility
Good Practices Toolkit
Controls & Measures
A single body and platform to coordinate, execute, and manage all automation solutions.

Distributed
Automation solutions are locally delivered and managed whether that is per business unit, type of technology, or vendor. Some collaboration and integration can occur among solutions but might be done without a holistic strategy or approach.

Hybrid
Automation solutions are locally delivered and managed and executed for isolated use cases. Broader and complex automations are centrally orchestrated and administered.

"Companies tend to underestimate the complexity of their business processes – and bots will frequently malfunction without an RPA design team that knows how to anticipate and prepare for most process exceptions. Unresolved process exceptions rank among the biggest RPA challenges, prompting frustrated users to revert to manual work."
– Eduardo Diquez, Auxis, 2020
Scenarios
Automation Operations
How will chaining multiple BPA technologies together impact your operating budget? Is there a limit on the number of active automations you can have at a single time?
User Licenses
How many users require access to the designer, orchestrator, and other functions of the BPA solution? Do they also require access to dependent applications, services, and databases?
System Enhancements
Are application and system upgrades and modernizations needed to support BPA? Is your infrastructure, data, and security controls capable of handling BPA demand?
Supporting Resources
Are dedicated resources needed to support, govern, and manage BPA across business and IT functions? Are internal resources or third-party providers preferred?
Training & Onboarding
Are end users and supporting resources trained to deliver, support, and/or use BPA? How will training and onboarding be facilitated: internally or via third party providers?
Your supportive body is a cross-functional group of individuals promoting collaboration and good BPA practices. It enables an organization to extract the full benefits from critical systems, guides the growth and evolution of strategic BPA implementations, and provides critical expertise to those that need it. A supportive body distinctly caters to optimizing and strengthening BPA governance, management, and operational practices for a single technology or business function or broadly across the entire organization encompassing all BPA capabilities.
See our Maximize the Benefits from Enterprise Applications With a Center of Excellence blueprint for more information.
What are my options?
Center of Excellence (CoE)
AND
Community of Practice (CoP)

As BPA scales, users and teams must not only think of how a BPA solution operates at a personal and technical level or what goals it is trying to achieve, but why it is worth doing and how the outcomes of the automated process will impact the organization's reputation, morality, and public perception.

"I think you're going to see a lot of corporations thinking about the corporate responsibility of [organizational change from automation], because studies show that consumers want and will only do business with socially responsible companies."
– Todd Lohr
Source: Appian, 2018.
Vision & Objectives
Clear direction and goals of the business process automation practice.
Governance
Defined BPA roles and responsibilities, processes, and technology controls.
Skills & Competencies
The capabilities users and support roles must have to be successful with BPA.
Business Process Management & Optimization
The tactics to document, analyze, optimize, and monitor business processes.
Business Process Automation Delivery
The tactics to review the fit of automation solutions and deliver and support according to end user needs and preferences.
Business Process Automation Platform
The capabilities to manage BPA platforms and ensure it supports the growing needs of the business.
Record the results in the 4. Readiness Assessment tab in Info-Tech's Scale Business Process Automation Readiness Assessment.
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Alston, Roland. "With the Rise of Intelligent Automation, Ethics Matter Now More than Ever." Appian, 4 Sept. 2018. Web.
"Challenges of Achieving RPA at Scale." Blueprint, N.d. Web.
Dilmegani, Cem. "RPA Benefits: 20 Ways Bots Improve Businesses in 2023," AI Multiple, 9 Jan 2023. Web.
Diquez, Eduardo. "Struggling To Scale RPA? Discover The Secret to Success." Auxis, 30 Sept. 2020. Web.
"How much does Robotic Process Automation (RPA) Really Cost?" Blueprint, 14 Sept. 2021. Web.
"Liverpool City Council improves document process with Nintex." Nintex, n.d. Web.
"The State of Low-Code/No-Code." Creatio, 2021. Web.
"Using automation to enhance security and increase IT NPS to 90+ at Nutanix." Workato, n.d. Web.
"What Is Hyperautomation? A Complete Guide To One Of Gartner's Top Tech Trends." Stefanini Group, 26 Mar. 2021. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
The Launch the Project phase will walk through completing Info-Tech's project charter template. This phase will help build a balanced project team, create a change message and communication plan, and achieve buy-in from key stakeholders.
The Identify and Define Enterprise Services phase will help to target enterprise services offered by the IT team. They are offered to everyone in the organization, and are grouped together in logical categories for users to access them easily.
After completing this phase, all services IT offers to each LOB or functional group should have been identified. Each group should receive different services and display only these services in the catalog.
Completing the Services Definition Chart will help the business pick which information to include in the catalog. This phase also prepares the catalog to be extended into a technical service catalog through the inclusion of IT-facing fields.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
The purpose of this module is to help engage IT with business decision making.
This module will help build a foundation for the project to begin. The buy-in from key stakeholders is key to having them take onus on the project’s completion.
1.1 Assemble the project team.
1.2 Develop a communication plan.
1.3 Establish metrics for success.
1.4 Complete the project charter.
A list of project members, stakeholders, and a project leader.
A change message, communication strategy, and defined benefits for each user group.
Metrics used to monitor the usefulness of the catalog, both from a performance and monetary perspective.
A completed project charter to engage users in the initiative.
The purpose of this module is to review services which are offered across the entire organization.
A complete list of enterprise services defined from the user’s perspective to help them understand what is available to them.
2.1 Identify enterprise services used by almost everyone across the organization.
2.2 Categorize services into logical groups.
2.3 Define the services from the user’s perspective.
A complete understanding of enterprise services for both IT service providers and business users.
Logical groups for organizing the services in the catalog.
Completed definitions in business language, preferably reviewed by business users.
The purpose of this module is to define the remaining LOB services for business users, and separate them into functional groups.
Business users are not cluttered with LOB definitions that do not pertain to their business activities.
Business users are provided with only relevant IT information.
3.1 Identify the LOBs.
3.2 Determine which one of two methodologies is more suitable.
3.3 Identify LOB services using appropriate methodology.
3.4 Define services from a user perspective.
A structured view of the different functional groups within the business.
An easy to follow process for identifying all services for each LOB.
A list of every service for each LOB.
Completed definitions in business language, preferably reviewed by business users.
The purpose of this module is to guide the client to completing their service record definitions completely.
This module will finalize the deliverable for the client by defining every user-facing service in novice terms.
4.1 Understand the components to each service definition (information fields).
4.2 Pick which information to include in each definition.
4.3 Complete the service definitions.
A selection of information fields to be included in the service catalog.
A selection of information fields to be included in the service catalog.
A completed service record design, ready to be implemented with the right tool.
The catalog defines, documents, and organizes the services that IT delivers to the organization. The catalog also describes the features of the services and how the services are intended to be used.
The user-facing service catalog creates benefits for both the business and IT.
User-friendly, intuitive, and simple overview of the services that IT provides to the business.
The items you would see on the menu at a restaurant are an example of User Facing. The content is relatable and easy to understand.
Series of technical workflows, supporting services, and the technical components that are required to deliver a service.
The recipe book with cooking instructions is an example of Technical Facing. This catalog is intended for the IT teams and is “behind the scene.”
The sum of the people, processes, and technologies required to enable users to achieve a business outcome is a Service.
A service is used directly by the end users and is perceived as a coherent whole.
Business Users →Service = Application & Systems + People & Processes
In other words, put on your user hat and leave behind the technical jargons!
|
|
|
|
23% of IT is still viewed as a cost center. |
47% of business executives believe that business goals are going unsupported by IT. |
92% of IT leaders see the need to prove the business value of IT’s contribution. |
|
How a Service Catalog can help: |
||
|---|---|---|
|
Use the catalog to demonstrate how IT is an integral part of the organization and IT services are essential to achieve business objectives. |
Transform the perception of IT by articulating all the services that are provided through the service catalog in a user-friendly language. Source: Info-Tech Benchmarking and Diagnostic Programs |
Increase IT-business communication and collaboration through the service catalog initiative. Move from technology focused to service-oriented. |
The team must be balanced between representatives from the business and IT.
Communication plan to facilitate input from both sides and gain adoption.
Metrics should reflect the catalog benefits. Look to reduced number of service desk inquiries.
Project charter helps walk you through project preparation.
2.1 Identify the services that are used across the entire organization.
2.2 Users must be able to identify with the service categories.
2.3 Create basic definitions for enterprise services.
3.1 Identify the different lines of business (LOBs) in the organization.
3.2 Understand the differences between our two methodologies for identifying LOB services.
3.3 Use methodology 1 if you have thorough knowledge of the business.
3.4 Use methodology 2 if you only have an IT view of the LOB.
4.1 Understand the different components to each service definition, or the fields in the service record.
4.2 Identify which information to include for each service definition.
4.3 Define each enterprise service according to the information and field properties.
4.3 Define each LOB service according to the information and field properties.
Trying to implement too many services at once can be overwhelming for both IT and the users. You don’t have to define and implement all of your services in one release of the catalog.
Info-Tech recommends implementing services themselves in batches, starting with enterprise, and then grouping LOB services into separate releases. Why? It benefits both IT and business users:
Improve IT’s visibility within the organization by creating a single source of information for all the value creating services IT has to offer. The service catalog helps the business understand the value IT brings to each service, each line of business, and the overall organization.
The service catalog contains information which empowers business users to access IT services and information without the help of IT support staff. The reduction in routine inquiries decreases workload and increases morale within the IT support team, and allows IT to concentrate on providing higher value services.
Service catalog brings more control to your IT environment by reducing shadow IT activities. The service catalog communicates business requests responsively in a language the business users understand, thus eliminating the need for users to seek outside help.
The language of IT is often confusing for the business and the users don’t know what to do when they have a concern. With a user-facing service catalog, business users can access information through a single source of information, and better understand how to request access or receive support for a service through clear, consistent, and business-relevant language.
The service catalog enables users to “self-serve” IT services. Instead of calling the service desk every time an issue occurs, the users can rely on the service catalog for information. This simplified process not only reduces routine service requests, but also provides information in a faster, more efficient manner that increases productivity for both IT and the business.
With every service clearly defined, business users can better understand the current support level, communicate their expectation for IT accountability, and help IT align services with critical business strategies.
A project charter template with a few samples completed. The project charter helps you govern the project progress and responsibilities.
A full list of enterprise definitions with features and descriptions pre-populated. These are meant to get you on your feet defining your own enterprise services, or editing the ones already there.
Similar to the enterprise services deliverable, but with two separate deliverables focusing on different perspectives – functional groups services (e.g. HR and finance) and industry-specific services (e.g. education and government).
Get a taste of a completed service catalog with full service definitions and service record design. This is the final product of the service catalog design once all the steps and activities have been completed.
Need an IT-friendly breakdown of each service?
Keep better record of what technical components are required to deliver a service. The technical service catalog is the IT version of a user-facing catalog.
Want to know how much each IT service is costing you?
Get a better grip on the true cost of IT. Using service-based costing can help justify IT expenses and increase budgetary allotment.
Want to hold each business unit accountable for the IT services they use?
Some business units abuse their IT services because they are thought to be free. Keep them accountable and charge them for what they use.
No matter what size organization you may be, every organization can create a service catalog. Small businesses can benefit from the catalog the same way a large organization can. We have an easy step-by-step methodology to help introduce a catalog to your business.
It is common that users do not know where to go to obtain services from IT… We always end up with a serious time-crunch at the beginning of a new school year. With automated on- and off-boarding services, this could change for the better.
– Dean Obermeyer, Technology Coordinator, Los Alamos Public Schools
As the CIO and the project sponsor, you need to spearhead the development of the service catalog and communicate support to drive engagement and adoption.
The project leader acts on behalf of the CIO and must be a senior level staff member who has extensive knowledge of the organization and experiences marshalling resources.
Developing a service catalog requires dedication from many groups within IT and outside of IT.
The project leader must hold a visible, senior position and can marshal all the necessary resources to ensure the success of the project. Ability to exert impact and influence around both IT and the business is a must.
The user-facing service catalog cannot be successful if business input is not received.
The project leader must leverage his/her existing relationship with the business to test out the service definitions and the service record design.
Creating a service catalog is not an easy job and the project leader must continuously engage the team members to drive results and efficiency.
The highly visible nature of the service catalog means the project leader must produce a high-quality outcome that satisfies the business users.
Municipal Government
The IT department of a large municipal government in the United States provides services to a large number of customers in various government agencies.
Service Catalog Initiative
The municipal government allocated a significant amount of resources to answer routine inquiries that could have been avoided through user self-service. The government also found that they do not organize all the services IT provides, and they could not document and publish them to the customer. The government has already begun the service catalog initiative, but was struggling with how to identify services. Progress was slow because people were arguing amongst themselves – the project team became demoralized and the initiative was on the brink of failure.
Results
With Info-Tech’s onsite support, the government was able to follow a standardized methodology to identify and define services from the user perspective. The government was able to successfully communicate the initiative to the business before the full adoption of the service catalog.
We’re in demos with vendors right now to purchase an ITSM tool, and when the first vendor looked at our finished catalog, they were completely impressed.
- Client Feedback
[We feel] very confident. The group as a whole is pumped up and empowered – they're ready to pounce on it. We plan to stick to the schedule for the next three months, and then review progress/priorities. - Client Feedback
Healthcare Provider
The organization is a healthcare provider in Canada. It treats patients with medical emergencies, standard operations, and manages a faculty of staff ranging from nurses and clerks, to senior doctors. This organization is run across several hospitals, various local clinics, and research centers.
Service Catalog Initiative
Because the organization is publicly funded, it is subject to regular audit requirements – one of which is to have a service catalog in place.
The organization also would like to charge back its clients for IT-related costs. In order to do this, the organization must be able to trace it back to each service. Therefore, the first step would be to create a user-facing service catalog, followed by the technical service catalog, which then allows the organization to do service-based costing and chargeback.
Results
By leveraging Info-Tech’s expertise on the subject, the healthcare provider was able to fast-track its service catalog development and establish the groundwork for chargeback abilities.
"There is always some reticence going in, but none of that was apparent coming out. The group dynamic was very good. [Info-Tech] was able to get that response, and no one around the table was silent.
The [expectation] of the participants was that there was a purpose in doing the workshop. Everybody knew it was for multiple reasons, and everyone had their own accountability/stakes in the development of it. Highly engaged." - Client Feedback
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
|
Launch the Project |
Identify Enterprise Services |
Identify Line of Business Services |
Complete Service Definitions |
|
|---|---|---|---|---|
| Best-Practice Toolkit |
1.1 Assemble the project team. 1.2 Develop a communication plan. 1.3 Establish metrics for success. 1.4 Complete the project charter. |
2.1 Identify services available organization-wide. 2.2 Categorize services into logical groups. 2.3 Define the services. |
3.1 Identify different LOBs. 3.2 Pick one of two methodologies. 3.3 Use method to identify LOB services. |
4.1 Learn components to each service definition. 4.2 Pick which information to include in each definition. 4.3 Define each service accordingly. |
| Guided Implementations | Identify the project leader with the appropriate skills.
Assemble a well-rounded project team. Develop a mission statement and change messages. |
Create a comprehensive list of enterprise services that are used across the organization.
Create a categorization scheme that is based on the needs of the business users. |
Walk through the two Info-Tech methodologies and understand which one is applicable. Define LOB services using the appropriate methodology. |
Decide what should be included and what should be kept internal for the service record design. Complete the full service definitions. |
| Onsite Workshop | Phase 1 Results: Clear understanding of project objectives and support obtained from the business. |
Phase 2 Results: Enterprise services defined and categorized. |
Phase 3 Results: LOB services defined based on user perspective. |
Phase 4 Results: Service record designed according to how IT wishes to communicate to the business. |
Contact your account representative or email Workshops@InfoTech.com for more information.
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | |
|---|---|---|---|---|
| Activities | Launch the Project | Identify Enterprise Services | Identify Line of Business Services | Complete Service Definitions |
1.1 Assemble the project team. 1.2 Develop a communication plan. 1.3 Establish metrics for success. 1.4 Complete the project charter. | 2.1 Identify services available organization-wide. 2.2 Categorize services into logical groups. 2.3 Define the services. | 3.1 Identify different LOBs. 3.2 Pick one of two methodologies. 3.3 Use method to identify LOB services. | 4.1 Learn components to each service definition. 4.2 Pick which information to include in each definition. 4.3 Define each service accordingly. | |
| Deliverables |
|
|
|
|
Design & Build a User-Facing Service Catalog
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Guided Implementation 1: Launch the project Proposed Time to Completion: 2 weeks |
|
|---|---|
| Step 1.2: Create change messages |
Step 1.2: Create change messages |
|
Start with an analyst kick off call:
|
Review findings with analyst:
|
|
Then complete these activities… |
Then complete these activities… |
|
With these tools & templates: Service Catalog Project Charter |
With these tools & templates: Service Catalog Project Charter |
The following section of slides outline how to effectively use Info-Tech’s sample project charter.
The Project Charter is used to govern the initiative throughout the project. IT should provide the foundation for project communication and monitoring.
It has been pre-populated with information appropriate for Service Catalog projects. Please review this sample text and change, add, or delete information as required.
Building the charter as a group will help you to clarify your key messages and help secure buy-in from critical stakeholders upfront.
You may feel like a full charter isn’t necessary, and depending on your organizational size, it might not be. However, the exercise of building the charter is important none-the-less. No matter your current climate, some elements of communicating the value and plans for implementing the catalog will be necessary.
Use Info-Tech’s Service Catalog Project Charter.
Good mission statements are directive, easy to understand, narrow in focus, and favor substance over vagueness.
While building your mission statement, think about what it is intended to do, i.e. keep the project team engaged and engage others to adopt the service catalog. Included in the project charter’s mission statement section is a brief description of the goals and objectives of the service catalog.
Info-Tech’s project charter contains two sample mission statements, along with additional tips to help you create yours.
Project leader will be the main catalyst for the creation of the catalog. This person is responsible for driving the whole initiative.
IT project participants’ input and business input will be pivotal to the creation of the catalog.
The project stakeholders are the senior executives who have a vested interest in the service catalog. IT must produce periodic and targeted communication to these stakeholders.
Your project team will be a major success factor for your service catalog. Involvement from IT management and the business is a must.
IT Service Desk Manager
Senior Manager/Director of Application
Senior Manager/Director of Infrastructure
Business IT Liaison
Business representatives from different LOBs
Input your project team, their roles, and relevant contact information into your project charter, Section 2.
Obtain explicit buy-in from both IT and business stakeholders.
The stakeholders could be your biggest champions for the service catalog initiative, or they could pull you back significantly. Engage the stakeholders at the start of the project and communicate the benefits of the service catalog to them to gain their approval.
| Stakeholders |
Benefits |
|---|---|
| CIO |
|
|
Manager of Service Desk |
|
|
Senior Manager/Director of Application & Infrastructure |
|
|
Senior Business Executives from Major LOBs |
|
Document a list of stakeholders, their involvement in the process (why they are stakeholders), and their contact information in Section 3.
Spread the word of service catalog implementation. Bring attention to your change message through effective mediums and organizational changes.
The methods of communication (e.g. newsletters, email broadcast, news of the day, automated messages) notify users of implementation.
In addition, it is important to know who will deliver the message (delivery strategy). Talking to the business leaders is very important, and you need IT executives to deliver the message. Work hard on obtaining their support as they are the ones communicating to their staff and could be your project champions.
The communication plan should consist of changes that will affect the way users interact with the catalog. Users should know of any meetings pertinent to the maintenance and improvement of the catalog, and ways to access the catalog (e.g. link on desktop/start menu).
The Qualities of Leadership: Leading Change
Your communication plan should serve as a rough guide. Communication happens in several unpredictable happenstances, but the overall message should be contained within.
One of the top challenges for organizations that are implementing a service catalog is the acceptance and adoption of the change. Effective planning for implementation and communication is pivotal. Ensure you create tailored plans for communication and understand how the change will impact staff.
“Better Service, Better Value.” It is important to have two change messages prepared: one for the IT department and one for business users.
Outline a few of the key benefits each user group will gain from adopting the service catalog (e.g. Faster, ease of use, convenient, consistent…)
Anticipate some resistances of service catalog adoption and prepare responses. These may be the other benefits which were not included in the change message (e.g. IT may be reluctant to think in business language.)
Host lunch & learns to demonstrate the value of the service catalog to both business and IT user groups.
These training sessions also serve as a great way to gather feedback from users regarding style and usability.
Pick your communication medium, and then identify your target audience. You should have a change message for each: the IT department and the business users. Pay careful consideration to wording and phrasing with regard for each.
In order to measure the success of your service catalog, you must establish baseline metrics to determine how much value the catalog is creating for your business.
The number of service catalog requests should be carefully monitored so that it does not fluctuate too greatly. In general, the number of requests via the service catalog should increase, which indicates a higher level of self-serve.
The number of inquiry calls should decrease because customers are able to self-serve routine IT inquiries that would otherwise have gone through the service desk.
The organization could adopt the following sample survey questions:
From 0-5: How satisfied are you with the functionality of the service catalog? How often do you turn to the service catalog first to solve IT problems?
The number of non-standard requests should decrease because a majority of services should eventually be covered in the service catalog. Users should be able to solve nearly any IT related problem through navigating the service catalog.
| Metric Description | Current Metric | Future Goal |
|---|---|---|
| Number of service requests via the Service Catalog | ||
| Number of inquiry calls to the service desk | ||
| Customer Satisfaction – specific question | ||
| Number of non-standard requests |
When measuring against your baseline, you should expect to see the following two monetary improvements:
(# of routine inquiry calls reduced) x (average time for a call) x (average service desk wage)
Routine inquiries often take up a significant portion of the service desk’s effort, and the majority of them can be answered via the service catalog, thus reducing the amount of time required for a service desk employee to engage in routine solutions. The reduction in routine inquiries allows IT to allocate resources to high-value services and provide higher quality of support.
Originally, the service desk of an organization answers 850 inquiries per month, and around 540 of them are routine inquiries requesting information on when a service is available, who they can contact if they want to receive a service, and what they need to do if they want access to a service, etc.
IT successfully communicated the introduction of the service catalog to the business and 3 months after the service catalog was implemented, the number of routine inquiries dropped to 60 per month. Given that the average time for IT to answer the inquiry is 10 minutes (0.167 hour) and the hourly wage of a service desk technician is $25, the monthly monetary cost saving of the service catalog is:
(540 – 60) x 0.167 x 25 = $2004.00
(Average additional cost of non-standard request) x (Reduction of non-standard request)
+
(Extra time IT spends on non-standard request fulfilment) x (Average wage)
Non-standard requests require a lot of time, and often a lot of money. IT frequently incurs additional cost because the business is not aware of how to properly request service or support. Not only can the service catalog standardize and streamline the service request process, it can also help IT define its job boundary and say no to the business if needed.
The IT department of an organization often finds itself dealing with last-minute, frustrating service requests from the business. For example, although equipment requests should be placed a week in advance, the business often requests equipment to be delivered the next day, leaving IT to pay for additional expedited shipping costs and/or working fanatically to allocate the equipment. Typically, these requests happen 4 times a month, with an additional cost of $200.00. IT staff work an extra 6 hours per each non-standard request at an hourly wage of $30.00.
With the service catalog, the users are now aware of the rules that are in place and can submit their request with more ease. IT can also refer the users to the service catalog when a non-standard request occurs, which helps IT to charge the cost to the department or not meet the terms of the business.
The monthly cost saving in this case is:
$200.00 x 4 + 6 hours x 30 = $980.00
The project charter is an important document to govern your project process. Support from the project sponsors is important and must be documented. Complete the following steps working with Info-Tech’s sample Project Charter.
The nature of government IT is quite complex: there are several different agencies located in a number of different areas. It is extremely important to communicate the idea of the service catalog to all the users, no matter the agency or location.
The IT department had yet to let business leaders of the various agencies know about the initiative and garner their support for the project. This has proven to be prohibitive for gaining adoption from all users.
The IT leaders met and identified all the opportunities to communicate the service catalog to the business leaders and end users.
To meet with the business leaders, IT leaders hosted a service level meeting with the business directors and managers. They adopted a steering committee for the continuation of the project.
To communicate with business users, IT leaders published announcements on the intranet website before releasing the catalog there as well.
Because IT communicated the initiative, support from business stakeholders was obtained early and business leaders were on board shortly after.
IT also managed to convince key business stakeholders to become project champions, and leveraged their network to communicate the initiative to their employees.
With this level of adoption, it meant that it was easier for IT to garner business participation in the project and to obtain feedback throughout.
The project received buy-in from the CIO and director of infrastructure. Together they assembled a team and project leader.
The two struggled to get buy-in from the rest of the team, however. They didn’t understand the catalog or its benefits and objectives. They were reluctant to change their old ways. They didn’t know how much work was required from them to accomplish the project.
With the Info-Tech analyst on site, the client was able to discuss the benefits within their team as well as the project team responsibilities.
The Info-Tech analyst convinced the group to move towards focusing on a business- and service-oriented mindset.
The workshop discussion was intended to get the entire team on board and engaged with meeting project objectives.
The project team had experienced full buy-in after the workshop. The CIO and director relived their struggles of getting project members on-board through proper communication and engagement.
Engaging the members of the project team with the discussion was key to having them take ownership in accomplishing the project.
The business users understood that the service catalog was to benefit their long-term IT service development.
| The following are sample activities that will be conducted by Info-Tech analysts with your team: | ||
|---|---|---|
| 1.1 |
|
Begin your project with a mission statement A strong mission statement that outlines the benefits of the project is needed to communicate the purpose of the project. The onsite Info-Tech analysts will help you customize the message and establish the foundation of the project charter. |
| 1.2 |
|
Identify project team members Our onsite analysts will help you identify high-value team members to contribute to this project. |
| 1.3 |
|
Identify important business and IT stakeholders Buy-in from senior IT and business management is a must. Info-Tech will help you identify the stakeholders and determine their level of influence and impact. |
| 1.4 |
|
Create a change message for the business and IT It is important to communicate changes early and the message must be tailored for each target audience. Our analysts will help you create an effective message by articulating the benefits of the service catalog to the business and to IT. |
| 1.5 |
|
Determine service project metrics To demonstrate the value of the service catalog, IT must come up with tangible metrics. Info-Tech’s analysts will provide some sample metrics as well as facilitate a discussion around which metrics should be tracked and monitored. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Guided Implementation 2: Define Enterprise Services Proposed Time to Completion: 4 weeks | |
|---|---|
Step 2.1: Identify enterprise services | Step 2.2: Create service categories |
Start with an analyst kick off call:
| Review findings with analyst:
|
Then complete these activities…
| Then complete these activities…
|
With these tools & templates: Service Sample Enterprise Services | With these tools & templates: Sample Enterprise Services |
Documentation of all business-facing IT services is an intimidating task, and a lack of parameters around this process often leads to longer project times and unsatisfactory outcomes.
To streamline this process, separating enterprise services from line of business services allows IT to effectively and efficiently organize these services. This method increases the visibility of the service catalog through user-oriented communication plans.
If you are unsure whether a service is enterprise wide, ask yourself these two questions:
Included with this blueprint is Info-Tech’s Sample Enterprise Services definitions.
The sample contains dozens of services common across most organizations; however, as a whole, they are not complete for every organization. They must be modified according to the business’ needs. Phase two will serve as a guide to identifying an enterprise service as well as how to fill out the necessary fields.
Keep track of which services you either modify or delete. You will have to change the same services in the final Info-Tech deliverable.
The next slide will introduce you to the information for each service record that can be edited.
Below is an example of a service record and its necessary fields of information. This is information that can be kept, deleted, or expanded upon.
|
Name the service unambiguously and from the user’s perspective. |
Brief description of how the service allows users to perform tasks. |
Describe the functionality of the service and how it helps users to achieve their business objectives. |
Cluster the services into logical groups. |
| Service Name | Description | Features | Category |
|---|---|---|---|
| Email communication to connect with other employees, suppliers, and customers |
|
Communications |
Web Conferencing has already been defined as a service. Is Audio Conferencing its own service or a feature of Web Conferencing?
Info-Tech Tip: Is Audio Conferencing run by the same application as the Web Conferencing? Does it use the same equipment? If not, Audio Conferencing is probably its own service.
Web Conferencing has already been defined as a service. Is “Screen Sharing” its own service or a feature of Web Conferencing?
Info-Tech Tip: It depends on how the user interacts with Screen Sharing. Do they only screen share when engaged in a Web Conference? If so, Screen Sharing is a feature and not a service itself.
VoIP is a popular alternative to landline telephone nowadays, but should it be part of the telephony service or a separate service?
Info-Tech Tip: It depends on how the VoIP phone is set up.
If the user uses the VoIP phone the same way they would use a landline phone – because the catalog is user facing – consider the VoIP as part of the telephone service.
If the user uses their computer application to call and receive calls, consider this a separate service on its own.
While there are some best practices for coming up with service definitions, it is not an exact science and you cannot accommodate everyone. When in doubt, think how most users would perceive the service.
You need to be as comprehensive as possible and try to capture the entire breadth of services IT provides to the business.
To achieve this, a three-step process is recommended.
IT Focus Group:
Have your user hat on when documenting service features and descriptions. Try to imagine how the users interact with each service.
Similar to the services and their features, there is no right or wrong way to categorize. The best approach is to do what makes sense for your organization and understand what your users think.
Categories organize services into logical groups that the users can identify with. Services with similar functions are grouped together in a common category.
| Enterprise Service Categories |
|---|
| Accounts and Access |
| Collaboration |
| Communication |
| Connectivity |
| Consulting |
| Desktop, Equipment, & Software |
| Employee Services |
| Files and Documents |
| Help & Support |
| Training |
Sample categories
There is no right or wrong way to categorize services; it is subjective to how they are provided by IT and how they are used by the business. Use the aforementioned categories to group the following services. Sample solutions are provided on the following slide.
| Service Name |
|---|
| Telephone |
| Remote access |
| Internet |
| BYOD (wireless access) |
| Instant Messaging |
| Video Conferencing |
| Audio Conferencing |
| Guest Wi-Fi |
| Document Sharing |
| Example 1 | Example 2 | ||
|---|---|---|---|
|
Desktop, Equipment, & Software Services |
Connectivity |
Mobile Devices |
Communications |
|
Internet |
Telephone |
BYOD (wireless access) |
Telephone |
|
Guest Wi-Fi |
Internet |
|
|
|
Remote Access |
Instant Messaging |
||
|
Video Conferencing |
|||
|
Audio Conferencing |
|||
| Communications |
Collaboration |
Storage and Retrieval |
Accounts and Access |
|
Telephone |
|
Document Sharing |
Remote access |
|
Instant Messaging |
Connectivity |
||
|
Mobile Devices |
Video Conferencing |
Internet | |
|
BYOD (wireless access) |
Audio Conferencing |
Guest Wi-Fi |
|
|
Guest Wi-Fi |
Document Sharing |
||
Services can have multiple categories only if it means the users will be better off. Try to limit this as much as possible.
Neither of these two examples are the correct answer, and no such thing exists. The answers you came up with may well be better suited for the users in your business.
Before you start, you must have a modified list of all defined enterprise services and a modified list of categories.
Because of the breadth of services IT provides across several agencies, it was challenging to identify what was considered enterprise beyond just the basic ones (email, internet, etc.)
IT recognized that although the specific tasks of service could be different, there are many services that are offered universally across the organization and streamlining the service request and delivery process would reduce the burden on IT.
The client began with services that users interact with on a daily basis; this includes email, wireless, telephone, internet, printing, etc.
Then, they focused on common service requests from the users, such as software and hardware provisioning, as well as remote access.
Lastly, they began to think of other IT services that are provided across the organization, such as RFP/RFI support, project management analysis, employee onboarding/off-boarding, etc.
By going through the lists and enterprise categories, the government was able to come up with a comprehensive list of all services IT provides to the business.
Classifying services such as onboarding meant that IT could now standardize IT services for new recruits and employee termination.
By capturing all enterprise services offered to the organization, IT centralized its management of services instead of having scattered request processes.
For some services, the project team had difficulty deciding on what was a service and what was a feature. They found it hard to distinguish between a service with features or multiple services.
For example, the client struggled to define the Wi-Fi services because they had many different user groups and different processes to obtain the service. Patients, visitors, doctors, researchers, and corporate employees all use Wi-Fi, but the service features for each user group were different.
The Info-Tech analyst came on-site and engaged the project team in a discussion around how the users would view the services.
The analyst also provided tips and techniques on identifying services and their features.
Because patients and visitors do not access Wi-Fi or receive support for the service in the same way as clinical or corporate employees, Wi-Fi was separated into two services (one for each user group).
Using the tips and techniques that were provided during the onsite engagement, the project team was able to have a high degree of clarity on how to define the services by articulating who the authorized users are, and how to access the process.
This allowed the group to focus on the users’ perspective and create clear, unambiguous service features so that users could clearly understand eligibility requirements for the service and how to request them.
| The following are sample activities that will be conducted by Info-Tech analysts with your team: | ||
|---|---|---|
| 2.1 |
|
Understand what enterprise services are The project team must have a clear understanding of what qualifies as an enterprise service. The onsite analysts will also promote a user-oriented mindset so the catalog focuses on business needs. |
| 2.2 |
|
Identify enterprise services The Info-Tech analysts will provide a list of ready-to-use services and will work with the project team to change, add, and delete service definitions and to customize the service features. |
| 2.3 |
|
Identify categories for enterprise services The Info-Tech analyst will again emphasize the importance of being service-oriented rather than IT-oriented. This will allow the group to come up with categories that are intuitive to the users. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Guided Implementation 3: Define LOB Services Proposed Time to Completion: 4 weeks | |
|---|---|
Step 3.1: Identify LOB services | Step 3.2: Define LOB services |
Start with an analyst kick off call:
| Review findings with analyst:
|
Then complete these activities…
| Then complete these activities…
|
With these tools & templates: Service LOB Services – Functional Group | With these tools & templates: LOB Services – Functional Group |
Within a business unit, there are user groups that use unique applications and IT services to perform business activities. IT must understand which group is consuming each service to document to their needs and requirements. Only then is it logical to group services into lines of business.
Covering every LOB service is a difficult task. Info-Tech offers two approaches to identifying LOB services, though we recommend working alongside business user groups to have input on how each service is used directly from the users. Doing so makes the job of completing the service catalog easier, and the product more detailed and user friendly.
Some helpful questions to keep in mind when characterizing user groups:
With business user input, you can answer questions as specific as “What requirements are necessary for IT to deliver value to each line of business?” and “What does each LOB need in order to run their operation?”
Business View is the preferred method for IT departments with a better understanding of business operations. This is because they can begin with input from the user, enabling them to more successfully define every service for each user group and LOB.
In addition, IT will also have a chance to work together with the business and this will improve the level of collaboration and communication. However, in order to follow this methodology, IT needs to have a pre-established relationship with the business and can demonstrate their knowledge of business applications.
The IT view begins with considering each business application used within the organization’s lines of business. Start with a broad view, following with a process of narrowing down, and then iterate for each business application.
This process leads to each unique service performed by every application within the business’ LOBs.
The IT view does not necessarily require a substantial amount of information about the business procedures. IT staff are capable of deducing what business users often require to maintain their applications’ functionality.
If you do have knowledge of business operations, using the business view is the better option and the service definition will be more relatable to the users.
For organizations that don’t have established relationships with the business or detailed knowledge of business activities, IT can decompose the application into services. They have more familiarity and comfort with the business applications than with business activities.
It is important to continue after the service is identified because it helps confirm and solidify the names and features. Determining the business activity and the user groups can help you become more user-oriented.
We will illustrate the two methodologies with the same example.
If you have established an ongoing relationship with the business and you are familiar with their business operations, starting with the LOB and user groups will ensure you cover all the services IT provides to the business and create more relatable service names.
If you want to understand what services IT provides to the Sales functional group, and you don’t have comprehensive knowledge of the department, you need to start with the IT perspective.
If you are concerned about the fact that people always associate a service with an application, you can include the application in the service name or description so users can find the service through a search function.
Like categories for enterprise services in Phase Two, LOB services are grouped into functional groups. Functional groups are the components of an organizational chart (HR, Finance, etc.) that are found in a company’s structure.
Functional groups enable a clear view for business users of what services they need, while omitting services that do not apply to them. This does not overwhelm them, and provides them with only relevant information.
To be clear, industry services can be put into functional groups.
Info-Tech provides a few sample industry services (without their functional group) to give an idea of what LOB service is specific to these industries. Try to extrapolate from these examples to create LOB services for your business.
Use Info-Tech’s Sample LOB Services – Functional Group and Sample LOB Services – Industry Specific documents.
Keep track of which services you either modify or delete. You will have to change the same services in the final Info-Tech deliverable.
Only perform this activity if you have a relationship with the business that can enable you to generate business input on service identifications and definitions.
In a group of your project participants, repeat the sequence for each LOB.
Only perform this activity if you cannot generate business input through your relationships, and must begin service definitions with business applications.
In a group of your project participants, repeat the sequence for each application.
→ Optional
Coming up with LOB service definitions is challenging for IT because it requires comprehension of all lines of business within the organization as well as direct interaction with the business users.
After completing the LOB service definitions, IT must talk to the business to ensure all the user groups and business activities are covered and all the features are accurate.
Here are some tips to reviewing your LOB Service Catalog generated content:
Go through the service in batches. Present 5-10 related services to the business first. Start with the service name and then focus on the features.
In the meeting, discuss whether the service features accurately sum up the business activities, or if there are missing key activities. Also discuss whether certain services should be split up into multiple services or combined into one.
There were many users from different LOBs, and IT provided multiple services to all of them. Tracking them and who had access to what was difficult.
IT didn’t understand who provided the services (service owner) and who the customers were (business owner) for some of the services.
After identifying the different Lines of Business, they followed the first approach (Business View) for those that IT had sufficient knowledge of in terms of business operations:
For the LOBs they weren’t familiar with, they used the IT view method, beginning with the application:
Through these two methodologies, IT was able to define services according to how the users both perceive and utilize them.
IT was able to capture all the services it provides to each line of business effectively without too much help from the business representatives.
By capturing all enterprise services offered to the organization, IT centralized its management of services instead of having scattered request processes.
Challenge
The organization uses a major application containing several modules used by different users for various business activities.
The challenge was to break down the application into multiple services in a way that makes sense to the business users. Users should be able to find services specific to them easily.
Therefore, the project team must understand how to map the modules to different services and user groups.
Solution
The project team identified the major lines of business and took various user groups such as nurses and doctors, figured out their daily tasks that require IT services, and mapped each user-facing service to the functionality of the application.
The project team then went back to the application to ensure all the modules and functionalities within the application were accounted for. This helped to ensure that services for all user groups were covered and prepared to be released in the catalog.
Results
Once the project team had come up with a comprehensive list of services for each line of business, they were able to sit with the business and review the services.
IT was also able to use this opportunity to demonstrate all the services it provides. Having all the LOB services demonstrates IT has done its preparation and can show the value they help create for the business in a language the users can understand. The end result was a strengthened relationship between the business and the IT department.
| The following are sample activities that will be conducted by Info-Tech analysts with your team: | ||
|---|---|---|
| 3.1 |
|
Understand what Line of Business services are The onsite analysts will provide a clear distinction between enterprise services and LOB services. The analysts will also articulate the importance of validating LOB services with the business. |
| 3.2 |
|
Identify LOB services using the business’ view There are two methods for coming up with LOB services. If IT has comprehensive knowledge of the business, they can identify the services by outlining the user groups and their business activities. |
| 3.3 |
|
Identify LOB services using IT’s view If IT does not understand the business and cannot obtain business input, Info-Tech’s analysts will present the second method, which allows IT to identify services with more comfortability through business applications/systems. |
| 3.4 |
|
Categorize the LOB services into functional groups The analysts will help the project team categorize the LOB services based on user groups or functional departments. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Guided Implementation 4: Complete service definitions | |
|---|---|
Step 4.1: Design service record | Step 4.2: Complete service definitions |
Start with an analyst kick off call:
| Review findings with analyst:
|
Then complete these activities…
| Then complete these activities…
|
With these tools & templates: Service Services Definition Chart | With these tools & templates: Services Definition Chart |
Info-Tech has provided a sample Services Definition Chart with standard service definitions and pre-populated fields. It is up to you throughout this step to decide which fields are necessary to your business users, as well as how much detail you wish to include in each of them.
Keep track of which services you either modify or delete. You will have to change the same services in the final Info-Tech deliverable.
The majority of the fields in the service catalog are user facing, which means they must be written in business language that the users can understand.
If there is any confusion or disagreement in filling out the fields, a facilitator is required to lead the working groups in coming up with a definitive answer. If a decision is still not reached, it should be escalated to the decision maker (usually the service owner).
There are IT facing fields that should not be published to the business users – they are for the benefit of IT. For example, you may want to keep Performance Metrics internal to IT until you are ready to discuss it with the business.
If the organization is interested in creating a Technical Service Catalog following this initiative, these fields will provide a helpful starting place for IT to identify the people, process, and technology required to support user-facing services.
It is important for IT-facing fields to be kept internal. If business users are having trouble with a service and the service owner’s name is available to them, they will phone them for support even if they are not the support owner.
When completing the service record, adopt the principle that “Less is More.” Keep it simple and write the service description from the user’s perspective, without IT language. From the list below, pick which fields of information are important to your business users.
What do the users need to access the service quickly and with minimal assistance?
Description: Delivers electronic messages to and from employees.
Features:
Category: Communications
Who is responsible for the delivery of the service and what are their roles?
Service owner → the IT member who is responsible and accountable for the delivery of the service.
Business owner → the business partner of the service owner who ensures the provided service meets business needs.
Service Owner: Manager of Business Solutions
Business Owner: VP of Human Resources
For enterprise services that are used by almost everyone in the organization, the business owner is the CIO.
“Who is authorized to access this service? How do they access it?”
Authorized users → who can access the service.
Request process → how to request access to the service.
Approval requirement/process → what the user needs to have in place before accessing the service.
Authorized Users: All people on site not working for the company
Request Process: Self-Service through website for external visitors
Approval Requirement/Process: N/A
Clearly defining how to access a service saves time and money by decreasing calls to the service desk and getting users up and running faster. The result is higher user productivity.
“Who is authorized to access this service? How do they access it?”
Requirements & pre-requisites → details of what must happen before a service can be provided.
Turnaround time → how much time it will take to grant access to the service.
User responsibility → What the user is expected to do to acquire the service.
Requirements & Pre-requisites: Disclaimer of non-liability and acceptance
Turnaround time: Immediate
User Responsibility: Adhering to policies outlined in the disclaimer
Clearly defining how to access a service saves time and money by decreasing calls to the service desk and getting users up and running faster. The result is higher user productivity.
“When is this service available to users? What service levels can the user expect?”
Support hours → what days/times is this service available to users?
Hours of availability/planned downtime → is there scheduled downtime for maintenance?
Performance metrics → what level of performance can the user expect for this service?
Support Hours: Standard business hours
Hours of Availability/Planned Downtime: Standard business hours; can be agreed to work beyond operating hours either earlier or later
Performance Metrics: N/A
Manage user expectations by clearly documenting and communicating service levels.
“How do I obtain support for this service?”
Support process → what is the process for obtaining support for this service?
Support owner → who can users contact for escalations regarding this service?
Support documentation → where can users find support documentation for this service?
Support Process: Contact help desk or submit a ticket via portal
Support Owner: Manager, client support
Support Documentation: .pdf of how-to guide
Clearly documenting support procedures enables users to get the help they need faster and more efficiently.
“Is there a cost for this service? If so, how much and who is expensing it?”
Internal Cost → do we know the total cost of the service?
Customer Cost → a lot of services are provided without charge to the business; however, certain service requests will be charged to a department’s budget.
Internal Cost: For purposes of audit, new laptops will be expensed to IT.
Customer Cost: Cost to rush order 10 new laptops with retina displays for the graphics team. Charged for extra shipment cost, not for cost of laptop.
Set user expectations by clearly documenting costs associated with a service and how to obtain approval for these costs if required.
This is the final activity to completing the service record design. It has been a long journey to make it here; now, all that is left is completing the fields and transferring information from previous activities.
Don’t forget to delete or bring over the edited LOB and Enterprise services from the phase 2 and 3 deliverables.
Now that you have completed the first run of service definitions, you can go back and complete the rest of the identified services in batches. You should observe increased efficiency and effectiveness in filling out the service definitions.
This blueprint’s purpose is to help you design a service catalog. There are a number of different platforms to build the catalog offered by application vendors. The sophistication of the catalog depends on the size of your business. It may be as simple as an Excel book, or something as complex as a website integrated with your service desk.
There are various levels of maturity to consider when you are thinking about how to deploy your service catalog.
| 1. Website/User Portal | 2. Catalog Module Within ITSM Tool |
3. Homegrown Solution |
|
|---|---|---|---|
|
Prerequisite |
An internet website, or a user portal |
An existing ITSM tool with a built-in service catalog module |
Database development capabilities Website development capabilities |
|
Pros |
Low cost Low effort |
Easy to deploy |
Customized solution tailored for the organization High flexibility regarding how the service catalog is published |
| Cons |
Not aesthetically appealing Lacking sophistication |
Difficult to customize to organization’s needs Limitation on how the service catalog info is published |
High effort High cost |
| → |
→ Maturity Level → |
→ |
The client had collected a lot of good information, but they were not sure about what to include to ensure the users could understand the service clearly.
They were also not sure what to keep internal so the service catalog did not increase IT’s workload. They want to help the business, but not appear as if they are capable of solving everything for everyone immediately. There was a fear of over-commitment.
The government created a Customer Responsibility field for each service, so it was not just IT who was providing solutions. Business users needed to understand what they had to do to receive some services.
The Service Owner and Business Owner fields were also kept internal so users would go through the proper request channel instead of calling Service Owners directly.
Lastly, the Performance Metrics field was kept internal until IT was ready to present service metrics to the business.
The business was provided clarity on their responsibility and what was duly owed to them by IT staff. This established clear boundaries on what was to be expected of IT services projected into the future.
The business users knew what to do and how to obtain the services provided to them. In the meantime, they didn’t feel overwhelmed by the amount of information provided by the service catalog.
There is a lack of clarity and a lack of agreement between the client’s team members regarding the request/approval processes for certain services. This was an indication that there is a level of ambiguity around process. Members were not sure what was the proper way to access a service and could not come up with what to include in the catalog.
Different people from different teams had different ways of accessing services. This could be true for both enterprise and LOB services.
The Info-Tech analyst facilitated a discussion about workflows and business processes.
In particular, the discussion focused around the approval/authorization process, and IT’s workflows required to deliver the service. The Info-Tech analyst on site walked the client through their different processes to determine which one should be included in the catalog.
The discussion brought clarity to the project team around both IT and business process. Using this new information, IT was able to communicate to the business better, and create consistency for IT and the users of the catalog.
The catalog design was a shared space where IT and business users could confer what the due process and responsibilities were from both sides. This increased accountability for both parties.
| The following are sample activities that will be conducted by Info-Tech analysts with your team: | ||
|---|---|---|
| 4.1 |
|
Determine which fields should be included in the record design The analysts will present the sample service definitions record and facilitate a discussion to customize the service record so unique business needs are captured. |
| 4.2 |
|
Determine which fields should be kept internal The onsite analysts will explain why certain fields are used but not published. The analysts will help the team determine which fields should be kept internal. |
| 4.3 |
|
Complete the service definitions The Info-Tech analysts will help the group complete the full service definitions. This exercise will also provide the organization with a clear understanding of IT workflows and business processes. |
Client Project: Design and Build a User-Facing Service Catalog
This project has the ability to fit the following formats:
Establish a Service-Based Costing Model
Develop the right level of service-based costing capability by applying our methodology.
Your newly hybrid workplace will include virtual, hybrid, and physical meetings, presenting several challenges:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the problem before you try to fix it. Before you can improve meetings, you need to understand what your norms and challenges currently are.
Document meeting roles, expectations, and how meetings should run. Decide what kind of meeting delivery model to use and develop a training program.
Always be consulting with users: early in the process to set a benchmark, during and after every meeting to address immediate concerns, and quarterly to identify trends and deeper issues.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the current state of meetings in your organization.
What you need to keep doing and what you need to change
1.1 Brainstorm meeting types.
1.2 Document meeting norms.
1.3 Document and categorize meeting challenges.
Documented challenges with meetings
Meeting norms
Desired changes to meeting norms
Review and implement meeting best practices.
Defined meeting best practices for your organization
2.1 Document meeting roles and expectations.
2.2 Review common meeting challenges and identify best practices.
2.3 Document when to use a hybrid meeting, virtual meeting, or an in-person meeting.
2.4 Develop a training program.
Meeting roles and expectations
List of meeting best practices
Guidelines to help workers choose between a hybrid, virtual, or in-person meeting
Training plan for meetings
Identify opportunities to improve meeting technology.
A strategy for improving the underlying technologies and meeting spaces
3.1 Empower virtual meeting attendees.
3.2 Optimize spaces for hybrid meetings.
3.3 Build a team of meeting champions.
3.4 Iterate to build and improve meeting technology.
3.5 Guide users toward each technology.
Desired improvements to meeting rooms and meeting technology
Charter for the team of meeting champions
Communications Guide Poster
A dynamic and streamlined policy approach will:
To accomplish this, the policy writer must engage their audience early to gather input on IT policies, increase policy awareness, and gain buy-in early in the process.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Assess your risk landscape and design a plan to update your policy network based on your most critical risks.
Use input from key stakeholders to write clear, consistent, and concise policies that people will actually read and understand. Then publish them and start generating policy awareness.
Use your policies to create a compliance culture in your organization, set KPIs, and track policy effectiveness.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify the pain points associated with IT policies.
Establish the policy development process.
Begin formulating a plan to re-design the policy network.
Establish the policy process.
Highlight key issues and pain points regarding policy.
Assign roles and responsibilities.
1.1 Introduce workshop.
1.2 Identify the current pain points with policy management.
1.3 Establish high-level goals around policy management.
1.4 Select metrics to measure achievement of goals.
1.5 Create an IT policy working group (ITPWG).
1.6 Define the scope and purpose of the ITPWG.
List of issues and pain points for policy management
Set of six to ten goals for policy management
Baseline and target measured value
Amended steering committee or ITPWG charter
Completed RACI chart
Documented policy development process
Identify key risks.
Develop an understanding of which risks are most critical.
Design a policy network that best mitigates those risks.
Use a risk-driven approach to decide which policies need to be written or updated first.
2.1 Identify risks at a high level.
2.2 Assess each identified risk scenario on impact and likelihood.
2.3 Map current and required policies to risks.
2.4 Assess policy effectiveness.
2.5 Create a policy action plan.
2.6 Select policies to be developed during workshop.
Ranked list of IT’s risk scenarios
Prioritized list of IT risks (simplified risk register)
Policy action plan
Outline what key features make a policy effective and write policies that mitigate the most critical IT risks.
Write policies that work and get them approved.
3.1 Define the policy audience, constraints, and in-scope and out-of-scope requirements for a policy.
3.2 Draft two to four policies
Drafted policies
Build an understanding of how well the organization’s value creation activities are being supported.
Identify an area or capability that requires improvement.
4.1 Review draft policies and update if necessary.
4.2 Create a policy communication plan.
4.3 Select KPIs.
4.4 Review root-cause analysis techniques.
Final draft policies
Policy communications plan
KPI tracking log
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Define and align your team on target persona, outline steps to capture and document a robust buyer persona and journey, and capture current team buyer knowledge.
Hold initial buyer interviews, test initial results, and continue with interviews.
Consolidate interview findings, present to product, marketing, and sales teams. Work with them to apply to product design, marketing launch/campaigning, and sales and customer success enablement.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Organize, drive alignment on target persona, and capture initial views.
Steering committee and project team roles and responsibilities clarified.
Product, marketing, and sales aligned on target persona.
Build initial team understanding of persona.
1.1 Outline a vision for buyer persona and journey creation and identify stakeholders.
1.2 Identify buyer persona choices and settle on an initial target.
1.3 Document team knowledge about buyer persona (and journey where possible).
Documented steering committee and working team
Executive Brief on personas and journey
Personas and initial targets
Documented team knowledge
Build list of buyer interviewees, finalize interview guide, and validate current findings with analyst input.
Interview efficiently using 75-question interview guide.
Gain analyst help in persona validation, reducing workload.
2.1 Share initial insights with covering industry analyst.
2.2 Hear from industry analyst their perspectives on the buyer persona attributes.
2.3 Reconcile differences; update “current understanding.”
2.4 Identify interviewee types by segment, region, etc.
Analyst-validated initial findings
Target interviewee types
Validate current persona hypothesis and flush out those attributes only derived from interviews.
Get to a critical mass of persona and journey understanding quickly.
3.1 Identify actual list of 15-20 interviewees.
3.2 Hold interviews and use interview guides over the course of weeks.
3.3 Hold review session after initial 3-4 interviews to make adjustments.
3.4 Complete interviews.
List of interviewees; calls scheduled
Initial review – “are you going in the right direction?”
Completed interviews
Summarize persona and journey attributes and provide activation guidance to team.
Understanding of product market fit requirements, messaging, and marketing, and sales asset content.
4.1 Summarize findings.
4.2 Create action items for supporting team, e.g. messaging, touch points, media spend, assets.
4.3 Convene steering committee/executives and working team for final review.
4.4 Schedule meetings with colleagues to action results.
Complete findings
Action items for team members
Plan for activation
Measure results, adjust, and improve.
Activation of outcomes; measured results.
5.1 Review final copy, assets, launch/campaign plans, etc.
5.2 Develop/review implementation plan.
5.3 Reconvene team to review results.
Activation review
List of suggested next steps
B2B marketers without documented personas and journeys often experience the following:
Without a deeper understanding of buyer needs and how they buy, B2B marketers will waste time and precious resources targeting the incorrect personas.
Despite being critical elements, organizations struggle to build personas due to:
In today’s Agile development environment, combined with the pressure to generate revenues quickly, high tech marketers often skip the steps necessary to go deeper to build buyer understanding.
With a common framework and target output, clients will:
Clients who activate findings from buyer personas and journeys will see a 50% results improvement.
SoftwareReviews Insight:
Buyer personas and buyer journeys are essential ingredients in go-to-market success, as they inform for product, marketing, sales, and customer success who we are targeting and how to engage with them successfully.
Jeff Golterman, Managing Director, SoftwareReviews Advisory
“44% of B2B marketers have already discovered the power of Personas.”
– Hasse Jansen, Boardview.io!, 2016
“It’s easier buying gifts for your best friend or partner than it is for a stranger, right? You know their likes and dislikes, you know the kind of gifts they’ll have use for, or the kinds of gifts they’ll get a kick out of. Customer personas work the same way, by knowing what your customer wants and needs, you can present them with content targeted specifically to their wants and needs.”
– Emma Bilardi, Product Marketing Alliance, 2020
“Marketing eutopia is striking the all-critical sweet spot that adds real value and makes customers feel recognized and appreciated, while not going so far as to appear ‘big brother’. To do this, you need a deep understanding of your audience coming from a range of different data sets and the capability to extract meaning.”
– Plexure, 2020
SoftwareReviews Advisory Insight:
Marketers developing buyer personas and journeys that lack agreement among Marketing, Sales, and Product of personas to target will squander precious time and resources throughout the customer targeting and acquisition process.
| 1. Document Team Knowledge of Buyer Persona and Drive Alignment | 2. Interview Target Buyer Prospects and Customers | 3. Create Outputs and Apply to Marketing, Sales, and Product | |
|---|---|---|---|
| Phase Steps |
|
|
|
| Phase Outcomes |
|
|
|
Our methodology will enable you to align your team on why it’s important to capture the most important attributes of buyer persona including:
| Functional – “to find them” | ||||||
| Job Role | Title | Org. Chart Dynamics | Buying Center | Firmographics | ||
| Emotive – “what they do and jobs to be done” | ||||||
| Initiatives: What programs/projects the persona is tasked with and their feelings and aspirations about these initiatives. Motivations? Build credibility? Get promoted? | Challenges: Identify the business issues, problems, and pain points that impede attainment of objectives. What are their fears, uncertainties, and doubts about these challenges? | Buyer Need: They may have multiple needs; which need is most likely met with the offering? | Terminology: What are the keywords/phrases they organically use to discuss the buyer need or business issue? | |||
| Decision Criteria – “how they decide” | ||||||
| Buyer Role: List decision-making criteria and power level. The five common buyer roles are champion, influencer, decision maker, user, and ratifier (purchaser/negotiator). | Evaluation and Decision Criteria: Which lens – strategic, financial, or operational – does the persona evaluate the impact of purchase through? | |||||
| Solution Attributes – “what does the ideal solution look like” | ||||||
| Steps in “Jobs to Be Done” | Elements of the “Ideal Solution” | Business outcomes from ideal solution | Opportunity scope; other potential users | Acceptable price for value delivered | Alternatives that see consideration | Solution sourcing: channel, where to buy |
| Behavioral Attributes – “how to approach them successfully” | ||||||
| Content Preferences: List the persona’s content preferences – blog, infographic, demo, video – vs. long-form assets (e.g. white paper, presentation, analyst report). | Interaction Preferences: Which are preferred among in-person meetings, phone calls, emails, videoconferencing, conducting research via Web, mobile, and social? | Watering Holes: Which physical or virtual places do they go to network or exchange info with peers (e.g. LinkedIn)? | ||||
“~2/3 of [B2B] buyers prefer remote human interactions or digital self-service.” And during Aug. ‘20 to Feb. ‘21, use of digital self-service to interact with sales reps leapt by more than 10% for both researching and evaluating new suppliers.”
– Liz Harrison, Dennis Spillecke, Jennifer Stanley, and Jenny Tsai McKinsey & Company, 2021
SoftwareReviews Advisory Insight:
Marketers are advised to update their buyer journey annually and with greater frequency when the human vs. digital mix is affected due to events such as COVID-19 and as emerging media such as AR shifts asset-type usage and engagement options.
Because marketing leaders need to reach buyers through the right channel with the right message at the right time during their decision cycle, you’ll benefit by using questionnaires that enable you to build the below easily and quickly.
Buyer personas and buyer journeys are essential ingredients in go-to-market success, as they inform for product, marketing, sales, and customer success who we are targeting and how to engage with them successfully.
Marketers developing buyer personas and journeys that lack agreement among Marketing, Sales, and Product of personas to target will squander precious time and resources throughout the customer targeting and acquisition process.
Marketing leaders leverage the buyer persona knowledge not only from in-house experts in areas such as sales and executives but from analysts that speak with their buyers each and every day.
While leaders will get a fast start by interviewing sellers, executives, and analysts, you will fail to craft the right messages, build the right marketing assets, and design the best buyer journey if you skip buyer interviews.
Leaders will update their buyer journey annually and with greater frequency when the human vs. digital mix is effected due to events such as COVID-19 and as emerging media such as AR and VR shifts the way buyers engage.
Digital marketers that ramp up lead gen engine capabilities to capture “wins” and measure engagement back through the lead gen and nurturing engines will build a more data-driven view of the buyer journey. Target to build this advanced capability in your initial design.
This blueprint is accompanied by supporting deliverables to help you gather team insights, interview customers and prospects, and summarize results for ease in communications.
To support your buyer persona and journey creation, we’ve created the enclosed tools
A PowerPoint template to aid the capture and summarizing of your team’s insights on the buyer persona.
For interviewing customers and prospects, this tool is designed to help you interview personas and summarize results for up to 15 interviewees.
A PowerPoint template into which you can drop your buyer persona and journey interviewees list and summary findings.
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
The "do-it-yourself" step-by-step instructions begin with Phase 1.
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
A Guided Implementation is a series of analysts inquiries with you and your team.
Diagnostics and consistent frameworks are used throughout each option.
A Guided Implementation (GI) is series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization.
For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst.
Your engagement managers will work with you to schedule analyst calls.
Drive an Aligned Initial Draft of Buyer Persona
Interview Buyers and Validate Persona and Journey
Prepare Communications and Educate Stakeholders
Contact your account representative for more information. workshops@infotech.com 1-888-670-8889
| Day1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
| Align Team, Identify Persona, and Document Current Knowledge | Validate Initial Work and Identify Buyer Interviewees | Schedule and Hold Buyer interviews | Summarize Findings and Provide Actionable Guidance to Colleagues | Measure Impact and Results | |
| Activities |
1.1 Outline a vision for buyer persona and journey creation and identify stakeholders. 1.2 Identify buyer persona choices and settle on an initial target. 1.3 Document team knowledge about buyer persona (and journey where possible). |
2.1 Share initial insights with covering industry analyst. 2.2 Hear from industry analyst their perspectives on the buyer persona attributes. 2.3 Reconcile differences; update “current understanding.” 2.4 Identify interviewee types by segment, region, etc. |
3.1 Identify actual list of 15-20 interviewees. A gap of up to a week for scheduling of interviews. 3.2 Hold interviews and use interview guides (over the course of weeks). 3.3 Hold review session after initial 3-4 interviews to make adjustments. 3.4 Complete interviews. |
4.1 Summarize findings. 4.2 Create action items for supporting team, e.g. messaging, touch points, media spend, assets. 4.3 Convene steering committee/exec. and working team for final review. 4.4 Schedule meetings with colleagues to action results. |
5.1 Review final copy, assets, launch/campaign plans, etc. 5.2 Develop/review implementation plan. A period of weeks will likely intervene to execute and gather results. 5.3 Reconvene team to review results. |
| Deliverables |
|
|
|
|
|
This Phase walks you through the following activities:
This Phase involves the following stakeholders:
Review the Create a Buyer Persona Executive Brief (Slides 3-14)
Download the Buyer Persona Creation Template
Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

This Phase walks you through the following activities:
This Phase involves the following stakeholders:
Download the Buyer Persona and Journey Interview Guide and Data Capture Tool
Download the Buyer Persona and Journey Interview Guide and Data Capture Tool
Test that you are on the right track:
| Functional – “to find them” | ||||||
| Job Role | Title | Org. Chart Dynamics | Buying Center | Firmographics | ||
| Emotive – “what they do and jobs to be done” | ||||||
| Initiatives: What programs/projects the persona is tasked with and their feelings and aspirations about these initiatives. Motivations? Build credibility? Get promoted? | Challenges: Identify the business issues, problems, and pain points that impede attainment of objectives. What are their fears, uncertainties, and doubts about these challenges? | Buyer Need: They may have multiple needs; which need is most likely met with the offering? | Terminology: What are the keywords/phrases they organically use to discuss the buyer need or business issue? | |||
| Decision Criteria – “how they decide” | ||||||
| Buyer Role: List decision-making criteria and power level. The five common buyer roles are champion, influencer, decision maker, user, and ratifier (purchaser/negotiator). | Evaluation and Decision Criteria: Which lens – strategic, financial, or operational – does the persona evaluate the impact of purchase through? | |||||
| Solution Attributes – “what does the ideal solution look like” | ||||||
| Steps in “Jobs to Be Done” | Elements of the “Ideal Solution” | Business outcomes from ideal solution | Opportunity scope; other potential users | Acceptable price for value delivered | Alternatives that see consideration | Solution sourcing: channel, where to buy |
| Behavioral Attributes – “how to approach them successfully” | ||||||
| Content Preferences: List the persona’s content preferences – blog, infographic, demo, video – vs. long-form assets (e.g. white paper, presentation, analyst report). | Interaction Preferences: Which are preferred among in-person meetings, phone calls, emails, videoconferencing, conducting research via Web, mobile, and social? | Watering Holes: Which physical or virtual places do they go to network or exchange info with peers (e.g. LinkedIn)? | ||||
Because marketing leaders need to reach buyers through the right channel with the right message at the right time during their decision cycle, you’ll benefit by using questionnaires that enable you to build the below easily and quickly.
Download the Buyer Persona and Journey Interview Guide and Data Capture Tool
This Phase walks you through the following activities:
This Phase involves the following stakeholders:
Download the Buyer Persona and Journey Interview Guide and Data Capture Tool
Download the Buyer Persona and Journey Summary Template
Download the Buyer Persona and Journey Summary Template
Activation of key learnings to drive:
Present final persona and journey results to each stakeholder team. Key presentations include:
Download the Buyer Persona and Journey Summary Template
With the help of this blueprint, you have deepened your and your colleagues’ buyer understanding at both the persona “who they are” level and the buyer journey “how do they buy” level. You are among the minority of marketing leaders that have fully documented a buyer persona and journey – congratulations!
The benefits of having led your team through the process are significant and include the following:
And by capturing and documenting your buyer persona and journey even for a single buyer type, you have started to build the “institutional strength” to apply the process to other roles in the decision-making process or for when you go after new and different buyer types for new products. And finally, by bringing your team along with you in this process, you have also led your team in becoming a more customer-focused organization – a strategic shift that all organizations should pursue.
Contact your account representative for more information.
info@softwarereviews.com
1-888-670-8889
Optimize Lead Generation With Lead Scoring
Bilardi, Emma. “How to Create Buyer Personas.” Product Marketing Alliance, July 2020. Accessed Dec. 2021.
Harrison, Liz, Dennis Spillecke, Jennifer Stanley, and Jenny Tsai. “Omnichannel in B2B sales: The new normal in a year that has been anything but.” McKinsey & Company, 15 March 2021. Accessed Dec. 2021.
Jansen, Hasse. “Buyer Personas – 33 Mind Blowing Stats.” Boardview.io!, 19 Feb. 2016. Accessed Jan. 2022.
Raynor, Lilah. “Understanding The Changing B2B Buyer Journey.” Forbes Agency Council, 18 July 2021. Accessed Dec. 2021.
Simpson, Jon. “Finding Your Audience: The Importance of Developing a Buyer Persona.” Forbes Agency Council, 16 May 2017. Accessed Dec. 2021.
“Successfully Executing Personalized Marketing Campaigns at Scale.” Plexure, 6 Jan. 2020. Accessed Dec 2020.
Ulwick, Anthony W. JOBS TO BE DONE: Theory to Practice. E-book, Strategyn, 1 Jan. 2017. Accessed Jan. 2022.
To guarantee success of the off-the-shelf AI implementation and deliver value, in addition to formulating a clear definition of the business case and understanding of data, organizations should also:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this practical and actionable framework that will guide you through the planning of your Off-the-Shelf AI product implementation.
Use this analysis tool to ensure the success of the implementation.
Your Challenge
|
Common Obstacles
|
Info-Tech’s Approach
Info-Tech’s approach includes a framework that will guide organizations through the process of the Off-the-Shelf AI product selection. To guarantee success of the Off-the-Shelf AI implementation and deliver value, organization should start with clear definition of the business case and an understanding of data. Other steps include:
|
To guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
92.1%of companies say they are achieving returns on their data and AI investments |
91.7%said they were increasing investments in data and AI |
26.0%of companies have AI systems in widespread production |
However, CIO Magazine identified nine main hurdles to AI adoption based on the survey results:
|
| “Data and AI initiatives are becoming well established, investments are paying off, and companies are getting more economic value from AI.” (Source: NewVantage, 2022.)
“67% of companies are currently using machine learning, and 97% are using or planning to use it in the next year.” (Source: Deloitte, 2020) |
|||
|
Machine learning systems learn from experience and without explicit instructions. They learn patterns from data then analyze and make predictions based on past behavior and the patterns learned. Artificial intelligence is a combination of technologies and can include machine learning. AI systems perform tasks mimicking human intelligence such as learning from experience and problem solving. Most importantly, AI is making its own decisions without human intervention. The AI system can make assumptions, test these assumptions, and learn from the results.
|
“Machine learning is the study of computer algorithms that improve automatically through experience.” (Tom Mitchell, 1997) “At its simplest form, artificial intelligence is a field, which combines computer science and robust datasets, to enable problem-solving.” (IBM, “What is artificial intelligence?”) |
||||||
| ML/AI-Powered Products | Off-the-Shelf Pre-built and Pre-trained AI/ML Models |
|
|
Examples of OTS tools/products:
|
Examples of OTS models:
|
The data inputs for these models are defined, the developer has to conform to the provided schema, and the data outputs are usually fixed due to the particular task the OTS model is built to solve.
To guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.
Question the value that AI adds to the tool you are evaluating. Don’t go after the tool simply because it has an AI label attached to it. AI/ML capabilities might add little value but increase implementation complexity. Define the problem you are solving and document business requirements for the tool or a model.
Know your data. Determine data requirements to:
Define the skills required for the implementation and assemble the team that will support the project from requirements to deployment and support, through its entire lifecycle. Don’t forget about production support and maintenance.
No need to reinvent the wheel and build a product you can buy, but be prepared to work around tool limitations, and make sure you understand the data and the model the tool is built on.
Using Off-the-Shelf-AI models enables an agile approach to system development. Faster POC and validation of ideas and approaches, but the model might not be customizable for your requirements.
To guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.
Why do you need AI in your toolset?Business GoalsClearly defined problem statement and business requirements for the tool or a model will help you select the right solution that will deliver business value even if it does not have all the latest bells and whistles. |
Do you know the data required for implementation?DataExpected business outcome defines data requirements for implementation. Do you have the right data required to train and run the model? |
Is your organization ready for AI?People/Team/ SkillsNew skills and expertise are required through all phases of the implementation: design, build, deployment, support, and maintenance, as well as post-production support, scaling, and adoption. Data Architecture/ InfrastructureNew tool or model will impact your cloud and integration strategy. It will have to integrate with the existing infrastructure, in the cloud or on prem. |
What questions do you need to ask when choosing the solution?Product/ Tool or Model SelectionDo you know what model powers the AI tool? What data was used to train the tool and what data is required to run it? Ask the right questions. |
Are you measuring impact on your processes?Business and IT ProcessesBusiness processes need to be defined or updated to incorporate the output of the tool back into the business processes to deliver value. IT governance and support processes need to accommodate the new AI-powered tool. |
Realize and measure business value of your AI investmentValueDo you have a clear understanding of the value that AI will bring to your organization?Optimization?Increased revenue?Operational efficiency? |
| Business Goals and Value | Data | People/Team/ Skills | Infrastructure | Business and IT Processes | |
| AI/ML–powered tools |
|
|
|
|
|
| Off-the-shelf AI/ML pre-built models |
|
|
|
|
|
Why do you need AI in your toolset? What value will AI deliver? Have a clear understanding of business benefits and the value AI delivers through the tool.
Info-Tech InsightQuestion the value that AI adds to the tool you are evaluating. Don’t go after the tool simply because it has an AI label attached to it. AI/ML capabilities might add little value but increase implementation complexity. Define the problem you are solving and document business requirements for the tool or a model. | ![]() AAI solutions and technologies are helping organizations make faster decisions and predict future outcomes such as:
|
|
Use the Business Drivers tab to document:
|
|
|
|
|
Download the Off-the-Shelf AI Analysis Tool
Input
|
Output
|
Materials
|
Participants
|
Understand data required for implementationDo you have the right data to implement and run the AI-powered tool or AI/ML model? | Info-Tech InsightKnow your data. Determine data requirements to:
| ||||||||
| Availability | Quality | Preparation | Bias, Privacy, Security | Data Architecture | |||||
|
|
|
|
| |||||
2-3 hours
Use the Data tab to document the following for each data source or dataset:
|
Download the Off-the-Shelf AI Analysis Tool |
Input
| Output
| Materials
| Participants
|
|
|
Define the skills required for the implementation and assemble the team that will support the project through its entire lifecycle. Don’t forget about production, support, and maintenance.
1-2 hours
Input: Solution conceptual design, Current resource availability
Output: Roles required for the implementation of the solution, Resources gap analysis, Training and hiring plan
Materials: Whiteboard/Flip charts, Off-the-Shelf AI Analysis Tool, “People and Team” tab
Participants: Project lead, HR, Enterprise Architect
Download the Off-the-Shelf AI Analysis Tool
Download the Create an Architecture for AI blueprint
2-3 hours
Input: Solution conceptual design
Output: Infrastructure requirements, Infrastructure readiness assessment
Materials: Whiteboard/Flip charts, Off-the-Shelf AI Analysis Tool, “Infrastructure” tab
Participants: Infrastructure Architect, Solution Architect, Enterprise Architect, Data Architect, ML/AI Ops Engineer
Download the Off-the-Shelf AI Analysis Tool
| Data | Model | Implementation and Integration | Deployment | Security and Compliance |
|
|
|
|
|
Use Info-Tech’s Off-the-Shelf AI Analysis Tool, “Vendor Questionnaire” tab to track vendor responses to these questions.
Process automation, optimization, and improvement enabled by the technology and AI/ML-powered tools allow organizations to reduce manual work, streamline existing business processes, improve customer satisfaction, and get critical insights to assist decision making.
To take full advantage of the benefits and new capabilities enabled by the technology, make sure that business and IT processes reflect these changes:
2-3 hours
Input: Solution design, Existing business and IT processes
Output: Documented updates to the existing processes, Documented new business and IT processes
Materials: Whiteboard/Flip charts, Off-the-Shelf AI Analysis Tool, “Business and IT Processes” tab
Participants: Project lead, Business stakeholders, Business analyst
Download the Off-the-Shelf AI Analysis Tool
PROS:
Info-Tech Insight:No need to reinvent the wheel and build the product you can buy, but be prepared to work around tool limitations, and make sure you understand the data and the model the tool is built on. | CONS:
|
PROS:
|
CONS:
|
Using Off-the-Shelf AI models enables an agile approach to system development – faster POC and validation of ideas and approaches, but the model might not be customizable for your requirements.
Metrics and KPIs for this project will depend on the business goals and objectives that you will identify in Step 1 of the tool selection process.
Metrics might include:
Adryan, Boris. “Is it all machine learning?” Badryan, Oct. 20, 2015. Accessed Feb. 2022.
“AI-Powered Data Management Platform.” Informatica, N.d. Accessed Feb 2022.
Amazon Rekognition. “Automate your image and video analysis with machine learning.” AWS. N.d. Accessed Feb 2022.
“Artificial Intelligence (AI).” IBM Cloud Education, 3 June 2020. Accessed Feb 2022.
“Artificial intelligence (AI) vs machine learning (ML).” Microsoft Azure Documentation. Accessed Feb. 2022.
“Avante Garde in the Realm of AI” SearchUnify Cognitive Platform. Accessed Feb 2022.
“Azure Cognitive Services.” Microsoft. N.d. Accessed Feb 2022.
“Becoming an AI-fueled organization. State of AI in the enterprise, 4th edition,” Deloitte, 2020. Accessed Feb. 2022.
“Coveo Predictive Search.” Coveo, N.d. Accessed Feb 2022.
”Data and AI Leadership. Executive Survey 2022. Executive Summary of Findings.” NewVantage Partners. Accessed Feb 2022.
“Einstein Discovery in Tableau.” Tableau, N.d. Accessed Feb 2022.
Korolov, Maria. “9 biggest hurdles to AI adoption.” CIO, Feb 26, 2019. Accessed Feb 2022.
Meel, Vidushi. “What Is Deep Learning? An Easy to Understand Guide.” visio.ai. Accessed Feb. 2022.
Mitchell, Tom. “Machine Learning,” McGraw Hill, 1997.
Stewart, Matthew. “The Actual Difference Between Statistics and Machine Learning.” Towards Data Science, Mar 24, 2019. Accessed Feb 2022.
“Sentiment analysis with Cognitive Services.” Microsoft Azure Documentation. Accessed February 2022.
“Three Principles for Designing ML-Powered Products.” Spotify Blog. Oct 2019, Accessed Feb 2022.
“Video Intelligence API.” Google Cloud Platform. N.d. Accessed Feb 2022
It is now 2020 and the GDPR has been in effect for almost 2 years. Many companies thought: been there, done that. And for a while the regulators let some time go by.
The first warnings appeared quickly enough. Eg; in September 2018, the French regulator warned a company that they needed to get consent of their customers for getting geolocation based data.
That same month, an airline was hacked and, on top of the reputational damage and costs to fix the IT systems, it faced the threat of a stiff fine.
Even though we not have really noticed, fines started being imposed as early as January 2019.
Wrong! The fines are levied in a number of cases. And to make it difficult to estimate, there are guidelines that will shape the decision making process, but no hard and fast rules!
The GDPR is very complex and consists of both articles and associated recitals that you need to be in compliance with. it is amuch about the letter as it is about the spirit.
We have a clear view on what most of those cases are.
And more importantly, when you follow our guidelines, you will be well placed to answer any questions by your clients and cooperate with the regulator in a proactive way.
They will never come after me. I'm too small.
And besides, I have my privacy policy and cookie notice in place
Company size has nothing to do with it.
While in the beginning, it seemed mostly a game for the big players (for names, you have to contact us) that is just perception.
As early as March 2018 a €10M revenue company was fined around €120,000. 2 days later another company with operating revenues of around €6.2M was fined close to €200.000 for failing to abide by the DSRR stipulatons.
Don't know what these are?
Fill out the form below and we'll let you in on the good stuff.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Read our executive brief to understand everyday struggles regarding application maintenance, the root causes, and our methodology to overcome these. We show you how we can support you.
Identify your stakeholders and understand their drivers.
Identify the right level of governance appropriate to your company and business context for your application maintenance. That ensures that people uphold standards across maintenance practices.
Most companies cannot do everything for all applications and systems. Build your maintenance triage and prioritization rules to safeguard your company, maximize business value generation and IT risks and requirements.
Define quality standards in maintenance practices. Enforce these in alignment with the governance you have set up. Show a high degree of transparency and open discussions on development challenges.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
By defining your goals, framing solutions based on end-user workloads, and understanding the pros and cons of various solutions, you can visualize what success looks like for your VDI/DaaS deployment. This includes defining your KPIs by end-user experience, knowing the decision gates for a successful deployment, and defining your hypothesis for value to make your decision more accurate and gain C-suite buy-in.
Virtual desktop infrastructure (VDI)/desktop as a service (DaaS) users expect their user experience to be at least equal to that provided by a physical PC, and they do not care about the underlying infrastructure. If the experience is less, then IT has failed in the considerations for VDI/ DaaS. In this research we analyze the data that the IT industry tracks but doesn't use or sometimes even look at regarding user experience (UX).
Understanding the strengths and weaknesses in your in-house technical skills and business requirements will assist you in making the right decision when it comes to VDI or DaaS solutions. In the case of DaaS this will include a managed service provider for small to medium-sized IT teams. Many IT teams lack a seasoned IT project manager who can identify gaps, risks, and weaknesses in the organization's preparedness. Redeploy your IT staff to new roles that impact management and monitoring of UX.
Ultimately, IT needs to reduce its complexity, increase user satisfaction, reduce management and storage costs, and maintain a secure and effective environment for both the end user and the business. They must also ensure productivity standards throughout the considerations, strategically, tactically, and in support of a move to a VDI or DaaS solution.
| Your Challenge With the evolution of VDI over the last 15-plus years, there has been a proliferation of solutions, such as Citrix desktop services, VMware Horizon, and in-house hypervisor solutions (e.g. ESX hosts). There has also been a great deal of growth and competition of DaaS and SaaS solutions in the cloud space. Hybrid work environments, remote from anywhere and any device, and the security concerns that go hand-in-hand with these strategies have certainly accelerated the move to VDI and DaaS. How will you manage and navigate the right solution for your organization? | Common Obstacles IT departments can encounter many obstacles to VDI and DaaS, many of which will be determined by your business model and other factors, such as:
| Info-Tech’s Approach By defining your end goals, framing solutions based on end-user workloads, and understanding the pros and cons of what solution(s) will meet your needs, you can visualize what success looks like.
|
Every IT organization needs to be asking what success looks like. If you do not consider how your end user will be impacted, whether they are doing something as simple as holding a team meeting with voice and video or working with highly technical workloads on a virtual environment, you will run into multiple issues that affect end-user satisfaction, productivity, and adoption. Understand the tension metrics that may conflict with meeting business objectives and KPIs.
Client-Driven InsightDifferent industries have different requirements and issues, so they look at solutions differently. Info-Tech InsightIf end-user experience is at the forefront of business requirements, then any solution that fits the business KPIs can be successful. |
|

Questions you should be asking before you create your RFP
| How would you rate the user experience on your VDI/DaaS solution?
Info-Tech InsightAsking critical use-case questions should give you a clear picture of the end-user experience outcome. |
Security is always quoted as a primary justification for VDI/DaaS, while UX is far down the list of KPIs. WHY?IT engineers use network and performance metrics to manage end-user complaints of “slowness,” which in reality is not what the user is experiencing.IT needs to invest in more meaningful metrics to manage end-user pain:
| ![]() (Source: Enterprise Strategy Group, 2020) |
The dimensions of end-user experience can be broken down into four distinct categories that will impact not only the end user but also the business. Picturing your landscape in this framework will help clearly define your considerations when deciding on whether a VDI or DaaS solution is right for your business. We will investigate how these scenarios impact the end user, what that means, and how that can guide the questions that you are asking as you move to an RFP. Info-Tech InsightIn the world of VDI and DaaS, if you do not get buy-in from the end user, the rate of adoption and the overall success of the implementation will prove difficult to measure. It will be impossible to calculate ROI even as you feel the impact of your TCO.
| ![]() |
What IT measuresMost business KPI objectives concentrate on business goals, whether it be cost containment, security, simplification, ease of management, or centralization of apps and data, but rarely is there a KPI for end-user experience. You can’t fix what you can’t see. Putting a cost benefit to end-user satisfaction may come in the form of productivity. This may be a central reason why VDI has not been widely adopted as an architecture since it came to the marketplace more than 15 years ago. | ![]() |
Monitoring end-user metrics will mitigate the tension between business KPIs and end-user satisfaction
Metric | Description | ||
End-User | PERFORMANCE | Logon duration | Once the user puts in their password, how long does it take to get to their desktop? What is the measurement and how do you measure? |
| App load time | When an app is launched by the user there should be immediate indication that it is loading. | ||
| App response time | When the user performs a task, there should be no wait time, or hourglass icon, waiting for the app to catch up to the user input. (There is no succinct way to measure this.) | ||
| Session response time | How does the user’s OS respond to I/O? The user should not experience any latency issues when doing a drag and drop, clicking on a menu item, or doing a search. | ||
| AVAILABILITY | SLAs | When something goes wrong in the VDI/DaaS environment, how quickly can the user expect to get back to their tasks? | |
| Geographic location | When all other considerations are configured correctly, the user experience may be impacted by their location. So, for example, a user working out of Mexico and logging into a VDI may experience latency based on location compared to a user in California, for example, where the resources are stored, managed, and monitored. | ||
| Application availability | Much like app load time and response time, the only factor affecting the user experience is the back-end load on the app itself, for example a CAD or heavy resource app not properly resourced. | ||
| FUNCTIONALITY | Configuration of user desktop | Degradation in functionality is caused by improper allocation of CPU, RAM, and GPU for the tasks at hand, creating a bad UX and end-user satisfaction score. | |
| Graphics quality and responsiveness | The user should have the same experience as if on their own physical machine. A video experience should not have any lag in it, for example. MS Teams should not have latency or sound quality issues. | ||
| Predictive analysis | Continuous performance and availability monitoring. | ||
| END USER | Browser real user monitoring (RUM) | A real-time view into how the web application is performing from the point of view of a real end user. | |
| Customer satisfaction score | Survey-based metrics on customer satisfaction. | ||
“If employees are the competitive edge and key differentiator for a business, I&O has a duty of care to ensure that the employees’ digital experience enables and does not impede the value of that asset.” (John Annand, Principal Director, Info-Tech Research Group)
Is security and data sovereignty the only reason?
| Technical capability | |
| AVAILABILITY | VDI is a better fit than DaaS in organizations that have limited or unreliable internet connectivity. |
| FUNCTIONALITY | Application flexibility: Resource-intensive applications may require specific virtual desktop configurations, for example in-house GIS apps, CAD, and gaming software requiring specific GPU configurations. |
| SECURITY | Data protection is often stated as a need to maintain an on-premises VDI solution, ensuring sensitive and highly privileged data does not travel across the internet. |
| AVAILABILITY | While some cloud providers will allow you to bring your OS licensing along with a cloud migration, many subscriptions already include OS licensing, and you may be paying additional licensing costs. |
| SECURITY | VDI makes sense if security and control are primary business KPIs, the IT resources are experienced virtual infrastructure engineers and administrators, and funding is not a hindrance. |
| PERFORMANCE | When processing power is a functional requirement, such as CPU, GPU, and storage capacity, VDI offers performance benefits over a standard PC, reducing the need to deploy high-powered PCs to end users. |
“Though the desktops are moving to the cloud, accountability is not.” (Gary Bea, Director of Consulting Services and Technical Operations, Goliath Technologies)
Any device anywhere: key benefits of DaaS
| Technical capability | Challenges | |
| AVAILABILITY | Delivers a consistent user experience regardless of location or device. | Info-Tech InsightThe total cost of the solution will be higher than you anticipate, and management is complex. Additionally, your ability to set your conditions and controls is limited. Info-Tech InsightDepending on your technical abilities and experience with cloud services, you will likely benefit from professional third-party services, technical services, and consulting, which can be critical when deciding if DaaS can fit into your current IT architecture, processes, and security posture. |
| SECURITY | Enhances security posture by eliminating your client VPN and keeping sensitive data off the endpoint device. | |
| FUNCTIONALITY | Onboard and offboard users quickly and securely. | |
| FUNCTIONALITY | Provides centralize workspace management. | |
| FUNCTIONALITY | Scale up or down on demand with a consumption- and subscription-based contract. | |
| FUNCTIONALITY | Significantly reduce operational overhead compared to managing a traditional VDI deployment. |

From an end-user experience perspective, what makes sense in terms of usage and cost?
Thin Client
| Desktop as a Service
| Thick Client
| Device as a Service
| Web Client
|
What is the better security posture and control plane? Clarify your stakeholders’ objectives, then see if VDI is an adequate solution.
![]() | Modernize and Transform Your End-User Computing Strategy Phase 3.2 of this research set covers virtual desktop infrastructure. |
![]() | Implement Desktop Virtualization and Transition to Everything as a Service Follow Info-Tech’s process for implementing the right desktop virtualization solution to create a project plan that will help ensure that you not only choose the right solution but also implement it effectively. |
![]() | Cloud Strategy Workbook Use this tool to assess cloud services (desktop-as-a-service). |
![]() | Desktop Virtualization TCO Calculator This tool is designed to help you understand what desktop virtualization looks like from a cost perspective. |
Anderson, Joseph. “Five Ways VDI Will Grow in 2022 Thanks to Hybrid Work.” StratoDesk, 28 Feb. 2022. Web.
Bowker, Mark. “Are Desktops Doomed? Trends in Digital Workspaces, VDI, and DaaS.” ESG, May 2020. Web.
“The CISO's Dilemma: How Chief Information Security Officers Are Balancing Enterprise Endpoint Security and Worker Productivity in Response to COVID-19.” Hysolate, Oct. 2020. Web.
King, Val. “Why the End-User Experience Is Not Good for Your Remote Workforce .” Whitehat Virtual Technologies, 2 Dec. 2021. Web.
Perry, Yifat. “VDI vs DaaS: 5 Key Differences and 6 Leading Solutions.” NetApp, 26 Aug. 2020. Web.
Rigg, Christian. “Best virtual desktop services 2022.” TechRadar, 20 Jan. 2022 . Web.
Seget, Vladan. “Key metrics to consider when assessing the performance of your VDI/DaaS environment.” vladan.fr, 19 April 2021. Web.
Spruijt, Ruben. “Why Should You Care About VDI and Desktop-as-a-Service?” Nutanix, 28 Jan. 2020. Web.
Stowers, Joshua. “The Best Desktop as a Service (DaaS) Providers 2022.” business.com, 21 Dec. 2021. Web.
“Virtual Desktop Infrastructure(VDI) Market 2022.” MarketWatch, 5 Jan. 2022. Web. Press release.
Zamir, Tal. “VDI Security Best Practices: Busting the Myths.” Hysolate, 29 Nov. 2021. Web.
Zychowicz, Paul. “Why do virtual desktop deployments fail?” Turbonomic Blog, 16 Dec. 2016. Web.
The business has embarked on its digital transformation journey. As CIO, you are being relied on to help triage what is most important – initiatives that will move the needle to achieve and fulfill the digital goals and ambitions of the organization.
Once the scope of the digital strategy and its goals are finalized, the heavy lifting begins. CIOs must prepare for this change by evaluating opportunities and prioritizing which will become digital initiatives.
By using an appropriate selection process, CIOs can prioritize the digital initiatives that will matter most to the organization and drive business value.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Part of Info-Tech’s seven-phase approach for aligning IT with the business’ digital strategy, this deck focuses the core and enabling initiatives that define IT’s innovation goals. By the end of this deck, the IT leader will have a roadmap of prioritized initiatives that enable the organization’s digital business initiatives.
| 35,000 members sharing best practices you can leverage. | Millions spent annually developing tools and templates. | Leverage direct access to over 100 analysts as an extension of your team. | Use our massive database of benchmarks and vendor assessments. | Get up to speed in a fraction of the time. |
A project – or a group of interdependent projects – whose primary purpose is to enable digital technologies and/or digital business models. These technologies and models may be net new to the organization, or they may be existing ones that are optimized and improved by the initiative itself.
The feasibility of any initiative is gauged by answering:
The plan to deploy existing/emerging technologies to look at developing new products and services, new business models, and operational efficiency to meet or exceed performance targets.
The plan for deploying and maintaining applications, hardware, infrastructure, and IT services that support the business goals in a secure/regulatory-compliant manner to ensure reliability.
Digital transformation is an at-scale change program – planned and executed over a finite time period – with the aspiration of creating material and sustainable improvement in the performance of an organization. Techniques include deploying a programmatic approach to innovation along with enabling technologies, capabilities, and practices that drive efficiency and create new products, markets, and business models.
Your Challenge
|
Common Obstacles
|
Solution
|
The business has embarked on its digital transformation journey. As CIO, you are being relied on to help triage what is most important – initiatives that will move the needle to achieve and fulfill the digital goals and ambitions of the organization.
Your stakeholders have spent considerable time and effort identifying and articulating a digital business strategy. Now that ideas have turned into opportunities, the CIO must prioritize those opportunities as actual initiatives. Where to begin?
Your first task is to identify the criteria that will be used to conduct prioritization activities. These criteria should be immutable and rigorously applied.
Your second task will be to develop business cases for each opportunity that passes muster. But don’t worry, you won’t need an MBA to get the job done properly.
Principal Research Director
Info-Tech Research Group
You have reviewed trends to reimagine the future of your industry and undertaken a digital maturity assessment to validate your business objectives and innovation goals. Now you need to evolve the current scope of your digital vision and opportunities.
By this point you have leveraged industry roundtables to better understand the art of the possible – exploring global trends, shifts in market forces or industry, customer needs, emerging technologies, and economic forecasts and creating opportunities out of these disruptions.
In Phase 2.1, you identified your business and innovation goals and documented your current capabilities, prioritized for transformation.
Business and innovation goals have been established through stakeholder interviews and business document review.
Current capabilities have been prioritized for transformation and heat mapped.
Throughout the course of Phase 2.2, you identified new digital opportunities, identified the business capabilities required to capitalize those opportunities, and updated the digital goals of your organization, accordingly.
The end result of this exercise is a new goals cascade that aligns digital goals and capabilities with those of the business. Digital initiatives were also identified but not yet selected or prioritized for execution at the project level.
The goal of this phase is to ensure that initiatives that are green-lit for execution have been successfully assessed against your chosen criteria and that the business case for each initiative is firmly established and documented.
There are three key activities outlined here that describe the actions that can be undertaken by industry members to help select and prioritize digital initiatives for the business.
| 1 | Identify your selection criteria
|
| 2 | Evaluate initiatives against criteria
|
| 3 | Determine a prioritized list of initiatives
|
1.1 |
Define what "viable" looks likeSet criteria types and thresholds.It is impossible to gauge whether or not an opportunity is worthwhile if you don’t have a yardstick to measure it by. However, what is viable for one organization in a particular industry may not be viable for a company elsewhere. |
Consider:
|
Avoid:
|
1.2 |
Conduct an evaluation sessionTest your assumptions by piloting prioritization.Select an initiative from one of the opportunity profiles from Phase 2.2 and run it through the selection criteria. From there, determine if your assumptions are sound. If not, tweak the criteria and test again until all stakeholders have confidence in the process. |
Consider:
|
Avoid:
|
Ideas matter, but not all ideas are created equal. Now that you have elicited ideas and identified opportunities, discuss the assumptions, risks, and benefits associated with each proposed digital business initiative.
Recall that the opportunities identified in Phase 2.2 also became proposed digital initiatives demonstrated in your goals cascade.
In your discussion, evaluate each opportunity through a matrix to create tension between value and complexity or other dimensions. Capture the information based on measurable business benefits-realization; risks or considerations; assumptions; and competencies, talent, and assets needed to deliver.
To start, take one of the opportunity profiles you created in Phase 2.2, Build Your Digital Vision and Strategy, and use it throughout the following steps. Once done, repeat with the next opportunity profile until all have been vetted against criteria. If you did not use Info-Tech’s approach, simply use whatever list of digital business opportunities provided to you from stakeholders.
Run each initiative through the following evaluation criteria. When finished, any opportunities that appear in the top left quadrant (high value/low complexity) are now your highest priority digital initiatives.
Assign each initiative a letter. As you decide on each one, move a copy of the circled letter to its appropriate place on the 2x2 selection matrix.
Evaluation should be based on the insights from analysis across all criteria. Leverage group discussion to help contextualize and challenge assumptions when validating opportunities.
Every idea is a good one, unless you need one that works. What “works” as a digital initiative is not the same thing as a straightforward IT project that would be typically managed by a project manager or PMO. These latter projects will be addressed in Phase 3.1 of the digital journey.
Focus: Transform the business and operations
2.1 | Evaluate and validateEvaluate and validate (or invalidate) opportunities.Now that you have tested and refined the selection criteria, take each opportunity profile from Phase 2.2 and run it through its paces. Once plotted on the 2x2 matrix, you will have a clear and concise view of high priority digital initiatives. | Consider:
| Avoid:
|
2.2 | Determine benefitsDocument benefits and value proposition.Identify and determine the benefits of each high priority initiative, including the benefit type (e.g. observable, financial, etc.). In addition, discuss and articulate the value proposition for each high priority initiative. | Consider:
| Avoid:
|
2.3 | Make your caseBuild a business case for each initiative.Once you have enunciated the value and benefits of each high priority initiative, create a business case and profile for each one that includes known costs, risks, and so on. These materials will be crucial for project execution and IT capability planning in Phase 2.3 of your digital journey. | Consider:
| Avoid:
|
Your prioritization matrix should look something like this. Initiatives B and C will now have short-form business cases developed for them. Initiatives in the “Should Plan” quadrant can be dealt with later.
You created opportunity profiles in Phase 2.2 to clarify, validate and evaluate specific ideas for digital initiatives. In these profiles, you considered the timing, relevance, and impact of those opportunities.
Some prioritized initiatives will have an immediate and significant impact on your business. Some may have a significant impact, but on a longer timeline. Understanding this is important context for your overall digital business strategy.
Above all, you must be able to communicate to stakeholders how the newly prioritized digital initiatives are relevant to driving the strategic growth of the business.
Start by elucidating further on initiative benefits and business value as outlined in the opportunity profile. This will become crucial for completing your next step – building a short-form business case for each prioritized initiative.
The next slide is a template for the short-form business case, while the slides after that contain instructions on how to fill out each section of the business case.
Input
|
Output
|
Materials
|
Participants
|
Business cases are not just a vehicle with which to acquire resources for investments, they are a mechanism that helps ensure the benefits of an investment are realized. To accomplish this, a business case must have a set of clearly defined benefits, combined with an understanding of how they will be measured and an explicitly stated beneficiary who can corroborate that the benefit has been realized.
Benefits are the advantages, or outcomes, that specific groups or individuals realize as a result of the proposed initiative’s implementation.
Initiative inputs are the time, resources, and scope dedicated to the endeavor of implementing an initiative.
Benefits are realized when an organization either starts doing something new, stops doing something, or improves the way something is already being done. The impact of these changes must be measured in order to determine whether the change is positive and if the case warrants more resources in order to scale.
Input
| Output
|
Materials
| Participants
|
The way one articulates the value an initiative provides is just as important as the initiative itself. Use the previous exercises as inputs to craft a statement that reflects the value your initiative will provide, but also describes how the initiative will create value. Specifically, a value proposition should answer the following questions:
Input
| Output
|
Materials
| Participants
|
Turn your attention to the roadmap section of the Short-Form Business Case Template and fill it in through the following steps:
Input
| Output
|
Materials
| Participants
|
Input
| Output
|
Materials
| Participants
|
3.1 | Compile informationFinalize your list of high priority initiatives.This list should also include the short-form business cases that you completed in the previous step. This compilation of initiative information will be used in the next phase of your digital journey and is critical for its successful completion. | Consider:
| Avoid:
|
3.2 | CommunicateIt’s time to communicate with stakeholders.By now you should have a relatively short yet potent list of digital business initiatives – plus a business case for each – that has been thoroughly vetted and prioritized. Stakeholders are eager to learn more about these initiatives, though the details that matter most may differ from stakeholder to stakeholder. | Consider:
| Avoid:
|
There are two follow-up actions to do with your newly prioritized list of digital initiative business cases: present them to stakeholders for approval and then add them to your IT strategic roadmap.
For most high-profile digital business initiatives, the short-form business case will not be the first time stakeholders hear about them. By this point, securing approval should only be a formality if the initiative has been effectively socialized beforehand. If this is not the case, one must build an adequate understanding of the stakeholder landscape and then use this understanding to effectively present business cases for digital initiative and receive approval to proceed with them.
Gauge the importance of various stakeholders and tailor your message according to their concerns and the requirements of their role. Consider the following important questions about each stakeholder:
A stakeholder map helps visualize the importance of various stakeholders and their concerns so you can prioritize your time according to those stakeholders who are most impacted by a digital initiative, as well as those who have the authority to green-light them.
Focus on key players: Relevant stakeholders who have high power are highly impacted and should have high involvement. Engage the stakeholders that are impacted most and have the authority to influence digital initiatives and approve business cases.
By now, you should have a firm understanding of the principles and desired actions, behaviors, and outcomes that have been presented in this methodology. Furthermore:
Assess how the external environment presents opportunities or threats to your organization.
Align with the business by creating an IT strategy that documents the business context, key initiatives, and a strategic roadmap.
Design a strategy that applies innovation to your business model, streamlines and transforms processes, and makes use of technologies to enhance interactions with customers and employees.
Principal Research Director, CIO Advisory
Info-Tech Research Group
Ross Armstrong is a Principal Research Director in the CIO Advisory practice at Info-Tech Research Group, covering the areas of IT strategic planning, digital strategy, digital transformation, and IT innovation.
Ross has worked in a variety of public and private sector industries including automotive, IT, mobile/telecom, and higher education. All of his roles over the years have centered around data-driven market research – in pursuit of insightful and successful product development and product management – at their core.
In addition to his long tenure as an Info-Tech Research Group analyst, Ross has worked in research and product innovation positions at Autodata initiatives (J.D. Power), BlackBerry, and Ivey Business School (Western University).
Ross holds a Master of Arts degree in English Language and Literature from Western University (UWO) and has served as an advisory board member for a number of not-for-profit and educational institutions.
Principal Research Director, CIO Advisory
Info-Tech Research Group
Joanne is an executive with over 25 years of experience providing leadership in digital technology and management consulting across both public and private entities from initiative delivery to organizational redesign across BC, Ontario, and Globally.
A Director within KPMG’s CIO Advisory Management Consulting services and practice lead for Digital Health in BC, Joanne has led various client engagements from ERP Cloud Strategy, IT Operating Models, Data and Analytics maturity, to process redesign. More recently, Joanne was the Chief Program Officer and Executive Director responsible for leading the implementation of a $450M technology and business transformation initiative across 13 hospitals and community services for one of the largest health authorities in BC.
A former clinician, Joanne has held progressive leadership roles in healthcare with accountabilities across IT operations and service management, data analytics, project management office (PMO), clinical informatics, and privacy and contract management. Joanne is passionate about connecting people, concepts, and capital.
“AI: From Data to ROI.” Cognizant, September 2020. Accessed November 2022.
Bughin, Jacques, et al. “The Case for Digital Reinvention.” McKinsey Quarterly, February 2017. Accessed November 2022.
“The Business Case for Digital Transformation.” CPA Canada, June 2021. Accessed November 2022.
“The Case for Digital Transformation.” The National Center for the Middle Market, Ohio State University, 2020. Accessed October 2022.
“Digital Transformation in Government Case Study.” Ionology, April 2020. Accessed October 2022.
Louis, Peter, et al. “Internet of Things – From Buzzword to Business Case.” Siemens, 11 January 2021. Accessed December 2022.
Miesen, Nick. “Case Studies of Digital Transformations in Process and Aerospace Industries.” Jugaad, 2018. Accessed November 2022.
Proff, Harald, and Claudia Bittrich. “The Digital Business Case - Done Right!” Deloitte, August 2019. Accessed October 2022.
“Propelling an Aerospace Innovator.” Accenture, 2021. Accessed October 2022.
Schmidt-Subramanian, Maxie. “The ROI of CX Transformation.” Forrester, 15 August 2019. Accessed November 2022.
Ward, John, et al. “Building Better Business Cases for IT Investments.” California Management Review, Sept. 2007. Web.
EA’s role in brokering and negotiating overlapping areas can lead to the creation of additional efficiencies at the enterprise level.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
In an accelerated path to digitization, the increasingly important role of enterprise architecture is one of collaboration across siloes, inside and outside the enterprise, in a configurable way that allows for quick adjustment to new threats and conditions, while embracing unprecedented opportunities to scale, stimulating innovation, in order to increase the organization’s competitive advantage.
Enterprise architecture, seen as the glue of the organization, aligns business goals with all the other aspects of the organization, providing additional effectiveness and efficiencies while also providing guardrails for safety.
In an accelerated path to digitization, the increasingly important role of enterprise architecture (EA) is one of collaboration across siloes, inside and outside the enterprise, in a configurable way that allows for quick adjustment to new threats and conditions while embracing unprecedented opportunities to scale, stimulating innovation to increase the organization’s competitive advantage.
![]() |
Milena Litoiu
|
The Digital transformation journey brings Business and technology increasingly closer.
Because the two become more and more intertwined, the role OF Enterprise Architecture increases in importance, aligning the two in providing additional efficiencies.
THE Current need for an accelerated Digital transformation elevates the importance of Enterprise Architecture.
More than 70% of organizations revamp their enterprise architecture programs. (Info-Tech Tech Trends 2022 Survey)
Most organizations still see a significant gap between the business and IT.
EA's role in brokering and negotiating overlapping areas can lead to the creation of additional efficiencies at the enterprise level.
Approaches:
A plethora of approaches are needed (e.g. architecture modularity, data integration, AI/ML) in addition to other Agile/iterative approaches for the entire organization.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This research focuses on verified digital identity ecosystems and explores risks, opportunities, and challenges of relying on verified digital IDs and also how adopting digital identity initiatives can improve customer experience and operational efficiency. It covers:
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
Amid the pandemic-fueled surge of online services, organizations require secure solutions to safeguard digital interactions. These solutions must be uniform, interoperable, and fortified against security threats. Although the digital identity ecosystem has garnered significant attention and investment, many organizations remain uncertain about its potential for authentication and authorization required for B2B and B2C transactions. They still wonder if digital ID can help reduce cost of operations and transfer data risks. |
Limited or lack of understanding of the global Digital ID ecosystem and its varying approaches across countries handicap businesses in defining the potential benefits Digital ID can bring to customer interactions and overall business management. In addition, key obstacles exist in balancing customer privacy (including the right to be forgotten), data security, and regulatory requirements while pursuing desired end-user experience and high customer adoption. |
Digital ID has many dimensions, and its ecosystem's sustainability lies in the key principles it is built on. Understanding the digital identity ecosystem and its responsibilities is crucial to formulate an approach to adopt it. Also, focusing on key success factors drives digital ID adoption. Before embarking on the digital identity adoption journey, it is essential to assess your readiness. It is also necessary to understand the risks and challenges. Specific steps to digital ID adoption can help realize the potential of digital identity and enhance the customers' experience. |
Info-Tech Insight
Focusing on customer touchpoints and transforming them is key to excellent user experience and increasing their lifetime value (LTV) to them and to your organization. Digital ID is that tool of transformation.
|
Manish Jain Principal Research Director |
“I just believed. I believed that the technology would change people's lives. I believed putting real identity online - putting technology behind real identity - was the missing link.” - Sheryl Sandberg (Brockes, Emma. “Facebook’s Sheryl Sandberg: who are you calling bossy?” The Guardian, 5 April 2014)Sometimes dismissed as mere marketing gimmicks, digital identity initiatives are anything but. While some argue that any online credential is a "Digital ID," rendering the hype around it pointless, the truth is that a properly built digital ID ecosystem has the power to transform laggard economies into global digital powerhouses. Moreover, digital IDs can help businesses transfer some of their cybersecurity risks and unlock new revenue channels by enabling a foundation for secure and efficient value delivery. In addition, digital identity is crucial for digital and financial inclusion, simplifying onboarding processes and opening up new opportunities for previously underserved populations. For example, in India, the Aadhaar digital ID ecosystem brought over 481 million1 people into the formal economy by enabling access to financial services. Similarly, in Indonesia, the e-KIP digital ID program paved the way for 10 million new bank accounts, 94% of which were for women2. However, digital identity initiatives also come with valid concerns, such as the risk of a single point of failure and the potential to widen the digital divide. This research focuses on the verified digital identity ecosystem, exploring the risks, opportunities, and challenges organizations face relying on these verified digital IDs to know their customers before delivering value. By understanding and adopting digital identity initiatives, organizations can unlock their full potential and provide a seamless customer experience while ensuring operational efficiency. 1 India Aadhaar PMJDY (https://pmjdy.gov.in/account)2 Women’s World Banking, 2020. |
“Digital identity (ID) is a set of attributes that links a physical person with their online interactions. Digital ID refers to one’s online persona - an online footprint. It touches important aspects of one’s everyday life, from financial services to health care and beyond.” - DIACC Canada
“Digital identity is a digital representation of a person. It enables them to prove who they are during interactions and transactions. They can use it online or in person.” - UK Digital Identity and Attributes Trust Framework
“Digital identity is an electronic representation of an entity (person or other entity such as a business) and it allows people and other entities to be recognized online.” - Australia Trusted Digital Identity Framework
A digital identity is primarily an electronic form of identity representing an entity uniquely , while abstracting all other identity attributes of the entity. In addition to an electronic form, it may also exist in a physical form (identity certificate), linked through an identifier representing the same entity.
|
Trust
|
Subject
|
|
Usability
|
Provider
|
|
Jurisdiction
|
Form
|
|
Governance
|
Expiry
|
|
Usage Mode
|
Purpose
|
Info-Tech Insight
Digital ID has taken different meanings for different people, serving different purposes in different environments. Based on various aspects of Digital Identification, it can be categorized in several types. However, most of the time when people refer to a form of identification as Digital ID, they refer to a verified id with built-in trust either from the government OR the eco-system.
Info-Tech Insight
Digital identity ecosystems comprise many entities playing different roles, and sometimes more than one. In addition, variations in approach by jurisdictions drive how many active players are in the ecosystem for that jurisdiction.
For example, in countries like Estonia and India, government plays the role of trust and governance authority as well as ID provider, but didn’t start with any Digital ID wallet. In contrast, in Ukraine, Diia App is primarily a Digital ID Wallet. Similarly, in the US, different states are adopting private Digital ID Wallet providers like Apple.
Social, economic, and legal alignment with target stakeholders
Transparent governance and operation
Legally auditable and enforceable
Robust and Resilient – High availability
Security – At rest, in progress, and in transit
Privacy and Control with users
Omni-channel Convenience – User and Operations
Minimum data transfer between entities
Technical interoperability enabled through open standards and protocol
Scalable and interoperable at policy level
Cost effective – User and operations
Inclusive and accessible
Info-Tech Insight
A transparent, resilient, and auditable digital ID system must be aligned with socio-economic realities of the target stakeholders. It not only respects their privacy and security of their data by minimizing the data transfer between entities, but also drives desired customer experience by providing an omni-channel, interoperable, scalable, and inclusive ecosystem while still being cost-effective for the collaborators.
Digital ID success factors
Legislative regulatory framework – Removes uncertainty
Security & Privacy Assurance- builds trust
Smooth user experience – Drives preferences
Transparent ecosystem – Drives inclusivity
Multi-channel – Drive consistent experience online / offline
Inter-operability thorough open standards
Digital literacy – Education and awareness
Multi-purpose & reusable – Reduce consumer burden
Collaborative ecosystem –Build network effect
Info-Tech Insight
Driving adoption of Digital ID requires affirmative actions from all ecosystem players including governing authorities, identity providers, and identity consumers (relying parties).
These nine success factors can help drive sustainable adoption of the Digital ID.
|
|
|
Info-Tech Insight
The world became global a long time ago; however, it sustained economic progress without digital IDs for most of the world's population.
With the pandemic, when political rhetoric pointed to the demand for localized supply chains, economies became irreversibly digital. In this digital economy, the digital ID ecosystem is the fulcrum of sustainable growth.
At a time in overlapping jurisdictions, multiple digital IDs can exist. For example, one is issued by a local municipality, one by the province, and another by the national government.
Info-Tech Insight
Countries’ approach to the digital ID is rooted in their socio-economic environment and global aspirations.
Emerging economies with large underserved populations prioritize fast implementation of digital ID through centralized systems.
Developed economies with smaller populations, low trust in government, and established ID systems prioritize developing trust frameworks to drive decentralized full-scale implementation.
There is no right way except the one which follows Digital ID principles and aligns with a country’s and its people’s aspirations.
|
|
Uniqueness Estonia pioneered the digital ID implementation with a centralized approach and later transitioned to a decentralized ecosystem driving trust to attract non-citizens into Estonia’s digital economy. |
99% Of Estonian residents have an ID card enabling use of electronic ID 1.4 B Digital signatures given (2021) 99% Public Services available as e-Services 17K+ Productive years saved (five working days/citizen/year saved accessing public services) 25K E-resident companies contributed more than €32 million in tax *Source: https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf ; |
|
| 1.36B People enrolled 80% Beneficiaries feel Aadhaar has made PDS, employment guarantee and social pensions more reliable 91.6% Are very satisfied or somewhat satisfied with Aadhaar 14B eKYC transactions done by 218 eKYC authentication agencies (KUA) Source: https://uidai.gov.in/aadhaar_dashboard/india.php; https://www.stateofaadhaar.in/ | Uniqueness “The Aadhaar digital identity system could reduce onboarding costs for Indian firms from 1,500 rupees to as low as an estimated 10 rupees.” -World Bank Report on Private Sector Impacts from ID With lack of public trust in private sector, government brought in private sector executives in public ecosystem to lead the largest identity program globally and build the India stack to leverage the power of Digital Identity. |
Regulatory Accountability and Operational Governance: Ministry of Digital Transformation. Identity provider: Federated govt. agencies. Digital identity form: Diia App & Portal as a digital wallet for all IDs including digital driving license. |
| 18.5M People downloaded the Diia app. 14 Digital IDs provided by other ID providers are available through Diia. 70 Government services are available through Diia. ~1M Private Entrepreneurs used Diia to register their companies. 1300 Tons of paper estimated to be saved by reducing paper applications for new IDs and replacements. Source:
| Uniqueness “One of the reasons for the Diia App's popularity is its focus on user experience. In September 2022, the Diia App simplified 25 public services and digitized 16 documents. The Ministry of Digital Transformation aims to make 100% of all public services available online by 2024.” - Vladyslava Aleksenko Project Lead—digital Identity, Ukraine |
|
| ![]() | 82% People supportive of Digital ID. 2/3 Canadians prefer public-private partnership for Pan-Canadian digital ID framework. >40% Canadians prefer completing various tasks and transactions digitally. 75% Canadians are willing to share personal information for better experience. >80% Trust government, healthcare providers, and financial institutions with their personal information. Source: DIACC Survey 2021 | Uniqueness Although a few provinces in Canada started their Digital ID journey already, federally, Canada lacked an approach. Now Canada is developing a federated Digital ID ecosystem driven through the Pan-Canadian Trust Framework (PCTF) led by a non-profit (DIACC) formed with public and private partnership. |
| 8.6M People using myGovID by Jun-2022 117 Services accessible through Digital Id System
| Uniqueness Australia started its journey of Digital ID with a centralized Digital ID ecosystem. However, now it preparing to transition to a centrally governed Trust framework-based ecosystem expanding to private sector. |
| ![]() | Uniqueness UK embarked its Digital ID journey through Gov.UK Verify but decided to scrap it recently. It is now preparing to build a trust framework-based federated digital ID ecosystem with roles like schema-owners and orchestration service providers for private sector and drive the collaboration between industry players. |
|
Cross Industry |
Financial Services |
Insurance |
E-governance |
Healthcare & Lifesciences |
Travel and Tourism |
E-Commerce |
|
|
|
|
|
|
|
INDUSTRY: Travel & Tourism
Source: Info-Tech Research Group
|
Challenge |
Solution |
Results |
|---|---|---|
|
Verifying the driver’s license (DL) is the first step a car rental company takes before handing over the keys. While the rental company only need to know the validity of the DL and if it belongs to the presenter, is bears the liability of much more data presented to them through the DL. For customers, it is impossible to rent a car if they forget their DL. If the customer has their driver’s license, they compromise their privacy and security as they hand over their license to the representative. The process is not only time consuming, it also creates unnecessary risks to both the business and the renter. |
A digital id-based rental process allows the renter to present the digital id online or in person. As the customer approaches the car rental they present their digital id on the mobile app, which has already authenticated the presenter though the biometrics or other credentials. The customer selects the purpose of the business as “Car Rental”, and only the customer’s name, photo, and validity of the DL appear on the screen for the representative to see (selective disclosures). If the car pick-up is online, only this information is shared with the car rental company, which in turn shares the car and key location with the renter. |
A digital identity-based identity verification can ensure a rental company has access to the minimum data it needs to comply with local laws, which in turn reduces its data leak risk. It also reduces customer risks linked to forgetting the DL, and data privacy. Digital identity also reduces the risk originated from identity fraud leading to stolen cars. |
INDUSTRY: Government
Source: Info-Tech Research Group
Challenge | Solution | Results |
|---|---|---|
In both emerging and developed economies, public distribution of resources – food, subsidies, or cash – is a critical process through which many people (especially from marginalized sections) survive on. They often either don’t have required valid proof of identity or fall prey to low-level corruption when someone defrauds them by claiming the benefit. As a result, they either completely miss out on claiming government-provided social benefits OR only receive a part of what they are eligible for. | A Digital ID based public distribution can help created a Direct Benefit Transfer ecosystem. Here beneficiaries register (manually OR automatically from other government records) for the benefits they are eligible for. On the specific schedule, they receive their benefit – monetary benefit in their bank accounts, and non-cash benefits, in person from authorized points-of-sales (POS), without any middleman with discretionary decision powers on the distribution. | India launched its Financial Inclusion Program (Prime Minister's Public Finance Scheme) in 2014. The program was linked with India’s Digital Id Aadhaar to smoothen the otherwise bureaucratic and discretionary process for opening a bank account. In last eight years, ~481M (Source: PMJDY) beneficiaries have opened a bank account and deposited ~ ₹1.9Trillion (USD$24B), a part of which came as social benefits directly deposited to these accounts from the government of India. |
INDUSTRY: Asset Management
Source: Info-Tech Research Group
Challenge | Solution | Results |
|---|---|---|
“Impersonators posing as homeowners linked to 32 property fraud cases in Ontario and B.C.” – Global News Canada1 “The level of fraud in the UK is such that it is now a national security threat” – UK Finance Lobby Group2 Real estate is the most expensive investment people make in their lives. However, lately it has become a soft target for title fraud. Fraudsters steal the title to one’s home and sell it or apply for a new mortgage against it. At the root cause of these fraud are usually identity theft when a fraudster steals someone’s identity and impersonates them as the title owner. | Digital identity tagged to the home ownership / title record can reduce the identity fraud in title transfer. When a person wants to sell their house OR apply for a new mortgage on house, multiple notifications will be triggered to their contact attributes on digital ID – phone, email, postal address, and digital ID Wallet, if applicable. The homeowner will be mandated to authorize the transaction on at least two channels they had set as preferred, to ensure that the transaction has the consent of the registered homeowner. | This process will stop any fraud transactions until at least two modes are compromised. Even if two modes are compromised, the real homeowner will receive the notification on offline communication modes, and they can then alert the institution or lawyer to block the transaction. It will especially help elderly people, who are more prone to fall prey to identity frauds when somebody uses their IDs to impersonate them. |
1 Global News (https://globalnews.ca/news/9437913/homeowner-impersonators-lined-32-fraud-cases-ontario-bc/)
2 UK Finance Lobby Group (https://www.ukfinance.org.uk/system/files/Half-year-fraud-update-2021-FINAL.pdf)
|
Governments & identity providers (public & private) |
Customers and end users (subjects) |
Identity consumer (relying parties) |
|---|---|---|
|
|
|
|
Governments and identity providers (public and private) |
|---|
|
|
Customers and end users (subjects) |
|---|
|
|
Identity consumer (relying parties) |
|---|
|
Does your target jurisdiction have adequate legislative framework to enable uses of digital identities in your industry?
If the Digital ID ecosystem in your target jurisdiction is trust framework-based, do you have adequate understanding of it?
Do you have exact understanding of value stream and customer touch-points where you interact with user identity?
Do you have exact understanding of the identity attributes that your business processes need to deliver customer value?
Do you have required systems to ensure your compliance with industry regulations around customer PII and identity?
Is your existing identity management system interoperable with Open-source Digital Identity ecosystem?
Have you established an integrated enterprise governance framework covering business processes, technical systems, and risk management?
Do have a clear strategy (mode, method, means) to communicate with your target customer and persuade them to adopt digital identity?
Do you have security operations center coordinating detection, response, resolution, and communication of potential data breaches?
|
Considering the complexity of digital identity adoption, and its impact on customer experience, it is vital to assess the ecosystem and adopt an MVP approach before a big-bang launch.
|
|
|
Digital ID adoption is a major change for everyone in the ecosystem. Manage associated risks to avoid the derailing of integration with your business processes and a negative impact on customer experience.
|
|
| 1 |
Customer-centricity Digital identity initiative should prioritize customer experience when evaluating its fit in the value stream. Adopting it should not sacrifice end-user experience to gain a few brownie points. See Info-Tech’s Adopt Design Thinking in Your Organization blueprint, to ensure customer remains at the center of your Digital Adoption initiative. |
|---|---|
| 2 |
Privacy and security Adopting digital identity reduces data risk by minimizing data transfer between providers and consumers. However, securing identity attributes in value streams still requires strengthening enterprise security systems and processes. See Info-Tech’s Assess and Govern Identity Security blueprint for the actions you may take to secure and govern digital identity. |
| 3 |
Inclusion and awareness Adopting digital identity may alter customer interaction with an organization. To avoid excluding target customer segments, design digital identity accordingly. Educating and informing customers about the changes can facilitate faster adoption. See Info-Tech’s Social Media blueprint and IT Diversity & Inclusion Tactics to make inclusion and awareness part of digital adoption |
| 4 |
Quantitative success metrics To measure the success of a digital ID adoption program, it's essential to use quantitative metrics that align with business KPIs. Some measurable KPIs may include:
|
Continues..
Attributes: An identity attribute is a statement or information about a specific aspect of entity’s identity ,substantiating they are who they claim to be, own, or have.
Attribute (or Credential) provider: An attribute or credential provider could be an organization which issues the primary attribute or credential to a subject or entity. They are also responsible for identity-attribute binding, credential maintenance, suspension, recovery, and authentication.
Attribute (or Credential) service provider: An attribute service provider could be an organization which originally vetted user’s credentials and certified a specific attribute of their identity. It could also be a software, such as digital wallet, which can store and share a user’s attribute with a third party once consented by the user. (Source: UK Govt. Trust Framework)
Attribute binding: This is a process an attribute service providers uses to link the attributes they created to a person or an organization through an identifier. This process makes attributes useful and valuable for other entities using these attributes. For example, when a new employee joins a company, they are given a unique employee number (an identifier), which links the person with their job title and other aspects (attributes) of his job. (Source: UK Govt. Trust Framework)
Authentication service provider: An organization which is responsible for creating and managing authenticators and their lifecycle (issuance, suspension, recovery, maintenance, revocation, and destruction of authenticators). (Source: DIACC)
Authenticator: Information or biometric characteristics under the control of an individual that is a specific instance of something the subject has, knows, or does. E.g. private signing keys, user passwords, or biometrics like face, fingerprints. (Source: Canada PCTF)
Authentication (identity verification): The process of confirming or denying that the identity presented relates to the subject who is making the claim by comparing the credentials presented with the ones presented during identity proofing.
Authorization: The process of validating if the authenticated entity has permission to access a resource (service or product).
Biometrics attributes: Human attributes like retina (iris), fingerprint, heartbeat, facial, handprint, thumbprint, voice print.
Centralized identity: Digital identities which are fully governed by a centralized government entity. It may have enrollment or registration agencies, private or public sector, to issue the identities, and the technical system may still be decentralized to keep data federated.
Certificate Authority (CA or accredited assessors): An organization or an entity that conducts assessments to validate the framework compliance of identity or attribute providers (such as websites, email addresses, companies, or individual persons) serving other users, and binding them to cryptographic keys through the issuance of electronic documents known as digital certificates.
Continues..
Collective (non-resolvable) attributes: Nationality, domicile, citizenship, immigration status, age group, disability, income group, membership, (outstanding) credit limit, credit score range.
Contextual identity: A type of identity which establishes an entity’s existence in a specific context – real or virtual. These can be issued by public or private identity providers and are governed by the organizational policies. E.g. employee ID, membership ID, social media ID, machine ID.
Credentials: A physical or a digital representation of something that establishes an entity’s eligibility to do something for which it is seeking permission, or an association/affiliation with another, generally well-known entity. E.g. Passport, DL, password. In the context of Digital Identity, every identity needs to be attached with a credential to ensure that the subject of the identity can control how and by whom that identity can be used.
Cryptographic hash function: A hash function is a one-directional mathematical operation performed on a message of any length to get a unique, deterministic, and fixed size numerical string (the hash) which can’t be reverse engineered to get the input data without deploying disproportionate resources. It is the foundation of modern security solutions in DLT / blockchain as they help in verifying the integrity and authenticity of the message.
Decentralized identity (DID) or self-sovereign identity: This is a way to give back the control of identity to the subject whose identity it is, using an identity wallet in which they collect verified information about themselves from certified issuers (such as the government). By controlling what information is shared from the wallet to requesting third parties (e.g. when registering for a new online service), the user can better manage their privacy, such as only presenting proof that they’re over 18 without needing to reveal their date of birth. Source: (https://www.gsma.com/identity/decentralised-identity)
Digital identity wallet: A type of digital wallet refers to a secure, trusted software applications (native mobile app, mobile web apps, or Rivas-hosted web applications) based on common standards, allowing a user to store and use their identity attributes, identifiers, and other credentials without loosing or sharing control of them. This is different than Digital Payment Wallets used for financial transactions. (Source: https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf)
Digital identity: A digital identity is primarily an electronic form of identity representing an entity uniquely , while abstracting all other identity attributes of the entity. In addition to an electronic form, it may also exist in a physical form (identity certificate), linked through an identifier representing the same entity. E.g. Estonia eID , India Aadhar, digital citizenship ID.
Digital object architecture: DOA is an open architecture for interoperability among various information systems, including ID wallets, identity providers, and consumers. It focuses on digital objects and comprises three core components: the identifier/resolution system, the repository system, and the registry system. There are also two protocols that connect these components. (Source: dona.net)
Digital signature: A digital signature is an electronic, encrypted stamp of authentication on digital information such as email messages, macros, or electronic documents. A signature confirms that the information originated from the signer and has not been altered. (Source: Microsoft)
Continues..
Entity (or Subject): In the context of identity, an entity is a person, group, object, or a machine whose claims need to be ascertained and identity needs to be established before his request for a service or products can be fulfilled. An entity can also be referred to as a subject whose identity needs to be ascertained before delivering a service.
Expiry: This is another dimension of an identity and determines the validity of an ID. Most of the identities are longer term, but there can be a few like digital tokens and URLs which can be issued for a few hours or even minutes. There are some which can be revoked after a pre-condition is met.
Federated identity: Federated identity is an agreement between two organizations about the definition and use of identity attributes and identifiers of a consumer entity requesting a service. If successful, it allows a consumer entity to get authenticated by one organization (identity provider) and then authorized by another organization. E.g. accessing a third-party website using Google credentials.
Foundational identity: A type of identity which establishes an entity’s existence in the real world. These are generally issued by public sector / government agencies, governed by a legal farmwork within a jurisdiction, and are widely accepted at least in that jurisdiction. E.g. birth certificate, citizenship certificate.
Governance: This is a dimension of identity that covers the governance model for a digital ID ecosystem. While traditionally it has been under the sovereign government or a federated structure, in recent times, it has been decentralized through DLT technologies or trust-framework based. It can also be self-sovereign, where individuals fully control their data and ID attributes.
Identifier: A digital identifier is a string of characters that uniquely represents an entity’s identity in a specific context and scope even if one or more identity attributes of the subject change over time. E.g. driver’s license, SSN, SIN, email ID, digital token, user ID, device ID, cookie ID.
Identity: An identity is an instrument used by an entity to provide the required information about itself to another entity in order to avail a service, access a resource, or exercise a privilege. An identity formed by 1-n identity attributes and a unique identifier.
Identity and access management (IAM): IAM is a set of frameworks, technologies, and processes to enable the creation, maintenance, and use of digital identity, ensuring that the right people gain access to the right materials and records at the right time. (Source: https://iam.harvard.edu/)
Identity consumer (Relying party): An organization, or an entity relying on identity provider to mitigate IT risks around knowing its customers before delivering the end-user value (product/service) without deteriorating end-user experience. E.g. Canada Revenue Agency using SecureKey service and relying on Banking institutions to authenticate users; Telecom service providers in India relying on Aadhaar identity system to authenticate the customer's identity.
Identity form: A dimension of identity that defines its forms depending on the scope it wants to serve. It can be a physical card for offline uses, a virtual identifier like a number, or an app/account with multiple identity attributes. Cryptographic keys and tokens can also be forms of identity.
Continues...
Identity infrastructure provider: Organizations involved in creating and maintaining technological infrastructure required to manage the lifecycle of digital identities, attributes, and credentials. They implement functions like security, privacy, resiliency, and user experience as specified in the digital identity policy and trust framework.
Identity proofing: A process of asserting the identification of a subject at a useful identity assurance level when the subject provides evidence to a credential service provider (CSP), reliably identifying themselves. (Source: NIST Special Publication 800-63A)
Identity provider (Attestation authority): An organization or an entity validating the foundation or contextual claims of a subject and establishing identifier(s) for a subject. E.g. DMV (US) and MTA (Canada) issuing drivers’ licenses; Google / Facebook issuing authentication tokens for their users logging in on other websites.
Identity validation: The process of confirming or denying the accuracy of identity information of a subject as established by an authorized party. It doesn’t ensure that the presenter is using their own identity.
Identity verification (Authentication): The process of confirming or denying that the identity presented relates to the subject who is making the claim by comparing the credentials presented with the ones presented during identity proofing.
Internationalized resource identifier (IRI): IRIs are equivalent to URIs except that IRIs also allow non-ascii characters in the address space, while URIs only allow us-ascii encoding. (Source: w3.org)
Jurisdiction: A dimension of identity that covers the physical area or virtual space where an identity is legally acceptable for the purpose defined under law. It can be global, like it is for passport, or it can be local within a municipality for specific services. For unverified digital IDs, it can be the social network.
Multi-factor Authentication (MFA): Multi-factor authentication is a layered approach to securing digital assets (data and applications), where a system requires a user to present a combination of two or more credentials to verify a user’s identity for login. These factors can be a combination of (i) something you know like a password/PIN; (ii) something you have like a token on mobile device; and (iii) something you are like a biometric. (Adapted from https://www.cisa.gov/publication/multi-factor-authentication-mfa)
Oauth (Open authorization): OAuth is a standard authorization protocol and used for access delegation. It allows internet users to access websites by using credentials managed by a third-party authorization server / Identity Provider. It is designed for HTTP and allows access tokens to be issued by an authorization server to third-party websites. E.g. Google, Facebook, Twitter, LinkedIn use Oauth to delegate access.
OpenID: OpenID is a Web Authentication Protocol and implements reliance authentication mechanism. It facilitates the functioning of federated identity by allowing a user to use an existing account (e.g. Google, Facebook, Yahoo) to sign into third-party websites without needing to create new credentials. (Source: https://openid.net/).
Continues...
Personally identifiable information (PII): PII is a set of attributes which can be used, through direct or indirect means, to infer the real-world identity of the individual whose information is input. E.g. National ID (SSN/SIN/Aadhar) DL, name, date of birth, age, address, age, identifier, university credentials, health condition, email, domain name, website URI (web resolvable) , phone number, credit card number, username/password, public key / private key. (Source: https://www.dol.gov)
Predicates: The mathematical or logical operations such as equality or greater than on attributes (e.g. prove your salary is greater than x or your age is greater than y) to prove a claim without sharing the actual values.
Purpose: This dimension of a digital id defines for what purpose digital id can be used. It can be one or many of these – authentication, authorization, activity linking, historical record keeping, social interactions, and machine connectivity for IoT use cases.
Reliance authentication: Relying on a third-party authentication before providing a service. It is a method followed in a federated entity system.
Risk-based authentication: A mechanism to protect against account compromise or identity theft. It correlates an authentication request with transitional facts like requester’s location, past frequency of login, etc. to reduce the risk of potential fraud.
Scheme in trust framework: A specific set of rules (standard and custom) around the use of digital identities and attributes as agreed by one or more organizations. It is useful when those organizations have similar products, services, business processes. (Source: UK Govt. Trust Framework). E.g. Many credit unions agree on how they will use the identity in loan origination and servicing.
Selective disclosure (Assertion): A way to present one’s identity by sharing only a limited amount information that is critical to make an authentication / authorization decision. E.g. when presenting your credentials, you could share something proving you are 18 years or above, but not share your name, exact age, address, etc.
Trust: A dimension of an identity, which essentially is a belief in the reliability, truth, ability, or strength of that identity. While in the physical world all acceptable form of identities come with a verified trust, in online domain, it can be unverified. Also, where an identity is only acceptable as per the contract between two entities, but not widely.
Trust framework: The trust framework is a set of rules that different organizations agree to follow to deliver one or more of their services. This includes legislation, standards, guidance, and the rules in this document. By following these rules, all services and organizations using the trust framework can describe digital identities and attributes they’ve created in a consistent way. This should make it easier for organizations and users to complete interactions and transactions or share information with other trust framework participants. (Source: UK Govt. Trust Framework)
Continues...
Uniform resource identifier (URI): A universal name in registered name spaces and addresses referring to registered protocols or name spaces.
Uniform resource locator (URL): A type of URI which expresses an address which maps onto an access algorithm using network protocols. (Source: https://www.w3.org/)
Uniform resource name (URN): A type of URI that includes a name within a given namespace but may not be accessible on the internet.
Usability: A dimension of identity that defines how many times it can be used. While most of the identities are multi-use, a few digital identities are in token form and can be used only once to authenticate oneself.
Usage mode: A dimension of identity that defines the service mode in which a digital ID can be used. While all digital IDs are made for online usage, many can also be used in offline interactions.
Verifiable credentials: This W3C standard specification provides a standard way to express credentials on the Web in a way that is cryptographically secure, privacy-respecting, and machine-verifiable. (Source: https://www.w3.org/TR/vc-data-model/)
X.509 Certificates: X.509 certificates are standard digital documents that represent an entity providing a service to another entity. They're issued by a certification authority (CA), subordinate CA, or registration authority. These certificates play an important role in ascertaining the validity of an identity provider and in turn the identities issued by it. (Source: https://learn.microsoft.com/en-us/azure/iot-hub/reference-x509-certificates)
Zero-knowledge proofs: A method by which one party (the prover) can prove to another party (the verifier) that something is true, without revealing any information apart from the fact that this specific statement is true. (Source: 1989 SIAM Paper)
Zero-trust security: A cybersecurity paradigm focused on resource protection and the premise that trust is never granted implicitly but must be continually evaluated. It evaluates each access request as if it is a fraud attempt, and grants access only if it passes the authentication and authorization test. (Source: Adapted from NIST, SP 800-207: Zero Trust Architecture, 2020)
Build a Zero Trust Roadmap
Leverage an iterative and repeatable process to apply zero trust to your organization.
Assess and Govern Identity Security
Strong identity security and governance are the keys to the zero-trust future.
Adopt Design Thinking in Your Organization
Innovation needs design thinking to ensure customer remains at the center of everything the organization does.
Social Media
Leveraging Social Media to connect with your customers and educate them to drive the value proposition of your efforts.
IT Diversity & Inclusion Tactics
Equip your teams to create an inclusive environment and mobilize inclusion efforts across the organization.
|
David Wallace |
|
Erik Avakian |
|
Matthew Bourne |
|
Mike Tweedie |
|
Aaron Shum |
India Aadhaar PMJDY (https://pmjdy.gov.in/account)
Theis, S., Rusconi, G., Panggabean, E., Kelly, S. (2020). Delivering on the Potential of Digitized G2P: Driving Women’s Financial Inclusion and Empowerment through Indonesia’s Program Keluarga Harapan. Women’s World Banking.
DIACC Canada (https://diacc.ca/the-diacc/)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
Australia Trusted Digital Identity Framework (https://www.digitalidentity.gov.au/tdif#changes)
eIDAS (https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation)
Europe Digital Wallet – POTENTIAL (https://www.digital-identity-wallet.eu/)
Canada PCTF (https://diacc.ca/trust-framework/)
Identification Revolution: Can Digital ID be harnessed for Development? (Gelb & Metz), 2018
e-Estonia website (https://e-estonia.com/solutions/e-identity/id-card/)
Aadhaar Dashboard (https://uidai.gov.in/)
DIACC Website (https://diacc.ca/the-diacc/)
Australia Digital ID website (https://www.digitalidentity.gov.au/tdif#changes)
UK Policy paper - digital identity & attributes trust framework (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
Ukraine Govt. website (https://ukraine.ua/invest-trade/digitalization/)
Singapore SingPass Website (https://www.tech.gov.sg/products-and-services/singpass/)
Norway BankID Website (https://www.bankid.no/en/private/about-us/)
Brazil National ID Card website (https://www.gov.br/casacivil/pt-br/assuntos/noticias/2022/julho/nova-carteira-de-identidade-nacional-modelo-unico-a-partir-de-agosto)
Indonesia Coverage in Professional Security Magazine (https://www.professionalsecurity.co.uk/products/id-cards/indonesian-cards/)
Philippine ID System (PhilSys) website (https://www.philsys.gov.ph/)
China coverage on eGovReview (https://www.egovreview.com/article/news/559/china-announces-plans-national-digital-ids)
Thales Group Website - DHS’s Automated Biometric Identification System IDENT (https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/customer-cases/ident-automated-biometric-identification-system)
FranceConnect (https://franceconnect.gouv.fr/)
Germany: Office for authorization cert. (https://www.personalausweisportal.de/Webs/PA/DE/startseite/startseite-node.html)
Italian Digital Services Authority (https://www.spid.gov.it/en/)
Monacco Mconnect (https://mconnect.gouv.mc/en)
Estonia eID (https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf)
E-Residency Dashboard (https://www.e-resident.gov.ee/dashboard)
Unique ID authority of India (https://uidai.gov.in/aadhaar_dashboard/india.php)
State of Aadhaar (https://www.stateofaadhaar.in/)
World Bank (https://documents1.worldbank.org/curated/en/219201522848336907/pdf/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf)
WorldBank - ID4D 2022 Annual Report (https://documents.worldbank.org/en/publication/documents-reports/documentdetail/099437402012317995/idu00fd54093061a70475b0a3b50dd7e6cdfe147)
Ukraine Govt. Website for Invest and trade (https://ukraine.ua/invest-trade/digitalization/)
Diia Case study prepared for the office of Canadian senator colin deacon (https://static1.squarespace.com/static/63851cbda1515c69b8a9a2b9/t/6398f63a9d78ae73d2fd5725/1670968891441/2022-case-study-report-diia-mobile-application.pdf)
Canadian Digital Identity Research (https://diacc.ca/wp-content/uploads/2022/04/DIACC-2021-Research-Report-ENG.pdf)
Voilà Verified Trustmark (https://diacc.ca/voila-verified/)
Digital Identity, 06A Federation Onboarding Guidance paper, March 2022 (https://www.digitalidentity.gov.au/sites/default/files/2022-04/TDIF%2006A%20Federation%20Onboarding%20Guidance%20-%20Release%204.6%20%28Doc%20Version%201.2%29.pdf)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
A United Nations Estimate of KYC/AML (https://www.imf.org/Publications/fandd/issues/2018/12/imf-anti-money-laundering-and-economic-stability-straight)
India Aadhaar PMJDY (https://pmjdy.gov.in/account)
Global News (https://globalnews.ca/news/9437913/homeowner-impersonators-lined-32-fraud-cases-ontario-bc/)
UK Finance Lobby Group (https://www.ukfinance.org.uk/system/files/Half-year-fraud-update-2021-FINAL.pdf)
McKinsey Digital ID report (
https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/digital-identification-a-key-to-inclusive-growth)
International Peace Institute (
https://www.ipinst.org/2016/05/information-technology-and-governance-estonia#7)
E-Estonia Report (https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf)
2022 Budget Statement (https://diacc.ca/2022/04/07/2022-budget-statement/)
World Bank ID4D - Private Sector Economic Impacts from Identification Systems 2018 (https://documents1.worldbank.org/curated/en/219201522848336907/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf)
DIACC Canada (https://diacc.ca/the-diacc/)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
https://www.gsma.com/identity/decentralised-identity
https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf
Microsoft Digital signatures and certificates (https://support.microsoft.com/en-us/office/digital-signatures-and-certificates-8186cd15-e7ac-4a16-8597-22bd163e8e96)
https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf
https://www.dona.net/digitalobjectarchitecture
IAM (https://iam.harvard.edu/)
NIST Special Publication 800-63A (https://pages.nist.gov/800-63-3/sp800-63a.html)
https://www.cisa.gov/publication/multi-factor-authentication-mfa
https://openid.net/
U.S. DEPARTMENT OF LABOR (https://www.dol.gov/)
UK govt. trust framework (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
https://www.w3.org/
Verifiable Credentials Data Model v1.1 (https://www.w3.org/TR/vc-data-model/)
https://learn.microsoft.com/en-us/azure/iot-hub/reference-x509-certificates
At Info-Tech, we take pride in our research and have established the most rigorous publication standards in the industry. However, we understand that engaging with all our analysts to gauge the future may not always be possible. Hence, we have curated some compelling recently published research along with forthcoming research insights to assist you in navigating the next quarter.
We offer a quarterly Research Agenda Outcomes deck that thoroughly summarizes our recently published research, supplying decision makers with valuable insights and best practices to make informed and effective decisions. Our research is supported by our team of seasoned analysts with decades of experience in the IT industry.
By leveraging our research, you can stay updated with the latest trends and technologies, giving you an edge over the competition and ensuring the optimal performance of your IT department. This way, you can make confident decisions that lead to remarkable success and improved outcomes.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
A guide to our top research published to date for 2023 (Q2/Q3).

Gord Harrison
Head of Research & Advisory
Info-Tech Research Group
Generative AI is here, and it's time to find its best uses – systematically and responsibly.
Engage cross-functional leadership to seize opportunity while protecting the organization from volatility.
If integrated risk is your destination, your IT risk taxonomy is the road to get you there.
Beyond the hype: How it can help you become more customer-focused?
Generative AI is here, and it's time to find its best uses – systematically and responsibly.
Select flexible work options that balance organizational and employee needs to drive engagement and improve attraction and retention.
Make relationship management a daily habit with a personalized action plan.
Spend less time struggling with visuals and more time communicating about what matters to your executives.
Your implementation doesn't start with technology but with an effective plan that the team can align on.
As you scale your business automations, focus on what matters most.
Agile and requirements management are complementary, not competitors.
Adapt to changes in the cyber insurance market.
Focus first on business value.
Acquire and use discovery tools wisely to populate, update, and validate the data in your ITAM database.
AI prominence across the enterprise value chain.
Bans aren't the answer, but what is?
Business capability maps, value streams, and strategy maps for the wholesale industry.
A strategy for modernizing mainframe systems to meet the needs of modern retail banking.
Building upon the collective wisdom for the art of the possible.
CIO
Strategy & Governance

Bill Wong
Principal Research Director
Download this research or book an analyst call on this topic



CIO
Strategy & Governance

Brian Jackson
Principal Research Director
Download this report or book an analyst call on this topic



CIO
Strategy & Governance

Donna Bales
Principal Research Director
Download this research or book an analyst call on this topic



CIO
Strategy & Governance

Manish Jain
Principal Research Director
Download this research or book an analyst call on this topic



CIO
People & Leadership

Brittany Lutes
Research Director

Diana MacPherson
Senior Research Analyst
Download this research or book an analyst call on this topic



CIO
People & Leadership

Jane Kouptsova
Research Director
Download this research or book an analyst call on this topic



CIO
Value & Performance

Mike Tweedle
Practice Lead
Download this research or book an analyst call on this topic



CIO
Value & Performance

Diana MacPherson
Senior Research Analyst
Download this research or book an analyst call on this topic



Applications
Business Processes

Ricardo de Oliveira
Research Director
Download this research or book an analyst call on this topic



Applications
Business Processes

Andrew Kum-Seun
Research Director
Download this research or book an analyst call on this topic



Applications
Application Development

Vincent Mirabelli
Principal Research Director
Download this research or book an analyst call on this topic



Security
Security Risk, Strategy & Governance

Logan Rohde
Senior Research Analyst
Download this research or book an analyst call on this topic



Security
Security Risk, Strategy & Governance

Michel Hébert
Research Director
Download this research or book an analyst call on this topic



Infrastructure & Operations
I&O Process Management

Andrew Sharp
Research Director
Download this research or book an analyst call on this topic



Industry Coverage
Retail

Rahul Jaiswal
Principal Research Director
Download this research or book an analyst call on this topic



Industry Coverage
Education

Mark Maby
Research Director
Download this research or book an analyst call on this topic



Industry Coverage
Wholesale

Rahul Jaiswal
Principal Research Director
Download this research or book an analyst call on this topic



Industry Coverage
Retail Banking

David Tomljenovic
Principal Research Director
Download this research or book an analyst call on this topic



Industry Coverage
Utilities

Jing Wu
Principal Research Director
Download this research or book an analyst call on this topic



Gord Harrison
Head of Research & Advisory
Info-Tech Research Group

Gord Harrison
Head of Research & Advisory
Info-Tech Research Group

Jack Hakimian
Senior Vice President
Research Development

Aaron Shum
Vice President
Security & Privacy Research

Larry Fretz
Vice President
Industry Research

Mark Tauschek
Vice President
Research Fellowships

Tom Zehren
Chief Product Officer

Rick Pittman
Vice President
Advisory Quality & Delivery

Nora Fisher
Vice President
Shared Services

Becca Mackey
Vice President
Workshops

Geoff Nielson
Senior Vice President
Global Services & Delivery

Brett Rugroden
Senior Vice President
Global Market Programs

Hannes Scheidegger
Senior Vice President
Global Public Sector
Info-Tech Research Group produces unbiased and highly relevant research to help leaders make strategic, timely, and well-informed decisions. We partner closely with your teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for the organization.

Our world-class leadership team is continually focused on building disruptive research and products that drive measurable results and save money.

Our team of experts is composed of the optimal mix of former CIOs, CISOs, PMOs, and other IT leaders and IT and management consultants as well as academic researchers and statisticians.
We enable over 30,000 members to share their insights and best practices that you can use by having direct access to over 100 analysts as an extension of your team.
Contact
Jack Hakimian
jhakimian@infotech.com
We interview hundreds of experts and practitioners to help ensure our research is practical and focused on key member challenges.
For information on Info-Tech's products and services and to participate in our research process, please contact:
Jack Hakimian
jhakimian@infotech.com

Notice what is missing in this list?
During the first reactions to an event, stick to the facts of what is happening and the symptoms. If the symptoms are bad, attend to people first, no matter the financial losses occurring.
Remember that financial losses are typically insured. Human life is not. Only loss of income and ability to pay is insured! Not the person's life.
The WHY, HOW, WHO and other root cause questions are asked in the aftermath of the incident and after you have stabilized the situation.
In ITIL terms, those are Problem Management and Root Cause Analysis stage questions.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Determine the most critical business services to ensure availability.
Craft a monitoring strategy to gather usage data.
Integrate business stakeholders into the capacity management process.
Identify and mitigate risks to your capacity and availability.
[infographic]
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine the most important IT services for the business.
Understand which services to prioritize for ensuring availability.
1.1 Create a scale to measure different levels of impact.
1.2 Evaluate each service by its potential impact.
1.3 Assign a criticality rating based on the costs of downtime.
RTOs/RPOs
List of gold systems
Criticality matrix
Monitor and measure usage metrics of key systems.
Capture and correlate data on business activity with infrastructure capacity usage.
2.1 Define your monitoring strategy.
2.2 Implement your monitoring tool/aggregator.
RACI chart
Capacity/availability monitoring strategy
Determine how to project future capacity usage needs for your organization.
Data-based, systematic projection of future capacity usage needs.
3.1 Analyze historical usage trends.
3.2 Interface with the business to determine needs.
3.3 Develop a plan to combine these two sources of truth.
Plan for soliciting future needs
Future needs
Identify potential risks to capacity and availability.
Develop strategies to ameliorate potential risks.
Proactive approach to capacity that addresses potential risks before they impact availability.
4.1 Identify capacity and availability risks.
4.2 Determine strategies to address risks.
4.3 Populate and review completed capacity plan.
List of risks
List of strategies to address risks
Completed capacity plan
"Nobody doubts the cloud’s transformative power. But will its ascent render “capacity manager” an archaic term to be carved into the walls of datacenters everywhere for future archaeologists to puzzle over? No. While it is true that the cloud has fundamentally changed how capacity managers do their jobs , the process is more important than ever. Managing capacity – and, by extent, availability – means minimizing costs while maximizing uptime. The cloud era is the era of unlimited capacity – and of infinite potential costs. If you put the infinity symbol on a purchase order… well, it’s probably not a good idea. Manage demand. Manage your capacity. Manage your availability. And, most importantly, keep your stakeholders happy. You won’t regret it."
Jeremy Roberts,
Consulting Analyst, Infrastructure Practice
Info-Tech Research Group
✓ CIOs who want to increase uptime and reduce costs
✓ Infrastructure managers who want to deliver increased value to the business
✓ Enterprise architects who want to ensure stability of core IT services
✓ Dedicated capacity managers
✓ Develop a list of core services
✓ Establish visibility into your system
✓ Solicit business needs
✓ Project future demand
✓ Set SLAs
✓ Increase uptime
✓ Optimize spend
✓ Project managers
✓ Service desk staff
✓ Plan IT projects
✓ Better manage availability incidents caused by lack of capacity
According to 451 Research, 59% of enterprises have had to wait 3+ months for new capacity. It is little wonder, then, that so many opt to overprovision. Capacity management is about ensuring that IT services are available, and with lead times like that, overprovisioning can be more attractive than the alternative. Fortunately there is hope. An effective availability and capacity management plan can help you:
Balancing overprovisioning and spending is the capacity manager’s struggle.
If an IT department is unable to meet demand due to insufficient capacity, users will experience downtime or a degradation in service. To be clear, capacity is not the only factor in availability – reliability, serviceability, etc. are significant as well. But no organization can effectively manage availability without paying sufficient attention to capacity.
"Availability Management is concerned with the design, implementation, measurement and management of IT services to ensure that the stated business requirements for availability are consistently met."
– OGC, Best Practice for Service Delivery, 12
"Capacity management aims to balance supply and demand [of IT storage and computing services] cost-effectively…"
– OGC, Business Perspective, 90
| Business | The highest level of capacity management, business capacity management, involves predicting changes in the business’ needs and developing requirements in order to make it possible for IT to adapt to those needs. Influx of new clients from a failed competitor. |
|---|---|
| Service | Service capacity management focuses on ensuring that IT services are monitored to determine if they are meeting pre-determined SLAs. The data gathered here can be used for incident and problem management. Increased website traffic. |
| Component | Component capacity management involves tracking the functionality of specific components (servers, hard drives, etc.), and effectively tracking their utilization and performance, and making predictions about future concerns. Insufficient web server compute. |
The C-suite cares about business capacity as part of the organization’s strategic planning. Service leads care about their assigned services. IT infrastructure is concerned with components, but not for their own sake. Components mean services that are ultimately designed to facilitate business.
Industry: Healthcare
Source: Interview
New functionalities require new infrastructure
There was a project to implement an elastic search feature. This had to correlate all the organization’s member data from an Oracle data source and their own data warehouse, and pool them all into an elastic search index so that it could be used by the provider portal search function. In estimating the amount of space needed, the infrastructure team assumed that all the data would be shared in a single place. They didn’t account for the architecture of elastic search in which indexes are shared across multiple nodes and shards are often split up separately.
Beware underestimating demand and hardware sourcing lead times
As a result, they vastly underestimated the amount of space that was needed and ended up short by a terabyte. The infrastructure team frantically sourced more hardware, but the rush hardware order arrived physically damaged and had to be returned to the vendor.
Sufficient budget won’t ensure success without capacity planning
The project’s budget had been more than sufficient to pay for the extra necessary capacity, but because a lack of understanding of the infrastructure impact resulted in improper forecasting, the project ended up stuck in a standstill.
There are three variables that are monitored, measured, and analyzed as part of availability management more generally (Valentic).
The availability of a system is the percentage of time the system is “up,” (and not degraded) which can be calculated using the following formula: uptime/(uptime + downtime) x 100%. The more components there are in a system, the lower the availability, as a rule.
The length of time a component/service can go before there is an outage that brings it down, typically measured in hours.
The amount of time it takes for a component/service to be restored in the event of an outage, also typically measured in hours.
| Features of the public cloud | Implications for capacity management |
|---|---|
| Instant, or near-instant, instantiation | Lead times drop; capacity management is less about ensuring equipment arrives on time. |
| Pay-as-you go services | Capacity no longer needs to be purchased in bulk. Pay only for what you use and shut down instances that are no longer necessary. |
| Essentially unlimited scalability | Potential capacity is infinite, but so are potential costs. |
| Offsite hosting | Redundancy, but at the price of the increasing importance of your internet connection. |
Traditionally, increases in capacity have come in bursts as a reaction to availability issues. This model inevitably results in overprovisioning, driving up costs. Access to the cloud changes the equation. On-demand capacity means that, ideally, nobody should pay for unused capacity.
The cloud reality does not look like the cloud ideal. Even with the ostensibly elastic cloud, vendors like the consistency that longer-term contracts offer. Enter reserved instances: in exchange for lower hourly rates, vendors offer the option to pay a fee for a reserved instance. Usage beyond the reserved will be billed at a higher hourly rate. In order to determine where that line should be drawn, you should engage in detailed capacity planning. Unfortunately, even when done right, this process will result in some overprovisioning, though it does provide convenience from an accounting perspective. The key is to use spot instances where demand is exceptional and bounded. Example: A university registration server that experiences exceptional demand at the start of term but at no other time.

Even in the era of elasticity, capacity planning is crucial. Spot instances – the spikes in the graph above – are more expensive, but if your capacity needs vary substantially, reserving instances for all of the space you need can cost even more money. Efficiently planning capacity will help you draw this line.
Simple and effective. Sometimes a simple display can convey all of the information necessary to manage critical systems. In cars it is important to know your speed, how much fuel is in the tank, and whether or not you need to change your oil/check your engine.
Where to begin?! Specialized information is sometimes necessary, but it can be difficult to navigate.
|
STEP 1 |
STEP 2 |
STEP 3 |
STEP 4 |
STEP 5 |
|---|---|---|---|---|
|
Record applications and dependencies Utilize your asset management records and document the applications and systems that IT is responsible for managing and recovering during a disaster. |
Define impact scoring scale Ensure an objective analysis of application criticality by establishing a business impact scale that applies to all applications. |
Estimate impact of downtime Leverage the scoring criteria from the previous step and establish an estimated impact of downtime for each application. |
Identify desired RTO and RPO Define what the RTOs/RPOs should be based on the impact of a business interruption and the tolerance for downtime and data loss. |
Determine current RTO/RPO Conduct tabletop planning and create a flowchart of your current capabilities. Compare your current state to the desired state from the previous step. |
According to end users, every system is critical and downtime is intolerable. Of course, once they see how much totally eliminating downtime can cost, they might change their tune. It is important to have this discussion to separate the critical from the less critical – but still important – services.
"It is wrong to suppose that if you can’t measure it, you can’t manage it – a costly myth."
– W. Edwards Deming, statistician and management consultant, author of The New Economics
While it is true that total monitoring is not absolutely necessary for management, when it comes to availability and capacity – objectively quantifiable service characteristics – a monitoring strategy is unavoidable. Capturing fluctuations in demand, and adjusting for those fluctuations, is among the most important functions of a capacity manager, even if hovering over employees with a stopwatch is poor management.
|
Do |
Do not |
|---|---|
|
✓ Develop a positive relationship with business leaders responsible for making decisions. ✓ Make yourself aware of ongoing and upcoming projects. ✓ Develop expertise in organization-specific technology. ✓ Make the business aware of your expenses through chargebacks or showbacks. ✓ Use your understanding of business projects to predict business needs; do not rely on business leaders’ technical requests alone. |
X Be reactive. X Accept capacity/availability demands uncritically. X Ask line of business managers for specific computing requirements unless they have the technical expertise to make informed judgments. X Treat IT as an opaque entity where requests go in and services come out (this can lead to irresponsible requests). |
The company meeting
“I don’t need this much RAM,” the application developer said, implausibly. Titters wafted above the assembled crowd as her IT colleagues muttered their surprise. Heads shook, eyes widened. In fact, as she sat pondering her utterance, the developer wasn’t so sure she believed it herself. Noticing her consternation, the infrastructure manager cut in and offered the RAM anyway, forestalling the inevitable crisis that occurs when seismic internal shifts rock fragile self-conceptions. Until next time, he thought.
"Work expands as to fill the resources available for its completion…"
– C. Northcote Parkinson, quoted in Klimek et al.
Critical inputs
In order to project your future needs, the following inputs are necessary.


If your focus is on ensuring process continuity in the event of a disaster.
If your focus is on flow mapping and transaction monitoring as part of a plan to engage APM vendors.
If your focus is on hardening your IT systems against major events.
|
Phase 1: Conduct a business impact analysis |
Phase 2: Establish visibility into core systems |
Phase 3: Solicit and incorporate business needs |
Phase 4: Identify and mitigate risks |
|---|---|---|---|
|
1.1 Conduct a business impact analysis 1.2 Assign criticality ratings to services |
2.1 Define your monitoring strategy 2.2 Implement monitoring tool/aggregator |
3.1 Solicit business needs 3.2 Analyze data and project future needs |
4.1 Identify and mitigate risks |
|
Deliverables |
|||
|
|
|
|
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
|
Conduct a business impact analysis |
Establish visibility into core systems |
Solicit and incorporate business needs |
Identify and | |
|---|---|---|---|---|
|
Best-Practice Toolkit |
1.1 Create a scale to measure different levels of impact 1.2 Assign criticality ratings to services |
2.1 Define your monitoring strategy 2.2 Implement your monitoring tool/aggregator |
3.1 Solicit business needs and gather data 3.2 Analyze data and project future needs |
4.1 Identify and mitigate risks |
|
Guided Implementations |
Call 1: Conduct a business impact analysis | Call 1: Discuss your monitoring strategy |
Call 1: Develop a plan to gather historical data; set up plan to solicit business needs Call 2: Evaluate data sources |
Call 1: Discuss possible risks and strategies for risk mitigation Call 2: Review your capacity management plan |
|
Onsite Workshop |
Module 1: Conduct a business impact analysis |
Module 2: Establish visibility into core systems |
Module 3: Develop a plan to project future needs |
Module 4: Identify and mitigate risks |
|
Phase 1 Results:
|
Phase 2 Results:
|
Phase 3 Results:
|
Phase 4 Results:
|
Contact your account representative or email Workshops@InfoTech.com for more information.
|
Workshop Day 1 |
Workshop Day 2 |
Workshop Day 3 |
Workshop Day 4 | |
|---|---|---|---|---|
|
Conduct a business |
Establish visibility into |
Solicit and incorporate business needs |
Identify and mitigate risks |
|
|
Activities |
1.1 Conduct a business impact analysis 1.2 Create a list of critical dependencies 1.3 Identify critical sub-components 1.4 Develop best practices to negotiate SLAs |
2.1 Determine indicators for sub-components 2.2 Establish visibility into components 2.3 Develop strategies to ameliorate visibility issues |
3.1 Gather relevant business-level data 3.2 Gather relevant service-level data 3.3 Analyze historical trends 3.4 Build a list of business stakeholders 3.5 Directly solicit requirements from the business 3.6 Map business needs to technical requirements 3.7 Identify inefficiencies and compare historical data |
|
|
Deliverables |
|
|
|
|
Business impact analyses are an invaluable part of a broader IT strategy. Conducting a BIA benefits a variety of processes, including disaster recovery, business continuity, and availability and capacity management
|
STEP 1 |
STEP 2 |
STEP 3 |
STEP 4 |
STEP 5 |
|---|---|---|---|---|
|
Record applications and dependencies Utilize your asset management records and document the applications and systems that IT is responsible for managing and recovering during a disaster. |
Define impact scoring scale Ensure an objective analysis of application criticality by establishing a business impact scale that applies to all applications. |
Estimate impact of downtime Leverage the scoring criteria from the previous step and establish an estimated impact of downtime for each application. |
Identify desired RTO and RPO Define what the RTOs/RPOs should be based on the impact of a business interruption and the tolerance for downtime and data loss. |
Determine current RTO/RPO Conduct tabletop planning and create a flowchart of your current capabilities. Compare your current state to the desired state from the previous step. |
Engaging in detailed capacity planning for an insignificant service draws time and resources away from more critical capacity planning exercises. Time spent tracking and planning use of the ancient fax machine in the basement is time you’ll never get back.
A BIA enables you to identify appropriate spend levels, continue to drive executive support, and prioritize disaster recovery planning for a more successful outcome. For example, an Info-Tech survey found that a BIA has a significant impact on setting appropriate recovery time objectives (RTOs) and appropriate spending.
Terms
No BIA: lack of a BIA, or a BIA bases solely on the perceived importance of IT services.
BIA: based on a detailed evaluation or estimated dollar impact of downtime.
In large organizations especially, collating an exhaustive list of applications and services is going to be onerous. For the purposes of this project, a subset should suffice.
Instructions
Input
Output
Materials
Participants
Include a variety of services in your analysis. While it might be tempting to jump ahead and preselect important applications, don’t. The process is inherently valuable, and besides, it might surprise you.
Note: If there are no dependencies for a particular category, leave it blank.
Example
ID is optional. It is a sequential number by default.
In-House, Co-Lo/MSP, and Cloud dependencies; leave blank if not applicable.
Add notes as applicable – e.g. critical support services.
Modify the Business Impact Scales headings and Overall Criticality Rating terminology to suit your organization. For example, if you don’t have business partners, use that column to measure a different goodwill impact or just ignore that column in this tool (i.e. leave it blank). Estimate the different levels of potential impact (where four is the highest impact and zero is no impact) and record these in the Business Impact Scales columns.

In the BIA tab columns for Direct Costs of Downtime, Impact on Goodwill, and Additional Criticality Factors, use the drop-down menu to assign a score of zero to four based on levels of impact defined in the Scoring Criteria tab. For example, if an organization’s ERP is down, and that affects call center sales operations (e.g. ability to access customer records and process orders), the impact might be as described below:
On the other hand, if payroll processing is down, this may not impact revenue, but it certainly impacts internal goodwill and productivity.

Mission critical services. An outage is catastrophic in terms of cost or public image/goodwill. Example: trading software at a financial institution.
Important to daily operations, but not mission critical. Example: email services at any large organization.
Loss of these services is an inconvenience more than anything, though they do serve a purpose and will be missed if they are never brought back online. Example: ancient fax machines.
Info-Tech recommends gold, silver, and bronze because of this typology’s near universal recognition. If you would prefer a particular designation (it might help with internal comprehension), don’t hesitate to use that one instead.
Every organization has its own rules about how to categorize service importance. For some (consumer-facing businesses, perhaps) reputational damage may trump immediate costs.
Instructions
Input
Output
Materials
Participants
See Info-Tech’s Create a Right-Sized Disaster Recovery Plan blueprint for instructions on how to complete your business impact analysis.
|
Large cloud provider |
Local traditional business |
|---|---|
|
|
"Cloud capacity management is not exactly the same as the ITIL version because ITIL has a focus on the component level. I actually don’t do that, because if I did I’d go crazy. There’s too many components in a cloud environment."
– Richie Mendoza, IT Consultant, SMITS Inc.
Service
Component
"You don’t ask the CEO or the guy in charge ‘What kind of response time is your requirement?’ He doesn’t really care. He just wants to make sure that all his customers are happy."
– Todd Evans, Capacity and Performance Management SME, IBM.
Industry: Telecommunications
Source: Interview
Coffee and Wi-Fi – a match made in heaven
In tens of thousands of coffee shops around the world, patrons make ample use of complimentary Wi-Fi. Wi-Fi is an important part of customers’ coffee shop experience, whether they’re online to check their email, do a YouTube, or update their Googles. So when one telco that provided Wi-Fi access for thousands of coffee shops started encountering availability issues, the situation was serious.
Wi-Fi, whack-a-mole, and web woes
The team responsible for resolving the issue took an ad hoc approach to resolving complaints, fixing issues as they came up instead of taking a systematic approach.
Resolution
Looking at the network as a whole, the capacity manager took a proactive approach by using data to identify and rank the worst service areas, and then directing the team responsible to fix those areas in order of the worst first, then the next worst, and so on. Soon the availability of Wi-Fi service was restored across the network.
Instructions
Input
Output
Materials
Participants
Dependency mapping can be difficult. Make sure you don’t waste effort creating detailed dependency maps for relatively unimportant services.
Ride sharing cannot work, at least not at maximum effectiveness, without these constituent components. When one or more of these components are absent or degraded, the service will become unavailable. This example illustrates some challenges of capacity management; some of these components are necessary, but beyond the ride-sharing company’s control.

Email is an example here not because it is necessarily a “gold system,” but because it is common across industries. This is a useful exercise for any service, but it can be quite onerous, so it should be conducted on the most important systems first.
Use the bottom layer of the pyramid drawn in step 1.2a for a list of important sub-components.
Instructions
Input
Output
Materials
Participants

In terms of service provision, capacity management is a form of availability management. Not all availability issues are capacity issues, but the inverse is true.
Capacity issues will always cause availability issues, but availability issues are not inherently capacity issues. Availability problems can stem from outages unrelated to capacity (e.g. power or vendor outages).
When signing contracts with vendors, you will be presented with an SLA. Ensure that it meets your requirements.
Input
Output
Materials
Participants
Vendors are sometimes willing to eat the cost of violating SLAs if they think it will get them a contract. Be careful with negotiation. Just because the vendor says they can do something doesn’t make it true.
See Info-Tech’s Improve IT-Business Alignment Through an Internal SLA blueprint for instructions on why you should develop internal SLAs and the potential benefits they bring.
1.2
Create a list of dependencies for your most important applications
Using the results of the business impact analysis, the analyst will guide workshop participants through a dependency mapping exercise that will eventually populate the Capacity Plan Template.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
|
Guided Implementation 1: Conduct a business impact analysis Proposed Time to Completion: 1 week | |
|---|---|
|
Step 1.1: Create a scale to measure different levels of impact Review your findings with an analyst Discuss how you arrived at the rating of your critical systems and their dependencies. Consider whether your external SLAs are appropriate. Then complete these activities…
With these tools & templates: Business Impact Analysis Tool |
Step 1.2: Assign criticality ratings to services Review your findings with an analyst Discuss how you arrived at the rating of your critical systems and their dependencies. Consider whether your external SLAs are appropriate. Then complete these activities…
With these tools & templates: Capacity Snapshot Tool |
|
Phase 1 Results & Insights:
|
|
Your findings are only as good as your data. Remember: garbage in, garbage out. There are three characteristics of good data:*
*National College of Teaching & Leadership, “Reliability and Validity”
"Data is king. Good data is absolutely essential to [the capacity manager] role."
– Adrian Blant, Independent Capacity Consultant, IT Capability Solutions
Every organization’s data needs are different; your data needs are going to be dictated by your services, delivery model, and business requirements. Make sure you don’t confuse volume with quality, even if others in your organization make that mistake.
Too much monitoring can be as bad as the inverse
In 2013, a security breach at US retailer Target compromised more than 70 million customers’ data. The company received an alert, but it was thought to be a false positive because the monitoring system produced so many false and redundant alerts. As a result of the daily deluge, staff did not respond to the breach in time.
Info-Tech Insight
Don’t confuse monitoring with management. While establishing visibility is a crucial step, it is only part of the battle. Move on to this project’s next phase to explore opportunities to improve your capacity/availability management process.
It is nearly impossible to overstate the importance of data to the process of availability and capacity management. But the wrong data will do you no good.
Instructions
Bottlenecks are bad. Use the Capacity Snapshot Tool (or another tool like it) to ensure that when the capacity manager leaves (on vacation, to another role, for good) the knowledge that they have accumulated does not leave as well.
Tracking every single component in significant detail will produce a lot of noise for each bit of signal. The approach outlined here addresses that concern in two ways:
Despite this effort, however, managing capacity at the component level is a daunting task. Ultimately, tools provided by vendors like SolarWinds and AppDynamics will fill in some of the gaps. Nevertheless, an understanding of the conceptual framework underlying availability and capacity management is valuable.
Industry: Financial Services
Source: AppDynamics
Challenge
Solution
Results
Source: “Just how complex can a Login Transaction be? Answer: Very!,” AppDynamics
"You don’t use a microscope to monitor an entire ant farm, but you might use many microscopes to monitor specific ants."
– Fred Chagnon, Research Director, Infrastructure Practice, Info-Tech Research Group
The next step in capacity management is establishing whether or not visibility (in the broad sense) is available into critical sub-components.
Instructions

Like ideas and watches, not all types of visibility are created equal. Ensure that you have access to the right information to make capacity decisions.
Instructions

For most mobile phone users, this breakdown is sufficient. For some, more granularity might be necessary.
Make note of monitoring tools and strategies. If anything changes, be sure to re-evaluate the visibility status. An outdated spreadsheet can lead to availability issues if management is unaware of looming problems.
The Capacity Snapshot Tool color-codes your components by status. Green – visibility and granularity are both sufficient; yellow – visibility exists, though not at sufficient granularity; and red – visibility does not exist at all.
Instructions
Input
Output
Materials
Participants
It might be that there is no amelioration strategy. Make note of this difficulty and highlight it as part of the risk section of the Capacity Plan Template.
The process of modernizing the network is fraught with vestigial limitations. Develop a program to gather requirements and plan.
As part of the blueprint, Modernize Enterprise Storage, the Modernize Enterprise Storage Workbook includes a section on storage capacity planning.

2.2

Develop strategies to ameliorate visibility issues
The analyst will guide workshop participants in brainstorming potential solutions to visibility issues and record them in the Capacity Snapshot Tool.
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
|
Guided Implementation 2: Establish visibility into core systems Proposed Time to Completion: 3 weeks | |
|---|---|
|
Step 2.1: Define your monitoring strategy Review your findings with an analyst Discuss your monitoring strategy and ensure you have sufficient visibility for the needs of your organization. Then complete these activities…
With these tools & templates:
|
Step 2.2: Implement your monitoring tool/aggregator Review your findings with an analyst Discuss your monitoring strategy and ensure you have sufficient visibility for the needs of your organization. Then complete these activities…
With these tools & templates:
|
|
Phase 2 Results & Insights:
|
|
The availability and capacity management summary card pictured here is a handy way to capture the results of the activities undertaken in the following phases. Note its contents carefully, and be sure to record specific outputs where appropriate. One such card should be completed for each of the gold services identified in the project’s first phase. Make note of the results of the activities in the coming phase, and populate the Capacity Snapshot Tool. These will help you populate the tool.

The Capacity Plan Template is designed to be a part of a broader mapping strategy. It is not a replacement for a dedicated monitoring tool.
"In all cases the very first thing to do is to look at trending…The old adage is ‘you don’t steer a boat by its wake,’ however it’s also true that if something is growing at, say, three percent a month and it has been growing at three percent a month for the last twelve months, there’s a fairly good possibility that it’s going to carry on going in that direction."
– Mike Lynch, Consultant, CapacityIQ
A holistic approach to capacity management involves peering beyond the beaded curtain partitioning IT from the rest of the organization and tracking business metrics.
Instructions
Input
Output
Materials
Participants
One level of abstraction down is the service level. Service level capacity management, recall that service level capacity management is about ensuring that IT is meeting SLAs in its service provision.
Instructions
Input
Output
Materials
Participants
|
Jan |
Feb |
Mar |
Apr |
May |
June |
July |
|---|---|---|---|---|---|---|
|
74 |
80 |
79 |
83 |
84 |
100 |
102 |
Note: the strength of this approach is that it is easy to visualize. Use the same timescale to facilitate simple comparison.
"Often what is really being offered by many analytics solutions is just more data or information – not insights."
– Brent Dykes, Director of Data Strategy, Domo
You can have all the data in the world and absolutely nothing valuable to add. Don’t fall for this trap. Use the activities in this phase to structure your data collection operation and ensure that your organization’s availability and capacity management plan is data driven.
At-a-glance – it’s how most executives consume all but the most important information. Create a dashboard that tracks the status of your most important systems.
Instructions
This tool collates and presents information gathered from other sources. It is not a substitute for a performance monitoring tool.
Stakeholder analysis is crucial. Lines of authority can be diffuse. Understand who needs to be involved in the capacity management process early on.
Instructions
Input
Output
Materials
Participants
Consider which departments are most closely aligned with the business processes that fuel demand. Prioritize those that have the greatest impact. Consider the stakeholders who will make purchasing decisions for increasing infrastructure capacity.
Establishing a relationship with your stakeholders is a necessary step in managing your capacity and availability.
Instructions
Input
Output
Materials
Participants
The best capacity managers develop new business processes that more closely align their role with business stakeholders. Building these relationships takes hard work, and you must first earn the trust of the business.
Convince, don’t coerce. Stakeholders want the same thing you do. Bake them into the planning process as a step towards this goal.
Input
Output
Materials
Participants
Industry: Financial Services
Source: Interview
In financial services, availability is king
In the world of financial services, availability is absolutely crucial. High-value trades occur at all hours, and any institution that suffers outages runs the risk of losing tens of thousands of dollars, not to mention reputational damage.
People know what they want, but sometimes they have to be herded
While line of business managers and application owners understand the value of capacity management, it can be difficult to establish the working relationship necessary for a fruitful partnership.
Proactively building relationships keeps services available
He built relationships with all the department heads on the business side, and all the application owners.
He established a steering committee for capacity.
He invited stakeholders to regular capacity planning meetings.
He scheduled lunch and learn sessions with business analysts and project managers.
Sometimes “need to know” doesn’t register with sales or marketing. Nearly every infrastructure manager can share a story about a time when someone has made a decision that has critically impacted IT infrastructure without letting anyone in IT in on the “secret.”
In brief
Imagine working for a media company as an infrastructure capacity manager. Now imagine that the powers that be have decided to launch a content-focused web service. Seems like something they would do, right? Now imagine you find out about it the same way the company’s subscribers do. This actually happened – and it shouldn’t have. But a similar lack of alignment makes this a real possibility for any organization. If you don’t establish a systematic plan for soliciting and incorporating business requirements, prepare to lose a chunk of your free time. The business should never be able to say, in response to “nobody tells me anything,” “nobody asked.”
Pictured: an artist’s rendering of the capacity manager in question.
Once you’ve established, firmly, that everyone’s on the same team, meet individually with the stakeholders to assess capacity.
Instructions
Input
Output
Materials
Participants
Sometimes line of business managers will evade or ignore you when you come knocking. They do this because they don’t know and they don’t want to give you the wrong information. Explain that a best guess is all you can ask for and allay their fears.
IT staff and line of business staff come with different skillsets. This can lead to confusion, but it doesn’t have to. Develop effective information solicitation techniques.
Instructions
Input
Output
Materials
Participants
When it comes to mapping technical requirements, IT alone has the ability to effectively translate business needs.
Instructions
Input
Output
Materials
Participants
Adapt the analysis to the needs of your organization. One capacity manager called the one-to-one mapping of business process to infrastructure demand the Holy Grail of capacity management. If this level of precision isn’t attainable, develop your own working estimates using the higher-level data
|
Capacity management The role of the capacity manager is changing, but it still has a purpose. Consider this:
|
Availability management Ensuring services are available is still IT’s wheelhouse, even if that means a shift to a brokerage model:
|
The cloud comes at the cost of detailed performance data. Sourcing a service through an SLA with a third party increases the need to perform your own performance testing of gold level applications. See performance monitoring.
"It is a commonplace observation that work expands so as to fill the time available for its completion. Thus, an elderly lady of leisure can spend the entire day in writing and despatching a postcard to her niece at Bognor Regis. An hour will be spent in finding the postcard, another in hunting for spectacles, half-an-hour in a search for the address, an hour and a quarter in composition, and twenty minutes in deciding whether or not to take an umbrella when going to the pillar-box in the next street."
C. Northcote Parkinson, The Economist, 1955
If you give people lots of capacity, they will use it. Most shops are overprovisioned, and in some cases that’s throwing perfectly good money away. Don’t be afraid to prod if someone requests something that doesn’t seem right.
Questions to ask:
In brief
Who isn’t a sports fan? Big games mean big stakes for pool participants and armchair quarterbacks—along with pressure on the network as fans stream games from their work computers. One organization suffered from this problem, and, instead of taking a hardline and banning all streams, opted to stream the game on a large screen in a conference room where those interested could work for its duration. This alleviated strain on the network and kept staff happy.
Industry:Professional Services
Source:Interview
24/7 AWS = round-the-clock costs
A senior developer realized that his development team had been leaving AWS instances running without any specific reason.
Why?
The development team appreciated the convenience of an always-on instance and, because the people spinning them up did not handle costs, the problem wasn’t immediately apparent.
Resolution
In his spare time over the course of a month, the senior developer wrote a program to manage the servers, including shutting them down during times when they were not in use and providing remote-access start-up when required. His team alone saved $30,000 in costs over the next six months, and his team lead reported that it would have been more than worth paying the team to implement such a project on company time.
Instructions
Input
Output
Materials
Participants
The most effective capacity management takes a holistic approach and looks at the big picture in order to find ways to eliminate unnecessary infrastructure usage, or to find alternate or more efficient sources of required capacity.
Industry:Telecommunications
Source: Interview
High-cost lines
The capacity manager at a telecommunications provider mapped out his firm’s network traffic and discovered they were using a number of VP circuits (inter building cross connects) that were very expensive on the scale of their network.
Paying the toll troll
These VP circuits were supplying needed network services to the telecom provider’s clients, so there was no way to reduce this demand.
Resolution
The capacity manager analyzed where the traffic was going and compared this to the cost of the lines they were using. After performing the analysis, he found he could re-route much of the traffic away from the VP circuits and save on costs while delivering the same level of service to their users.
Make informed decisions about capacity. Remember: retain all documentation. It might come in handy for the justification of purchases.
Instructions
Capacity management (and, by extension, availability management) is a combination of two balancing acts: cost against capacity and supply and demand.*
Instructions
In brief
The fractured nature of the capacity management space means that every organization is going to have a slightly different tooling strategy. No vendor has dominated, and every solution requires some level of customization. One capacity manager (a cloud provider, no less!) relayed a tale about a capacity management Excel sheet programmed with 5,000+ lines of code. As much work as that is, a bespoke solution is probably unavoidable.

3.2

Map business needs to technical requirements and technical requirements to infrastructure requirements
The analyst will guide workshop participants in using their organization’s data to map out the relationships between applications, technical requirements, and the underlying infrastructure usage.
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
|
Guided Implementation 3: Solicit and incorporate business needs Proposed Time to Completion: 2 weeks | |
|---|---|
|
Step 3.1: Solicit business needs and gather data Review your findings with an analyst Discuss the effectiveness of your strategies to involve business stakeholders in the planning process and your methods of data collection and analysis. Then complete these activities…
With these tools & templates: Capacity Plan Template |
Step 3.2: Analyze data and project future needs Review your findings with an analyst Discuss the effectiveness of your strategies to involve business stakeholders in the planning process and your methods of data collection and analysis. Then complete these activities…
With these tools & templates: Capacity Snapshot Tool Capacity Plan Template |
|
Phase 3 Results & Insights:
|
|
Availability: how often a service is usable (that is to say up and not too degraded to be effective). Consequences of reduced availability can include financial losses, impacted customer goodwill, and reduced faith in IT more generally.
Causes of availability issues:
Capacity: a particular component’s/service’s/business’ wiggle room. In other words, its usage ceiling.
Causes of capacity issues:
Availability and capacity issues can stem from a number of different causes. Include a list in your availability and capacity management plan.
Instructions
Input
Output
Materials
Participants
Availability and capacity problems result in incidents, critical incidents, and problems. These are addressed in a separate project (incident and problem management), but information about common causes can streamline that process.
Based on your understanding of your capacity needs (through written SLAs and informal but regular meetings with the business) highlight major risks you foresee.
Instructions
Input
Output
Materials
Participants
It’s an old adage, but it checks out: don’t come to the table armed only with problems. Be a problem solver and prove IT’s value to the organization.
Instructions (cont.)
Input
Output
Materials
Participants
It’s an old adage, but it checks out: don’t come to the table armed only with problems. Be a problem solver and prove IT’s value to the organization.
While capacity management is a form of availability management, it is not the only form. In this activity, outline the specific nature of threats to availability.
Instructions

Input
Output
Materials
Participants
A dynamic central repository is a good way to ensure that availability issues stemming from a variety of causes are captured and mitigated.
Although it is easier said than done, identifying potential mitigations is a crucial part of availability management as an activity.
Instructions (cont.)
Input
Output
Materials
Participants
The stakeholders consulted as part of the process will be interested in its results. Share them, either in person or through a collaboration tool.
The current status of your availability and capacity management plan should be on the agenda for every stakeholder meeting. Direct the stakeholders’ attention to the parts of the document that are relevant to them, and solicit their thoughts on the document’s accuracy. Over time you should get a pretty good idea of who among your stakeholder group is skilled at projecting demand, and who over- or underestimates, and by how much. This information will improve your projections and, therefore, your management over time.
Use the experience gained and the artifacts generated to build trust with the business. The meetings should be regular, and demonstrating that you’re actually using the information for good is likely to make hesitant participants in the process more likely to open up.

4.1

Identify capacity risks and mitigate them
The analyst will guide workshop participants in identifying potential risks to capacity and determining strategies for mitigating them.
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
|
Guided Implementation 4: Identify and mitigate risks Proposed Time to Completion: 1 week |
|---|
|
Step 4.1: Identify and mitigate risks Review your findings with an analyst
Then complete these activities…
With these tools & templates: Capacity Snapshot Tool Capacity Plan Template |
|
Phase 4 Results & Insights:
|
Components are critical to availability and capacity management.
The CEO doesn’t care about the SMTP server. She cares about meeting customer needs and producing profit. For IT capacity and availability managers, though, the devil is in the details. It only takes one faulty component to knock out a service. Keep track and keep the lights on.
Ask what the business is working on, not what they need.
If you ask them what they need, they’ll tell you – and it won’t be cheap. Find out what they’re going to do, and use your expertise to service those needs. Use your IT experience to estimate the impact of business and service level changes on the components that secure the availability you need.
Cloud shmoud.
The role of the capacity manager might be changing with the advent of the public cloud, but it has not disappeared. Capacity managers in the age of the cloud are responsible for managing vendor relationships, negotiating external SLAs, projecting costs and securing budgets, reining in prodigal divisions, and so on.
Client Project: Develop an Availability and Capacity Management Plan
This project has the ability to fit the following formats:
Adrian Blant, Independent Capacity Consultant, IT Capability Solutions
Adrian has over 15 years' experience in IT infrastructure. He has built capacity management business processes from the ground up, and focused on ensuring a productive dialogue between IT and the business.
James Zhang, Senior Manager Disaster Recovery, AIG Technology
James has over 20 years' experience in IT and 10 years' experience in capacity management. Throughout his career, he has focused on creating new business processes to deliver value and increase efficiency over the long term.
Mayank Banerjee, CTO, Global Supply Chain Management, HelloFresh
Mayank has over 15 years' experience across a wide range of technologies and industries. He has implemented highly automated capacity management processes as part of his role of owning and solving end-to-end business problems.
Mike Lynch, Consultant, CapacityIQ
Mike has over 20 years' experience in IT infrastructure. He takes a holistic approach to capacity management to identify and solve key problems, and has developed automated processes for mapping performance data to information that can inform business decisions.
Paul Waguespack, Manager of Application Systems Engineering, Tufts Health Plan
Paul has over 10 years' experience in IT. He has specialized in implementing new applications and functionalities throughout their entire lifecycle, and integrating with all aspects of IT operations.
Richie Mendoza, IT Consultant, SMITS Inc.
Richie has over 10 years' experience in IT infrastructure. He has specialized in using demand forecasting to guide infrastructure capacity purchasing decisions, to provide availability while avoiding costly overprovisioning.
Rob Thompson, President, IT Tools & Process
Rob has over 30 years’ IT experience. Throughout his career he has focused on making IT a generator of business value. He now runs a boutique consulting firm.
Todd Evans, Capacity and Performance Management SME, IBM
Todd has over 20 years' experience in capacity and performance management. At Kaiser Permanente, he established a well-defined mapping of the businesses workflow processes to technical requirements for applications and infrastructure.
451 Research. “Best of both worlds: Can enterprises achieve both scalability and control when it comes to cloud?” 451 Research, November 2016. Web.
Allen, Katie. “Work Also Shrinks to Fit the Time Available: And We Can Prove It.” The Guardian. 25 Oct. 2017.
Amazon. “Amazon Elastic Compute Cloud.” Amazon Web Services. N.d. Web.
Armandpour, Tim. “Lies Vendors Tell about Service Level Agreements and How to Negotiate for Something Better.” Network World. 12 Jan 2016.
“Availability Management.” ITIL and ITSM World. 2001. Web.
Availability Management Plan Template. Purple Griffon. 30 Nov. 2012. Web.
Bairi, Jayachandra, B., Murali Manohar, and Goutam Kumar Kundu. “Capacity and Availability Management by Quantitative Project Management in the IT Service Industry.” Asian Journal on Quality 13.2 (2012): 163-76. Web.
BMC Capacity Optimization. BMC. 24 Oct 2017. Web.
Brooks, Peter, and Christa Landsberg. Capacity Management in Today’s IT Environment. MentPro. 16 Aug 2017. Web.
"Capacity and Availability Management." CMMI Institute. April 2017. Web.
Capacity and Availability Management. IT Quality Group Switzerland. 24 Oct. 2017. Web.
Capacity and Performance Management: Best Practices White Paper. Cisco. 4 Oct. 2005. Web.
"Capacity Management." Techopedia.
“Capacity Management Forecasting Best Practices and Recommendations.” STG. 26 Jan 2015. Web.
Capacity Management from the Ground up. Metron. 24 Oct. 2017. Web.
Capacity Management in the Modern Datacenter. Turbonomic. 25 Oct. 2017. Web.
Capacity Management Maturity Assessing and Improving the Effectiveness. Metron. 24 Oct. 2017. Web.
“Capacity Management Software.” TeamQuest. 24 Oct 2017. Web,
Capacity Plan Template. Purainfo. 11 Oct 2012. Web.
“Capacity Planner—Job Description.” Automotive Industrial Partnership. 24 Oct. 2017. Web.
Capacity Planning. CDC. Web. Aug. 2017.
"Capacity Planning." TechTarget. 24 Oct 2017. Web.
“Capacity Planning and Management.” BMC. 24 Oct 2017. Web.
"Checklist Capacity Plan." IT Process Wiki. 24 Oct. 2017. Web.
Dykes, Brent. “Actionable Insights: The Missing Link Between Data and Business Value.” Forbes. April 26, 2016. Web.
Evolved Capacity Management. CA Technologies. Oct. 2013. Web.
Francis, Ryan. “False positives still cause threat alert fatigue.” CSO. May 3, 2017. Web.
Frymire, Scott. "Capacity Planning vs. Capacity Analytics." ScienceLogic. 24 Oct. 2017. Web.
Glossary. Exin. Aug. 2017. Web.
Herrera, Michael. “Four Types of Risk Mitigation and BCM Governance, Risk and Compliance.” MHA Consulting. May 17, 2013.
Hill, Jon. How to Do Capacity Planning. TeamQuest. 24 Oct. 2017. Web.
“How to Create an SLA in 7 Easy Steps.” ITSM Perfection. 25 Oct. 2017. Web.
Hunter, John. “Myth: If You Can’t Measure It: You Can’t Manage It.” W. Edwards Deming Institute Blog. 13 Aug 2015. Web.
IT Service Criticality. U of Bristol. 24 Oct. 2017. Web.
"ITIL Capacity Management." BMC's Complete Guide to ITIL. BMC Software. 22 Dec. 2016. Web.
“Just-in-time.” The Economist. 6 Jul 2009. Web.
Kalm, Denise P., and Marv Waschke. Capacity Management: A CA Service Management Process Map. CA. 24 Oct. 2017. Web.
Klimek, Peter, Rudolf Hanel, and Stefan Thurner. “Parkinson’s Law Quantified: Three Investigations in Bureaucratic Inefficiency.” Journal of Statistical Mechanics: Theory and Experiment 3 (2009): 1-13. Aug. 2017. Web.
Landgrave, Tim. "Plan for Effective Capacity and Availability Management in New Systems." TechRepublic. 10 Oct. 2002. Web.
Longoria, Gina. “Hewlett Packard Enterprise Goes After Amazon Public Cloud in Enterprise Storage.” Forbes. 2 Dec. 2016. Web.
Maheshwari, Umesh. “Understanding Storage Capacity.” NimbleStorage. 7 Jan. 2016. Web.
Mappic, Sandy. “Just how complex can a Login Transaction be? Answer: Very!” Appdynamics. Dec. 11 2011. Web.
Miller, Ron. “AWS Fires Back at Larry Ellison’s Claims, Saying It’s Just Larry Being Larry.” Tech Crunch. 2 Oct. 2017. Web.
National College for Teaching & Leadership. “The role of data in measuring school performance.” National College for Teaching & Leadership. N.d. Web,
Newland, Chris, et al. Enterprise Capacity Management. CETI, Ohio State U. 24 Oct. 2017. Web.
Office of Government Commerce . Best Practice for Service Delivery. London: Her Majesty’s Stationery Office, 2001.
Office of Government Commerce. Best Practice for Business Perspective: The IS View on Delivering Services to the Business. London: Her Majesty’s Stationery Office, 2004.
Parkinson, C. Northcote. “Parkinson’s Law.” The Economist. 19 Nov. 1955. Web.
“Parkinson’s Law Is Proven Again.” Financial Times. 25 Oct. 2017. Web.
Paul, John, and Chris Hayes. Performance Monitoring and Capacity Planning. VM Ware. 2006. Web.
“Reliability and Validity.” UC Davis. N.d. Web.
"Role: Capacity Manager." IBM. 2008. Web.
Ryan, Liz. “‘If You Can’t Measure It, You Can’t Manage It’: Not True.” Forbes. 10 Feb. 2014. Web.
S, Lalit. “Using Flexible Capacity to Lower and Manage On-Premises TCO.” HPE. 23 Nov. 2016. Web.
Snedeker, Ben. “The Pros and Cons of Public and Private Clouds for Small Business.” Infusionsoft. September 6, 2017. Web.
Statement of Work: IBM Enterprise Availability Management Service. IBM. Jan 2016. Web.
“The Road to Perfect AWS Reserved Instance Planning & Management in a Nutshell.” Botmetric. 25 Oct. 2017. Web.
Transforming the Information Infrastructure: Build, Manage, Optimize. Asigra. Aug. 2017. Web.
Valentic, Branimir. "Three Faces of Capacity Management." ITIL/ISO 20000 Knowledge Base. Advisera. 24 Oct. 2017. Web.
"Unify IT Performance Monitoring and Optimization." IDERA. 24 Oct. 2017. Web.
"What is IT Capacity Management?" Villanova U. Aug. 2017. Web.
Wolstenholme, Andrew. Final internal Audit Report: IT Availability and Capacity (IA 13 519/F). Transport For London. 23 Feb. 2015. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Set the right stakeholder expectations for your delivery estimates and plans.
Adopt the analysis, estimation, commitment, and communication tactics to successfully develop your delivery plan.
Build your estimation optimization roadmap.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discuss the decisions that estimates will help make.
Level set estimation expectations by clarifying what they can and cannot do.
Review the current state of your estimation practice.
Grounded understanding of estimation that is accepted by all audiences and stakeholders.
Identification of whether estimation practices are the root cause of estimation challenges or a symptom of a different issue.
1.1 Define estimation expectations.
1.2 Reveal your root cause challenges.
Estimation expectations
Root causes of estimation challenges
Discuss the estimation and planning practices used in the industry.
Define the appropriate tactics to use to make key business and delivery decisions.
Simulate the tactics to verify and validate their fit with your teams.
Knowledge of good practices that can improve the effectiveness of your estimates and plans.
Practice using new tactics.
2.1 Ground estimation fundamentals.
2.2 Strengthen your analysis tactics.
2.3 Strengthen your estimation tactics.
2.4 Commit and communicate delivery.
2.5 Simulate your target state planning and estimation tactics.
Estimation glossary and guiding principles
Defined analysis tactics
Defined estimation and consensus-building tactics
Defined commitment and communication tactics
Lessons learned
Review the scope and achievability of your improved estimation and planning practice.
Realistic and achievable estimation optimization roadmap.
3.1 Mature your estimation practice.
Estimation optimization roadmap
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Brainstorm opportunities to secure the DevOps pipeline using the CLAIM Framework.
Assess opportunities and formulate a strategy based on a cost/benefit analysis.
Even in a highly tool-centric view, it is the appreciation of DevOps core principles that will determine your success in implementing its practices.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the current state of your software delivery process and categorize existing challenges in it.
Brainstorm solutions using Info-Tech Research Group’s MATURE framework.
Identify metrics that are insightful and valuable. Determine tools that can help with DevOps practices implementation.
Lay out a schedule for enhancements for your software process to make it ready for DevOps.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Set the context for improvement.
Provide a great foundation for an actionable vision and goals that people can align to.
1.1 Review the outcome of the DevOps Readiness Survey.
1.2 Articulate the current-state delivery process.
1.3 Categorize existing challenges using PEAS.
Baseline assessment of the organization’s readiness for introducing DevOps principles in its delivery process
A categorized list of challenges currently evident in the delivery process
Brainstorm solutions using the MATURE framework.
Collaborative list of solutions to challenges that are restricting/may restrict adoption of DevOps in your organization.
2.1 Brainstorm solutions for identified challenges.
2.2 Understand different DevOps topologies within the context of strong communication and collaboration.
A list of solutions that will enhance the current delivery process into one which is influenced by DevOps principles
(Optional) Identify a team topology that works for your organization.
Select metrics and tools for your DevOps-inspired delivery pipeline.
Enable your team to select the right metrics and tool chain that support the implementation of DevOps practices.
3.1 Identify metrics that are sensible and provide meaningful insights into your organization’s DevOps transition.
3.2 Determine the set of tools that satisfy enterprise standards and can be used to implement DevOps practices.
3.3 (Optional) Assess DevOps pipeline maturity.
A list of metrics that will assist in measuring the progress of your organization’s DevOps transition
A list of tools that meet enterprise standards and enhance delivery processes
Build a plan laying out the work needed to be done for implementing the necessary changes to your organization.
Roadmap of steps to take in the coming future.
4.1 Create a roadmap for future-state delivery process.
Roadmap for future-state delivery process
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify the business drivers that necessitate data architecture improvements, then create a tactical plan for optimization.
Analyze how you stack up to Info-Tech’s data architecture capability model to uncover your tactical plan, and discover groundbreaking data architecture trends and how you can fit them into your action plan.
Optimize your data architecture by following tactical initiatives and managing the resulting change brought on by those optimization activities.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Explain approach and value proposition.
Review the common business drivers and how the organization is driving a need to optimize data architecture.
Understand Info-Tech’s five-tier data architecture model.
Determine the pattern of tactics that apply to the organization for optimization.
Understanding of the current data architecture landscape.
Priorities for tactical initiatives in the data architecture practice are identified.
Target state for the data quality practice is defined.
1.1 Explain approach and value proposition.
1.2 Review the common business drivers and how the organization is driving a need to optimize data architecture.
1.3 Understand Info-Tech’s five-tier data architecture model.
1.4 Determine the pattern of tactics that apply to the organization for optimization.
Five-tier logical data architecture model
Data architecture tactic plan
Define improvement initiatives.
Define a data architecture improvement strategy and roadmap.
Gaps, inefficiencies, and opportunities in the data architecture practice are identified.
2.1 Create business unit prioritization roadmap.
2.2 Develop subject area project scope.
2.3 Subject area 1: data lineage analysis, root cause analysis, impact assessment, business analysis
Business unit prioritization roadmap
Subject area scope
Data lineage diagram
Define improvement initiatives.
Define a data quality improvement strategy and roadmap.
Improvement initiatives are defined.
Improvement initiatives are evaluated and prioritized to develop an improvement strategy.
A roadmap is defined to depict when and how to tackle the improvement initiatives.
3.1 Create business unit prioritization roadmap.
3.2 Develop subject area project scope.
3.3 Subject area 1: data lineage analysis, root cause analysis, impact assessment, business analysis.
Business unit prioritization roadmap
Subject area scope
Data lineage diagram
“As business and data landscapes change, an organization’s data architecture needs to be able to keep pace with these changes. It needs to be responsive so as to not only ensure the organization continues to operate efficiently but that it supports the overall strategic direction of the organization.
In the dynamic marketplace of today, organizations are constantly juggling disruptive forces and are finding the need to be more proactive rather than reactive. As such, organizations are finding their data to be a source of competitive advantage where the data architecture has to be able to not only support the increasing amount, sources, and rate at which organizations are capturing and collecting data but also be able to meet and deliver on changing business needs.
Data architecture optimization should, therefore, aid in breaking down data silos and creating a more shared and all-encompassing data environment for better empowering the business.” (Crystal Singh, Director, Research, Data and Information Practice, Info-Tech Research Group)
This Research Is Designed For:
|
This Research Will Help You:
|
This Research Will Also Assist:
|
This Research Will Help Them:
|
The transformational insights that executives are constantly seeking to leverage can be uncovered with a data practice that makes high quality, trustworthy information readily available to the business users who need it.
50% Organizations that embrace data are 50% more likely to launch products and services ahead of their competitors. (Nesta, 2016)
Whether hoping to gain a better understanding of your business or trying to become an innovator in your industry, any organization can get value from its data regardless of where you are in your journey to becoming a data-driven enterprise:
Business Monitoring
|
Business Insights
|
Business Optimization
|
Business Transformation
|
A zettabyte is a billion terabytes. Organizations today need to measure their data size in zettabytes, a challenge that is only compounded by the speed at which the data is expected to move.
Arriving at the understanding that data can be the driving force of your organization is just the first step. The reality is that the true hurdles to overcome are in facing the challenges of today’s data landscape.
| Challenges of The Modern Data Landscape | ||||
| Data at rest | Data movement | |||
| Greater amounts | Different types | Uncertain quality | Faster rates | Higher complexity |
“The data environment is very chaotic nowadays. Legacy applications, data sprawl – organizations are grappling with what their data landscape looks like. Where are our data assets that we need to use?” (Andrew Johnston, Independent Consultant)
Well-defined and structured data management practices are the best way to mitigate the limitations that derive from these challenges and leverage the most possible value from your data.
Refer to Info-Tech’s capstone Create a Plan For Establishing a Business-Aligned Data Management Practice blueprint to understand data quality in the context of data disciplines and methods for improving your data management capabilities.
Data ArchitectureThe set of rules, policies, standards, and models that govern and define the type of data collected and how it is used, stored, managed, and integrated within the organization and its database systems. In general, the primary objective of data architecture is the standardization of data for the benefit of the organization. 54% of leading “analytics-driven” enterprises site data architecture as a required skill for data analytics initiatives. (Maynard 2015) |
MYTHData architecture is purely a model of the technical requirements of your data systems. REALITYData architecture is largely dependent on a human element. It can be viewed as “the bridge between defining strategy and its implementation”. (Erwin 2016) |
FunctionsA strong data architecture should:
|
Business valueA strong data architecture will help you:
|
The data architect:
|
Data architects bridge the gap between strategic and technical requirements:
“Fundamentally, the role of a data architect is to understand the data in an organization at a reasonable level of abstraction.” (Andrew Johnston, Independent Consultant) |
Outdated and archaic systems and processes limit the ability to access data in a timely and efficient manner, ultimately diminishing the value your data should bring.
59% |
of firms believe their legacy storage systems require too much processing to meet today’s business needs. (Attivio, Survey Big Data decision Makers, 2016) | 48% |
of companies experience pains from being reliant on “manual methods and trial and error when preparing data.” (Attivio, Survey Big Data decision Makers, 2016) | 44% |
44% of firms said preparing data was their top hurdle for analytics, with 22% citing problems in accessing data. (Data Virtualization blog, Data Movement Killed the BI Star, 2016) |
Intuitive organizations who have recognized these shortcomings have already begun the transition to modernized and optimized systems and processes.
28% |
of survey respondents say they plan to replace “data management and architecture because it cannot handle the requirements of big data.” (Informatica, Digital Transformation: Is Your Data Management Ready, 2016) | 50% |
Of enterprises plan to replace their data warehouse systems and analytical tools in the next few years. (TDWI, End of the Data Warehouse as we know it, 2017) |
Leading organizations are attacking data architecture problems … you will be left behind if you do not start now!
Focusing on only data models without the required data architecture guidance can cause harmful symptoms in your IT department, which will lead to organization-wide problems.
| IT Symptoms Due to Ineffective Data Architecture | ||
Poor Data Quality
|
Poor Accessibility
|
Strategic Disconnect
|
| Leads to Poor Organizational Conditions | ||
Inaccurate Insights
|
Ineffective Decision Making
|
Inefficient Operations
|
| You need a solution that will prevent the pains. | ||
1 |
|
![]() |
2 |
|
|
3 |
|
![]() |
Info-Tech has identified these four common drivers that lead to the need to optimize your data architecture.
These different core objectives underline the motivation to optimize data architecture, and will determine your overall approach.
Every organization’s data system requires a unique design and an assortment of applications and storage units to fit their business needs. Therefore, it is difficult to paint a picture of an ideal model that has universal applications. However, when data architecture is broken down in terms of layers or tiers, there exists a general structure that is seen in all data systems.

Thinking of your data systems and processes in this framework will allow you to see how different elements of the architecture relate to specific business operations.
|
|
Info-Tech’s Data Architecture Capability Model
![]() |
|
|
Info-Tech Insight
Optimizing data architecture requires a tactical approach, not a passive approach. The demanding task of optimization requires the ability to heavily prioritize. After you have identified why, determine how using our pre-built roadmap to address the four common drivers. |
| Data Architecture in Alignment
Data architecture can not be designed to simply address the focus of data specialists or even the IT department. It must act as a key component in the all encompassing enterprise architecture and reflect the strategy and design of the entire business. Data architecture collaborates with application architecture in the delivery of effective information systems, and informs technology architecture on data related infrastructure requirements/considerations Please refer to the following blueprints to see the full picture of enterprise architecture: |
Adapted from TOGAF Refer to Phase C of TOGAF and Bizbok for references to the components of business architecture that are used in data architecture. |
CASE STUDY |
Industry: Financial
|
![]() |
Look for this symbol as you walk through the blueprint for details on how Info-Tech Consulting assisted this monetary authority. |
The monetary authority is responsible for oversight of the financial situation of a country that takes in revenue from foreign incorporation. Due to increased pressure from international regulatory bodies, the monetary authority became responsible for generating multiple different types of beneficial ownership reports based on corporation ownership data within 24 hours of a request.
Normally, the process to generate and provide beneficial ownership reports took a week or more. This was due to multiple points of stale data architecture, including a dependence on outdated legacy systems and a broken process for gathering the required data from a mix of paper and electronic sources.
Info-Tech helped the monetary authority identify the business need that resulted from regulatory pressures, the challenges that needed to be overcome, and actionable tactics for addressing the needs.
Info-Tech’s methodology was followed to optimize the areas of data architecture that address the business driver.
As you walk through this blueprint, watch for additional case studies that walk through the details of how Info-Tech helped this monetary authority.
Phase 1
Prioritize Your Data Architecture With Business-Driven Tactics |
Phase 2
Personalize Your Tactics to Optimize Your Data Architecture |
Phase 3
Create Your Tactical Data Architecture Roadmap |
Step 1: Identify Your Business Driver for Optimizing Data Architecture
Data Architecture Driver Pattern Identification Tool
Data Architecture Optimization Template |
Step 1: Measure Your Data Architecture Capabilities
Data Architecture Tactical Roadmap Tool
Data Architecture Tactical Roadmap Tool
Data Architecture Trends Presentation |
Step 1: Personalize Your Data Architecture Roadmap
Data Architecture Tactical Roadmap Tool
Data Architecture Decision Template |
Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.
This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.
This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
| PHASE 1 Prioritize Your Data Architecture With Business-Driven Tactics |
PHASE 2 Personalize Your Tactics to Optimize Your Data Architecture |
PHASE 3 Create Your Tactical Data Architecture Roadmap |
|
![]() Best-Practice Toolkit |
1.1 Identify Your Business Driver for Optimizing Data Architecture 1.2 Determine Actionable Tactics to Optimize Data Architecture |
2.1 Measure Your Data Architecture Capabilities 2.2 Set a Target for Data Architecture Capabilities 2.3 Identify the Tactics that Apply to Your Organization |
3.1 Personalize Your Data Architecture Roadmap 3.2 Manage Your Data Architecture Decisions and the Resulting Changes |
Guided Implementations |
|
|
|
![]() Onsite Workshop |
Module 1:
Identify the Drivers of the Business for Optimizing Data Architecture |
Module 2:
Create a Tactical Plan for Optimizing Data Architecture |
Module 3:
Create a Personalized Roadmap for Data Architecture Activities |
Preparation |
Workshop Day 1 |
Workshop Day 2 |
Workshop Day 3 |
Workshop Day 4 |
Workshop Day 5 |
|
| Organize and Plan Workshop | Identify the Drivers of the Business for Optimizing Data Architecture | Determine the Tactics For Optimizing Data Architecture | Create Your Roadmap of Optimization Activities | Create Your Personalized Roadmap | Create a Plan for Change Management | |
Morning Activities |
|
|
|
|
|
|
Afternoon Activities |
|
|
|
|
|
|
Deliverables |
|
|
|
|
|
|
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 1.1: Identify Your Business Driver for Optimizing Data Architecture | Step 1.2: Determine Actionable Tactics to Optimize Data Architecture |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
Phase 1 Results & Insights
|
|
In this phase, you will determine your focus for optimizing your data architecture based on the business drivers that are commonly felt by most organizations.
“To stay competitive, we need to become more data-driven. Compliance pressures are becoming more demanding. We need to add a new functionality.”
Info-Tech’s Five-Tier Data Architecture:
Tactical plan for Data Architecture Optimization
PHASE 1 |
|
| 1.1 | 1.2 |
| Identify Your Business Driver for Optimizing Data Architecture | Determine Actionable Tactics to Optimize Data Architecture |
A description of the structure and interaction of the enterprise’s major types and sources of data, logical data assets, physical data assets, and data management resources (TOGAF 9).
The subject area of data management that defines the data needs of the enterprise and designs the master blueprints to meet those needs (DAMA DMBOK, 2009).
IBM (2007) defines data architecture as the design of systems and applications that facilitate data availability and distribution across the enterprise.
Definitions vary slightly across major architecture and management frameworks.
However, there is a general consensus that data architecture provides organizations with:
Data architecture must be based on business goals and objectives; developed within the technical strategies, constraints, and opportunities of the organization in support of providing a foundation for data management.
| Current Data Management |
|
Goal for Data Management |
Data Architecture is not just data models. Data architects must understand the needs of the business, as well as the existing people and processes that already exist in the organization to effectively perform their job.
![]() |
Each layer of architecture informs the next. In other words, each layer has components that execute processes and offer services to the next layer. For example, data architecture can be broken down into more granular activities and processes that inform how the organization’s technology architecture should be arranged. |
|
Data does not exist on its own. It is informed by business architecture and used by other architectural domains to deliver systems, IT services, and to support business processes. As you build your practice, you must consider how data fits within the broader architectural framework. |
The Zachman Framework is a widely used EA framework; within it, data is identified as the first domain. The framework aims to standardize artifacts (work-products) within each architectural domain, provides a cohesive view of the scope of EA and clearly delineates data components. Use the framework to ensure that your target DA practice is aligned to other domains within the EA framework. |
![]() (Source: Zachman International) |
Enterprise Architect
The enterprise architect provides thought leadership and direction to domain architects.
They also maintain architectural standards across all the architectural domains and serve as a lead project solution architect on the most critical assignments.
| Data architects need to have a deep experience in data management, data warehousing, and analytics technologies. At a high level, the data architect plans and implements an organization’s data, reporting, and analytics roadmap. Some of the role’s primary duties and responsibilities include:
| Data architects bridge the gap between strategic and technical requirements: “Fundamentally, the role of a data architect is to understand the data in an organization at a reasonable level of abstraction.” (Andrew Johnston, Independent Consultant) |
The data architect role is not always clear cut. Many organizations do not have a dedicated data architect resource, and may not need one. However, the duties and responsibilities of the data architect must be carried out to some degree by a combination of resources as appropriate to the organization’s size and environment.
Data Architect Role Description
Skills Necessary
|
Define Policies, Processes, and Priorities
|
See Info-Tech’s Data Architect job description for a comprehensive description of the data architect role.

The Open Group TOGAF enterprise architecture model is a detailed framework of models, methods, and supporting tools to create an enterprise-level architecture.
The wide adoption of TOGAF has resulted in the mapping of it to several other industry standards including CoBIT and ITIL.

MIKE2.0 (Method for an Integrated Knowledge Environment), is an open source method for enterprise information management providing a framework for information development.
If an enterprise-level IT architecture is your goal, TOGAF is likely a better model. However, if you are an information and knowledge-based business then MIKE2.0 may be more relevant to your business.
As the business landscape evolves, new needs arise. An organization may undergo new compliance requirements, or look to improve their customer intimacy, which could require a new functionality from an application and its associated database.
There are four common scenarios that lead to an organization’s need to optimize its data architecture and these scenarios all present unique challenges for a data architect:
These are not the only reasons why data architects need to optimize the organization’s data architecture. These are only four of the most common scenarios, however, other business needs can be addressed using the same concept as these four common scenarios.
Follow Info-Tech’s process of first analyzing the needs of the business, then determining how best to architect your data based on these drivers. Data architecture needs to be able to rapidly evolve to support the strategic goals of the business, and the Data Architecture Driver Pattern Identification Tool will help you to prioritize your efforts to best do this.
Tab 2. Driver Identification Objective: Objectively assess the most pressing business drivers.
|
Tab 3. Tactic Pattern Plan, Section 1 Purpose: Review your business drivers that require architectural changes in your environment.
|
Tab 3. Tactic Pattern Plan, Section 2 Purpose: Determine a list of tactics that will help you address the business drivers.
|
Step
|
Step
|
Step
|
INPUT: Data Architecture Driver tool assessment prompts.
OUTPUT: Identified business driver that applies to your organization.
Materials: Data Architecture Driver Pattern Identification Tool
Participants: Data architect, Enterprise architect
InstructionsIn Tab 2. Driver Identification of the Data Architecture Driver Pattern Identification Tool, assess the degree to which the organization is feeling the pains of the four most common business drivers:
|
Data architecture improvements need to be driven by business need.
“As a data architect, you have to understand the functional requirements, the non-functional requirements, then you need to make a solution for those requirements. There can be multiple solutions and multiple purposes.” (Andrew Johnston, Independent Consultant) |
1.1.2 1 hour per interview
INPUT: Sample questions targeting the activities, challenges, and opportunities of each business unit
OUTPUT: Sample questions targeting the activities, challenges, and opportunities of each business unit
Materials: Data Architecture Driver Pattern Identification Tool
Participants: Data architect, Business representatives, IT representatives
Identify 2-3 business units that demonstrate enthusiasm for or a positive outlook on improving how organizational data can help them in their role and as a unit.
Conducting a deep-dive interview process with these key stakeholders will help further identify high-level goals for the data architecture strategy within each business unit. This process will help to secure their support throughout the implementation process by giving them a sense of ownership.
Request background information and documentation from stakeholders regarding the following:
1.1.3 2 hours
INPUT: Data Architecture Driver tool assessment prompts.
OUTPUT: Identified business driver that applies to your organization.
Materials: Data Architecture Driver Pattern Identification Tool
Participants: Data architect, Enterprise architect
| Instructions
As you work through Tab 2. Driver Identification of the Data Architecture Driver Pattern Identification Tool, consult with the enterprise architect or equivalent to assist you in rating the importance of each of the symptoms of the business drivers. This will help you provide greater value to the business and more aligned objectives. |
![]() Tab 2. Driver Identification |
PHASE 1 | |
| 1.1 | 1.2 |
| Identify Your Business Driver for Optimizing Data Architecture | Determine Actionable Tactics to Optimize Data Architecture |
Remember… Architecting an organization involves alignment, planning, road mapping, design, and change management functions.
Data architects must be heavily involved with:
To do this, you need a framework. A framework provides you with the holistic view of the organization’s data environment that you can use to design short- and long-term tactics for improving the use of data for the needs of the business.
Use Info-Tech’s five-tier data architecture to model your environment in a logical, consumable fashion.
The more complicated an environment is, the more need there is for a framework. Being able to pick a starting point and prioritize tasks is one of the most difficult, yet most essential, aspects of any architect’s role.
Info-Tech’s five-tier data architecture model summarizes an organization’s data environment at a logical level. Data flows from left to right, but can also flow from the presentation layer back to the warehousing layer for repatriation of data.

Download the Data Architecture Optimization Template.
Use this template to support your team in creating a tactical strategy for optimizing your data architecture across the five tiers of the organization’s architecture. This template can be used to document your organization’s most pressing business driver, the reasons for optimizing data architecture according to that driver, and the tactics that will be employed to address the shortcomings in the architecture.
![]() |
Info-Tech’s Data Architecture Optimization Template | Table of Contents | |
| 1. Build Your Current Data Architecture Logical Model | Use this section to document the current data architecture situation, which will provide context for your plan to optimize your data architecture. | ||
| 2. Optimization Plan | Use this section to document the tactics that will be employed to optimize the current data architecture according to the tactic pattern identified by the business driver. | ||
As you read about the details of the five-tier data architecture model in the following slides, start building your current logical data architecture model by filling out the sections that correspond to the various tiers. For example, if you identified that the most pressing business driver is becoming compliant with regulations, document the sources of data required for compliance, as well as the warehousing strategy currently being employed. This will help you to understand the organization’s data architecture at a logical level.
![]() –› Data to integration layer | Tier 1 is where the data enters the organization.All applications, data documents such as MS Excel spreadsheets, documents with table entries, manual extractions from other document types, user-level databases including MS Access and MySQL, other data sources, data feeds, big datasets, etc. reside here. This tier typically holds the siloed data that is so often not available across the enterprise because the data is held within department-level applications or systems. This is also the layer where transactions and operational activities occur and where data is first created or ingested. There are any number of business activities from transactions through business processes that require data to flow from one system to another, so it is often at this layer we see data created more than once, data corruption occurs, manual re-keying of data from system to system, and spaghetti-like point-to-point connections are built that are often fragile. This is usually the single most problematic area within an enterprise’s data environment. Application- or operational-level (siloed) reporting often occurs at this level. Info-Tech Best PracticeAn optimized Tier 1 has the following attributes:
|
![]() –› Data to Warehouse Environment Find out more For more information on data integration, see Info-Tech’s Optimize the Organization’s Data Integration Practices blueprint. | Tier 2 is where integration, transformation, and aggregation occur.Regardless of how you integrate your systems and data stores, whether via ETL, ESB, SOA, data hub, ODS, point-to-point, etc., the goal of this layer is to move data at differing speeds for one of two main purposes: 1) To move data from originating systems to downstream systems to support integrated business processes. This ensures the data is pristine through the process and improves trustworthiness of outcomes and speed to task and process completion. 2) To move data to Tier 3 - The Data Warehouse Architecture, where data rests for other purposes. This movement of data in its purest form means we move raw data to storage locations in an overall data warehouse environment reflecting any security, compliance and other standards in our choices for how to store. Also, this is where data is transformed for unique business purpose that will also be moved to a place of rest or a place of specific use. Data masking, scrambling, aggregation, cleansing and matching, and other data related blending tasks occur at this layer. Info-Tech Best PracticeAn optimized Tier 2 has the following attributes:
|
Tier 3 is where data rests in long-term storage.This is where data rests (long-term storage) and also where an enterprise’s information, documents, digital assets, and any other content types are stored. This is also where derived and contrived data creations are stored for re-use, and where formulas, thought models, heuristics, algorithms, report styles, templates, dashboard styles, and presentations-layer widgets are all stored in the enterprise information management system. At this layer there may be many technologies and many layers of security to reflect data domains, classifications, retention, compliance, and other data needs. This is also the layer where data lakes exist as well as traditional relational databases, enterprise database systems, enterprise content management systems, and simple user-level databases. Info-Tech Best PracticeAn optimized Tier 3 has the following attributes:
| Data from integration layer –›![]() –› Analytics Find out more For more information on Data Warehousing, see Info-Tech’s Build an Extensible Data Warehouse Foundation and Drive Business Innovation With a Modernized Data Warehouse Environment blueprints. |
Tier 4 represents data being used for a purpose.This is where you build fit-for-purpose data sets (marts, cubes, flat files) that may now draw from all enterprise data and information sources as held in Tier 3. This is the first place where enterprise views of all data may be effectively done and with trust that golden records from systems of record are being used properly. This is also the layer where BI tools get their greatest use for performing analysis. Unlike Tier 3 where data is at rest, this tier is where data moves back into action. Data is brought together in unique combinations to support reporting, and analytics. It is here that the following enterprise analytic views are crafted:
Info-Tech Best PracticeAn optimized Tier 4 has the following attributes:
| Warehouse Environment –›![]() –› Presentation Find out more For more information on BI tools and strategy, see Info-Tech’s Select and Implement a Business Intelligence and Analytics Solution and Build a Next Generation BI with a Game-Changing BI Strategy blueprints. |
Tier 5 represents data in knowledge form.This is where the data and information combine in information insight mapping methods (presentations, templates, etc.). We craft and create new ways to slice and dice data in Tier 4 to be shown and shared in Tier 5. Templates for presenting insights are extremely valuable to an enterprise, both for their initial use, and for the ability to build deeper, more insightful analytics. Re-use of these also enables maximum speed for sharing, consuming the outputs, and collective understanding of these deeper meanings that is a critical asset to any enterprise. These derived datasets and the thought models, presentation styles, templates, and other derived and contrived assets should be repatriated into the derived data repositories and the enterprise information management systems respectively as shown in Tier 3. Find out more For more information on enterprise content management and metadata, see Info-Tech’s Develop an ECM Strategy and Break Open Your DAM With Intuitive Metadata blueprints. | ![]() | |
Info-Tech Best PracticeAn optimized Tier 5 has the following attributes:
| Info-Tech InsightRepatriation of data and information is an essential activity for all organizations to manage organizational knowledge. This is the activity where information, knowledge, and insights that are stored in content form are moved back to the warehousing layer for long-term storage. Because of this, it is crucial to have an effective ECM strategy as well as the means to find information quickly and efficiently. This is where metadata and taxonomy come in. | |
Now that you have an understanding of the drivers requiring data architecture optimization, as well as the current data architecture situation at your organization, it is time to determine the actions that will be taken to address the driver.
1. Business driver |
![]() Data Architecture Driver Pattern Identification Tool, Tab 2. Tactic Pattern Plan |
![]() 3. Documented tactic planData Architecture Optimization Template |
2. Tactics across the five tiers |
![]() |
Whether the business wants to gain better customer intimacy, achieve operational excellence, or needs to change its compliance and reporting strategy, the need for collecting new data through a new application or a new functionality within an existing application can arise. This business driver has the following attributes:
|
![]() |
||
| When this business driver arises, data architects should focus on optimizing architecture at the source tier and the integration of the new functionality. | Tactics for this business driver should address the following pattern:![]() |
||
An organization can want to use its data for multiple reasons. Whether these reasons include improving customer experience or operational excellence, the data architect must ensure that the organization’s data aggregation environment, reporting and analytics, and presentation layer are assessed and optimized for serving the needs of the business.
“Data-drivenness is about building tools, abilities, and, most crucially, a culture that acts on data.” (Carl Anderson, Creating a Data-Driven Organization)
Tactics for this business driver should address the following pattern:![]() |
When this business driver arises, data architects should focus on optimizing architecture at the source tier and the integration of the new functionality. | ||
![]() |
|
||
An organization can want to use its data for multiple reasons. Whether these reasons include improving customer experience or operational excellence, the data architect must ensure that the organization’s data aggregation environment, reporting and analytics, and presentation layer are assessed and optimized for serving the needs of the business.
There are different types of requirements:
|
![]() |
||
| When this business driver arises, data architects should focus on optimizing architecture where data is stored: at the sources, the warehouse environment, and analytics layer. | Tactics for this business driver should address the following pattern:![]() |
||
Is the organization looking to acquire or merge with another organization or line of business?There are three scenarios that encompass the mergers and acquisitions business driver for data architecture:
|
Regardless of what scenario your organization falls into, you must go through the same process of identifying the requirements for the new data:
|
|
| “As a data architect, you must do due diligence of the acquired firm. What are the workflows, what are the data sources, what data is useful, what is useless, what is the value of the data, and what are the risks of embedding the data?” (Anonymous Mergers and Acquisitions Consultant) | ||
| When this business driver arises, data architects should focus on optimizing architecture at the source tier, the warehousing layer, and analytics. |
![]() |
|
1.2.1 30 minutes
INPUT: Business driver assessment
OUTPUT: Tactic pattern and tactic plan
Materials: Data Architecture Driver Pattern Identification Tool, Data Architecture Optimization Template
Participants: Data architect, Enterprise architect
Instructions
|
||
![]() Data Architecture Driver Tool |
![]() |
![]() Data Architecture Optimization Template |
Our approach will help you to get to the solution of the organization’s data architecture problems as quickly as possible. However, keep in mind that you should still address the other tiers of your data architecture even if they are not part of the pattern we identified. For example, if you need to become more data driven, don’t completely ignore the sources and the integration of data. However, to deliver the most and quickest value, focus on tiers 3, 4, and 5.
Data architects and those responsible for updating an organization’s data architecture have a wide-open playing field with which to take their efforts. Being able to narrow down your focus and generate an actionable plan will help you provide more value to the organization quickly and get the most out of your data.
Now that you have your prioritized tactical plan, move to Phase 2. This phase will help you map these priorities to the essential capabilities and measure where you stack up in these capabilities. This is an essential step in creating your data architecture roadmap and plan for coming years to modernize the organization’s data architecture.
CASE STUDY | Industry: Financial
| ![]() | Part 1 |
| Prior to receiving new external requirements, the monetary Authority body had been operating with an inefficient system. Outdated legacy systems, reports in paper form, incomplete reports, and stale data from other agencies resulted in slow data access. The new requirements demanded speeding up this process.
Although the organization understood it needed changes, it first needed to establish what were the business objectives, and which areas of their architecture they would need to focus on. The business driver in this case was compliance requirements, which directed attention to the sources, aggregation, and insights tiers. |
Looking at the how the different tiers relate to certain business operations, the organization uncovered the best practise tactics to achieving an optimized data architecture.
Once the business driver had been established, the organization was able to identify the specific areas it would eventually need to evaluate and remedy as needed. |
![]() |
|
1.1.1 |
![]() |
Identify the business driver that will set the direction of your data architecture optimization plan.
In this activity, the facilitator will guide the team in identifying the business driver that is creating the need to improve the organization’s data architecture. Data architecture needs to adapt to the changing needs of the business, so this is the most important step of any data architecture improvements. |
1.2.1 |
![]() |
Determine the tactics that you will use to optimize data architecture.
In this activity, the facilitator will help the team create a tactical plan for optimizing the organization’s data architecture across the five tiers of the logical model. This plan can then be followed when addressing the business needs. |
| Business Drivers |
|
|||||||||||||||
| Tiers | 1. Data Sources | 2. Integration | 3. Warehousing | 4. Insights | 5. Presentation | |||||||||||
| Capabilities | Current Capabilities | |||||||||||||||
| Target Capabilities | ||||||||||||||||
| Example Tactics | Leverage indexes, partitions, views, and clusters to optimize performance.
Cleanse data source. |
Leverage integration technology.
Identify matching approach priorities. |
Establish governing principles.
Install performance enhancing technologies. |
Establish star schema and snowflake principles.
Share data via data mart. |
Build metadata architecture:
|
|||||||||||
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 2.1: Measure Your Data Architecture Capabilities | Step 2.2: Set a Target for Data Architecture Capabilities | Step 2.3: Identify the Tactics That Apply to Your Organization |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Finalize phase deliverable:
|
Then complete these activities…
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
With these tools & templates:
|
Phase 2 Results & Insights
|
||
PHASE 2 |
||
| 2.1 | 2.2 | 2.3 |
| Measure Your Data Architecture Capabilities | Set a Target for Data Architecture Capabilities | Identify the Tactics That Apply to Your Organization |
Capabilities represent a mixture of people, technology, and processes. The focus of capability design is on the outcome and the effective use of resources to produce a differentiating capability or an essential supporting capability.
To personalize your tactics, you have to understand what the essential capabilities are across the five tiers of an organization’s data architecture. Then, assess where you currently stand in these capabilities and where you need to go in order to build your optimization plan.

Info-Tech’s data architecture capability model can be laid over the five-tier data architecture to understand the essential and advanced capabilities that an organization should have, and to build your tactical strategy for optimizing the organization’s data architecture across the tiers.
Info-Tech’s data architecture capability model can be laid over the five-tier data architecture to understand the essential and advanced capabilities that an organization should have, and to build your tactical strategy for optimizing the organization’s data architecture across the tiers.

2.1.1 Data Architecture Tactical Roadmap Tool
InstructionsUse the Data Architecture Tactical Roadmap Tool as your central tool to develop a tactical plan of action to optimize the organization’s data architecture. This tool contains the following sections:
| INFO-TECH DELIVERABLE |
The organization likely has some of the capabilities that are needed to solve the problem, but also a need to improve other capabilities. To narrow down the capabilities that you should focus on, first select the business driver that was identified in Phase 1 in Tab 1. Business Driver Input of the Data Architecture Tactical Roadmap Tool. This will customize the roadmap tool to deselect the capabilities that are likely to be less relevant to your organization.
For Example: If you identified your business driver as “becoming more data-driven”, you will want to focus on measuring and building out the capabilities within Tiers 3, 4, and 5 of the capability model.
Data Architecture Capability Model![]() |
NoteIf you want to assess your organization for all of the capabilities across the data architecture capability model, select “Comprehensive Data Architecture Assessment” in Tab 1. Business Driver Input of the Data Architecture Tactical Roadmap Tool.
|
2.1.2 1 hour
INPUT: Current data architecture capabilities.
OUTPUT: An idea of where you currently stand in the capabilities.
Materials: Data Architecture Tactical Roadmap Tool
Participants: Data architect, Enterprise architect, Business representatives
Use the Data Architecture Tactical Roadmap Tool to evaluate the baseline and target capabilities of your practice in terms of how data architecture is approached and executed.
Instructions
These results will set the baseline against which you will monitor performance progress and keep track of improvements over time. |
To assess data architecture maturity, Info-Tech uses the Capability Maturity Model Integration (CMMI) program for rating capabilities on a scale of 1 to 5:
1 = Initial/Ad hoc 2 = Developing 3 = Defined 4 = Managed and Measurable 5 = Optimized |
Focus on Early Alignment. Assessing capabilities within specific people’s job functions can naturally result in disagreement or debate, especially between business and IT people. Objectively facilitate any debate and only finalize capability assessments when there is full alignment. Remind everyone that data architecture should ultimately serve business needs wherever possible.
PHASE 2 | ||
| 2.1 | 2.2 | 2.3 |
| Measure Your Data Architecture Capabilities | Set a Target for Data Architecture Capabilities | Identify the Tactics That Apply to Your Organization |
Keep the goal in mind by documenting target state objectives. This will help to measure the highest priority gaps in the organization’s data architecture capabilities.
| Example driver = Becoming more data driven | ![]() |
![]() |
![]() |
Current Capabilities | ![]() |
Target Capabilities |
| Gaps and Priorities | ||||||
![]() |
||||||
INPUT: Current state of data architecture capabilities.
OUTPUT: Target state of data architecture capabilities.
Materials: Data Architecture Tactical Roadmap Tool
Participants: Data architect
Determine the state of data architecture capabilities that the organization needs to reach to address the drivers of the business.
For example: If you identified your business driver as “becoming more data driven”, you will want to focus on the capabilities within Tiers 3, 4, and 5 of the capability model.
| Driver = Becoming more data driven | ![]() |
![]() |
![]() |
Target Capabilities |
2.2.2 1 hour
INPUT: Current and target states of data architecture capabilities.
OUTPUT: Holistic understanding of where you need to improve data architecture capabilities.
Materials: Data Architecture Tactical Roadmap Tool
Participants: Data architect
To enable deeper analysis on the results of your capability assessment, Tab 4. Capability Gap Analysis in the Data Architecture Tactical Roadmap Tool creates visualizations of the gaps identified in each of your practice capabilities and related data management practices. These diagrams serve as analysis summaries.

PHASE 2 | ||
| 2.1 | 2.2 | 2.3 |
| Measure Your Data Architecture Capabilities | Set a Target for Data Architecture Capabilities | Identify the Tactics That Apply to Your Organization |
Stop here. Before you begin to plan for optimization of the organization’s data environment, get a sense of the sustainability and scalability of the direction of the organization’s data architecture evolution.
Practically any trend in data architecture is driven by an attempt to solve one or more the common challenges of today’s tumultuous data landscape, otherwise known as “big data.” Data is being produced in outrageous amounts, at very high speeds, and in a growing number of types and structures.
To meet these demands, which are not slowing down, you must keep ahead of the curve. Consider the internal and external catalysts that might fuel your organization’s need to modernize its data architecture:
Big Data |
Data Storage |
Advanced analytics |
Unstructured data |
Integration |
| Hadoop ecosystem
The discussion about big data is no longer about what it is, but how do businesses of all types operationalize it. Is your organization currently capturing and leveraging big data? Are they looking to do so in the near future? |
The cloud
The cloud offers economical solutions to many aspects of data architecture. Have you dealt with issues of lack of storage space or difficulties with scalability? Do you need remote access to data and tools? |
Real-time architecture
Advanced analytics (machine learning, natural language processing) often require data in real-time. Consider Lambda and Kappa architectures. Has your data flow prevented you from automation, advanced analytics, or embracing the world of IoT? |
Graph databases
Self-service data access allows more than just technical users to participate in analytics. NoSQL can uncover buried relationships in your data. Has your organization struggled to make sense of different types of unstructured data? |
Is ETL enough?
What SQL is to NoSQL, ETL is to NoETL. Integration techniques are being created to address the high variety and high velocity of data. Have your data scientists wasted too much time and resources in the ETL stage? |
The Info-Tech Data Architecture Trends Presentation provides a glance at some of the more significant innovations in technology that are driving today’s advanced data architectures. This presentation also explains how these trends relate to either the data challenges you may be facing, or the specific business drivers you are hoping to bring to your organization. |
![]() Data Architecture Trends Presentation |
Now that you know where the organization currently stands, follow these steps to begin prioritizing the initiatives:
| Current State | Gap Closure Strategies | Target State | Data Architecture Tactical Roadmap |
|
Initiatives involving:
|
|
(Source: “How to Build a Roadmap”) |
Optimizing data architecture requires a tactical approach, not a passive approach. The demanding task of optimization requires the ability to heavily prioritize. After you have identified why, determine how using our pre-built roadmap to address the four common drivers.
Before diving headfirst into creating your tactical data architecture plan, documenting the challenges associated with each aspect of the organization’s data architecture can help to identify where you need to focus your energy in optimizing each tier. The following table presents the common challenges across the five tiers:
Source Tier |
Integration Tier |
Warehousing Tier |
Analytics Tier |
Presentation Tier |
| Inconsistent data models | Performance issues | Scalability of the data warehouse | Data currency, flexibility | Model interoperability |
| Data quality measures: data accuracy, timeliness, accessibility, relevance | Duplicated data | Infrastructure needed to support volume of data | No business context for using the data in the correct manner | No business context for using the data in the correct manner |
| Free-form field and data values beyond data domain | Tokenization and other required data transformations | Performance
Volume Greedy consumers can cripple performance Insufficient infrastructure |
Inefficiencies in building the data mart | Report proliferation/chaos (“kitchen sink dashboards”) |
| Reporting out of source systems | DB model inefficiencies | |||
| Manual errors;
Application usability |
Elasticity |
2.2.3 1 hour
INPUT: Tactics that will be used to optimize data architecture.
OUTPUT: Metrics that can be used to measure optimization success.
Materials: Data Architecture Tactical Roadmap Tool
Participants: Data architect
There are two types of metrics that are useful for data architects to track and measure: program metrics and project metrics. Program metrics represent the activities that the data architecture program, which is the sum of multiple projects, should help to improve. Project metrics are the more granular metrics that track each project.
Program Metrics
|
Project Metrics
|
Use Tab 6. Metrics of the Data Architecture Tactical Roadmap Tool to document and track metrics associated with your optimization tactics.
| Data Governance
Data architecture depends on effective data governance. Use our blueprint, Enable Shared Insights With an Effective Data Governance Engine to get more out of your architecture. |
Data Quality
The key to maintaining high data quality is a proactive approach that requires you to establish and update strategies for preventing, detecting, and correcting errors. Find out more on how to improve data quality with Info-Tech’s blueprint, Restore Trust in Your Data Using a Business-Aligned Data Quality Management Approach. |
| Master Data Management
When you start your data governance program, you will quickly realize that you need an effective MDM strategy for managing your critical data assets. Use our blueprint, Develop a Master Data Management Strategy and Roadmap to Better Monetize Data to get started with MDM. |
Data Warehouse
The key to maintaining high data quality is a proactive approach that requires you to establish and update strategies for preventing, detecting, and correcting errors. Find out more on how to improve data quality with Info-Tech’s blueprint, Drive Business Innovation With a Modernized Data Warehouse Environment. |
CASE STUDY | Industry: Financial
| ![]() | Part 2 |
After establishing the appropriate tactics based on its business driver, the monetary authority was able to identify its shortcomings and adopt resolutions to remedy the issues.
| Best Practice Tactic | Current State | Solution | |
| Tier 1 - Data Sources | Identify data sources | Data coming from a number of locations. | Create data model for old and new systems. |
| Ensure data quality | Internal data scanned from paper and incomplete. | Data cleansing and update governance and business rules for migration to new system. | |
| External sources providing conflicting data. | |||
| Tier 3 - Data Warehousing | Data catalogue | Data aggregated incompletely. | Built proper business data glossary for searchability. |
| Indexing | Data warehouse performance sub-optimal. | Architected data warehouse for appropriate use (star schema). | |
| Tier 4 - Data Analytics | Data accessibility | Relevant data buried in warehouse. | Build data marts for access. |
| Data reduction | Accurate report building could not be performed in current storage. | Built interim solution sandbox, spin up SQL database. |
Establishing these solutions provided the organization with necessary information to build their roadmap and move towards implementing an optimized data architecture.
![]() |
|
2.1.1 – 2.2.2 |
![]() |
Evaluate your current capabilities and design your target data quality practice from two angles
In this assessment and planning activity, the team will evaluate the current and target capabilities for your data architecture’s ability to meet business needs based on the essential capabilities across the five tiers of an organization’s architectural environment. |
2.2.3 |
![]() |
Create metrics to track the success of your optimization plan.
The Info-Tech facilitator will guide you through the process of creating program and project metrics to track as you optimize your data architecture. This will help to ensure that the tactics are helping to improve crucial business attributes. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 3.1: Personalize Your Data Architecture Roadmap | Step 3.2: Manage Your Data Architecture Decisions and the Resulting Changes |
Start with an analyst kick-off call:
| Review findings with analyst:
|
Then complete these activities…
| Then complete these activities…
|
With these tools & templates:
| With these tools & templates:
|
Phase 3 Results & Insights
| |
PHASE 3 |
||
| 3.1 | 3.2 | |
| Personalize Your Data Architecture Roadmap | Manage Your Data Architecture Decisions and the Resulting Changes | |
Phase 1 and 2 helped you to identify tactics that address some of the most common business drivers. Phase 3 will bring you through the process of practically planning what those tactics look like in your organization’s environment and create a roadmap to plan how you will generate business value through optimization of your data architecture environment.

Generating Your Roadmap
|
![]() Tab 5. Tactic and Initiative Planning
|
3.1.2 1 hour
INPUT: Timing of initiatives for optimizing data architecture.
OUTPUT: Optimization roadmap
Materials: Data Architecture Tactic Roadmap Tool
Participants: Data architect, Enterprise Architect
![]() |
Tab 5. Tactic and Initiative Planning | ![]() |
Tab 7. Initiative Roadmap |
The activities that populate the roadmap can be taken as best practice activities. If you want an actionable, comprehensive, and prescriptive plan for optimizing your data architecture, fill in the timing of the activities and print the roadmap. This can serve as a rapid communication tool for your data architecture plan to the business and other architects.
| Remember: Data architects bridge the gap between strategic and technical requirements of data.
|
Also remember: In Phase 1, you built your tactical data architecture optimization plan.
|
INPUT: Data Architecture Tactical Roadmap
OUTPUT: Communication plan
Materials: Data Architecture Optimization Template
Participants: Data Architect, Business representatives, IT representatives
| Instructions
Begin by presenting your plan and roadmap to the business units who participated in business interviews in activity 1.1.3 of Phase 1. If you receive feedback that suggests that you should make revisions to the plan, consult Info-Tech Research Group for suggestions on how to improve the plan. If you gain approval for the plan, communicate it to DBAs and other data workers. |
Iterative optimization and communication plan:
![]() |
CASE STUDY | Industry: Financial
| ![]() | Part 3 |
After establishing the appropriate tactics based on its business driver, the monetary authority was able to identify its shortcomings and adopt resolutions to remedy the issues.
ChallengeA monetary authority was placed under new requirements where it would need to produce 6 different report types on its clients to a regulatory body within a window potentially as short as 1 hour. With its current capabilities, it could complete such a task in roughly 7 days. The organization’s data architecture was comprised of legacy systems that had poor searchability. Moreover, the data it worked with was scanned from paper, regularly incomplete and often inconsistent. |
SolutionThe solution first required the organization to establish the business driver behind the need to optimize its architecture. In this case, it would be compliance requirements. With Info-Tech’s methodology, the organization focused on three tiers: data sources, warehousing, and analytics. Several solutions were developed to address the appropriate lacking capabilities. Firstly, the creation of a data model for old and new systems. The implementation of governance principles and business rules for migration of any data. Additionally, proper indexing techniques and business data glossary were established. Lastly, data marts and sandboxes were designed for data accessibility and to enable a space for proper report building. |
ResultsWith the solutions established, the monetary authority was given information it needed to build a comprehensive roadmap, and is currently undergoing the implementation of the plan to ensure it will experience its desired outcome – an optimized data architecture built with the capacity to handle external compliance requirements. |
PHASE 3 | ||
| 3.1 | 3.2 | |
| Personalize Your Data Architecture Roadmap | Manage Your Data Architecture Decisions and the Resulting Changes | |
Once you have a plan in place, one the most challenging aspects of improving an organization is yet to come…overcoming change!
“When managing change, the job of the data architect is to avoid unnecessary change and to encapsulate necessary change.
You must provide motivation for simplifying change, making it manageable for the whole organization.” (Andrew Johnston, Independent Consultant)
![]() |
Create roadmap
Communicate roadmap
Implement roadmap
Change management |
| Document the architectural decisions made to provide context around changes made to the organization’s data environment.
The goal of this Data Architecture Decision Template is to provide data architects with a template for managing the changes that accompany major architectural decisions. As you work through the Build a Business-Aligned Data Architecture Optimization Strategy blueprint, you will create a plan for tactical initiatives that address the drivers of the business to optimize your data architecture. This plan will bring about changes to the organization’s data architecture that need change management considerations. Document any major changes to the organization’s data architecture that are required to evolve with the organization’s drivers. This will ensure that major architectural changes are documented, tracked, and that the context around the decision is maintained. “Environment is very chaotic nowadays – legacy apps, sprawl, ERPs, a huge mix and orgs are grappling with what our data landscape look like? Where are our data assets that we need to use?” (Andrew Johnston, Independent Consultant) |
Use Info-Tech’s Data Architecture Decision Template to document any major changes in the organization’s data architecture. |
As changes to the architectural environment occur, data architects must stay ahead of the curve and plan the change management considerations that come with major architectural decisions.
“When managing change, the job of the data architect is to avoid unnecessary change and to encapsulate necessary change.
You must provide motivation for simplifying change, making it manageable for the whole organization.” (Andrew Johnston, Independent Consultant)
See Info-Tech’s resources on change management to smooth changes:![]() |
|
|
|
As changes to the architectural environment occur, data architects must stay ahead of the curve and plan the release management considerations around new hardware and software releases or updates.
Release management is a process that encompasses the planning, design, build, configuration, and testing of hardware and software releases to create a defined set of release components (ITIL). Release activities can include the distribution of the release and supporting documentation directly to end users. See Info-Tech’s resources on Release Management to smooth changes:
![]() |
|
|
|
![]() |
|
3.1.1 |
![]() |
Create your personalized roadmap of activities.
In this activity, the facilitator will guide the team in evaluating practice gaps highlighted by the assessment, and compare these gaps at face value so general priorities can be documented. The same categories as in 3.1.1 are considered. |
3.1.3 |
![]() |
Communicate your data architecture optimization plan.
The facilitator will help you to identify the optimal medium and timing for communicating your plan for optimizing your data architecture. |
![]() |
Ron Huizenga, Senior Product Manager
Embarcadero Technologies, Inc. Ron Huizenga has over 30 years of experience as an IT executive and consultant in enterprise data architecture, governance, business process reengineering and improvement, program/project management, software development, and business management. His experience spans multiple industries including manufacturing, supply chain, pipelines, natural resources, retail, healthcare, insurance, and transportation. |
![]() |
Andrew Johnston, Architect
Independent Consultant
An independent consultant with a unique combination of managerial, commercial, and technical skills, Andrew specializes in the development of strategies and technical architectures that allow businesses to get the maximum benefit from their IT resources. He has been described by clients as a "broad spectrum" architect, summarizing his ability to engage in many problems at many levels. |
| Internal Contributors | |
![]() |
|
| External Contributors | |
![]() |
|
Allen, Mark. “Get the ETL Out of Here.” MarkLogic. Sep, 2016. Web. 25 Apr 2017.[http://www.marklogic.com/blog/get-the-etl-out-of-here/]
Anadiotis, George. “Streaming hot: Real-time big data architecture matters.” ZDNet. Jan, 2017. Web. 25 Apr 2017. [http://www.zdnet.com/article/streaming-hot-real-time-big-data-architecture-matters/]
Aston, Dan. “The Economic value of Enterprise Architecture and How to Show It.” Erwin. Aug, 2016. Web. 20 Apr 2017. [http://erwin.com/blog/economic-value-enterprise-architecture-show/]
Baer, Tony. “2017 Trends to Watch: Big Data.” Ovum. Nov, 2016. Web. 25 Apr 2017.
Bmc. “Benefits & Advantages of Hadoop.” Bmc. Web. 25 Apr 2017. [http://www.bmcsoftware.ca/guides/hadoop-benefits-business-case.html]
Boyd, Ryan, et al. “Relational vs. Graph Data Modeling” DZone. Mar 2016. Web. 25 Apr 2017. [https://dzone.com/articles/relational-vs-graph-data-modeling]
Brahmachar, Satya. “Theme To Digital Transformation - Journey to Data Driven Enterprise” Feb, 2015. Web. 20 Apr 2017. [http://satyabrahmachari-thought-leader.blogspot.ca/2015/02/i-smac-theme-to-digital-transformation.html]
Capsenta. “NoETL.” Capsenta. Web. 25 Apr 2017. [https://capsenta.com/wp-content/uploads/2015/03/Capsenta-Booklet.pdf]
Connolly, Shaun. “Implementing the Blueprint for Enterprise Hadoop” Hortonworks. Apr, 2014. Web. 25 Apr 2017. https://hortonworks.com/blog/implementing-the-blue...
Forbes. “Cloud 2.0: Companies Move From Cloud-First To Cloud-Only.” Forbes. Apr, 2017. Web. 25 Apr 2017. [https://www.forbes.com/sites/vmware/2017/04/07/cloud-2-0-companies-move-from-cloud-first-to-cloud-only/#5cd9d94a4d5e]
Forgeat, Julien. “Lambda and Kappa.” Ericsson. Nov 2015. Web 25 Apr 2017. [https://www.ericsson.com/research-blog/data-knowledge/data-processing-architectures-lambda-and-kappa/]
Grimes, Seth. “Is It Time For NoETL?” InformationWeek. Mar, 2010. Web. 25 Apr 2017. [http://www.informationweek.com/software/information-management/is-it-time-for-noetl/d/d-id/1087813]
Gupta, Manav. et al. “How IB‹ leads in building big data analytics solutions in the cloud.” IBM. Feb, 2016. Web. 25 Apr 2017. [https://www.ibm.com/developerworks/cloud/library/cl-ibm-leads-building-big-data-analytics-solutions-cloud-trs/index.html#N102DE]
“How To Build A Roadmap.” Hub Designs Magazine. Web 25 Apr 2017. [https://hubdesignsmagazine.com/2011/03/05/how-to-build-a-roadmap/]
IBM. “Top industry use cases for stream computing.” IBM. Oct, 2015. Web. 25 Apr 2017. [https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=IMW14704USEN]
Mateos-Garcia, Juan, et al. “Skills Of The Datavores.” Nesta. July. 2015. Web. 8 Aug 2016. [https://www.nesta.org.uk/sites/default/files/skills_of_the_datavores.pdf].
Maynard, Steven. “Analytics: Don’t Forget The Human Element” Forbes. 2015. Web. 20 Apr. 2017. [http://www.ey.com/Publication/vwLUAssets/EY-Forbes-Insights-Data-and-Analytics-Impact-Index-2015/$FILE/EY-Forbes-Insights-Data-and-Analytics-Impact-Index-2015.pdf]
Neo4j. “From Relational to Neo4j.” Neo4j. Web. 25 Apr 2017. [https://neo4j.com/developer/graph-db-vs-rdbms/#_from_relational_to_graph_databases]
NoETL “NoETL.” NoETL. Web. 25 Apr 2017. [http://noetl.org/]
Nolan, Roger. “Digital Transformation: Is Your Data Management Ready?” Informatica. Jun, 2016. Web. 20 Apr 2017. [https://blogs.informatica.com/2016/06/10/digital-transformation-data-management-ready/#fbid=hmBYQgS6hnm]
OpsClarity. “2016 State of Fast Data & Streaming Applications.” OpsClarity. Web. 25 Apr 2017. [https://www.opsclarity.com/wp-content/uploads/2016/07/2016FastDataSurvey.pdf]
Oracle. “A Relational Database Overview.” Oracle. Web. 25 Apr 2017. [https://docs.oracle.com/javase/tutorial/jdbc/overview/database.html]
Ponemon Institute LLC. “Big Data Cybersecurity Analytics Research Repor.t” Cloudera. Aug, 2016. Web. 25 Apr 2017. [https://www.cloudera.com/content/dam/www/static/documents/analyst-reports/big-data-cybersecurity-analytics-research-report.pdf]
Sanchez, Jose Juan. “Data Movement Killed the BI Star.” DV Blog. May, 2016. Web. 20 Apr. 2017. [http://www.datavirtualizationblog.com/data-movement-killed-the-bi-star/]
SAS. “Hadoop; What it is and why does it matter?” SAS. Web. 25 Apr 2017. [https://www.sas.com/en_ca/insights/big-data/hadoop.html#hadoopusers]
Schumacher, Robin. “A Quick Primer on graph Databases for RDBMS Professionals.” Datastax. Jul, 2016. Web. 25 Apr 2017. [http://www.datastax.com/2016/07/quick-primer-on-graph-databases-for-rdbms-professionals]
Swoyer, Steve. “It’s the End of the Data Warehouse as We Know It.” TDWI. Jan, 2017. Web. 20 Apr. 2017. [https://upside.tdwi.org/articles/2017/01/11/end-of-the-data-warehouse-as-we-know-it.aspx]
Webber, Jim, and Ian Robinson. “The Top 5 Use Cases of Graph Databases.” Neo4j. 2015. Web. 25 Apr 2017. [http://info.neo4j.com/rs/773-GON-065/images/Neo4j_Top5_UseCases_Graph%20Databases.pdf]
Zachman Framework. [https://www.zachman.com/]
Zupan, Jane. “Survey of Big Data Decision Makers.” Attiv/o. May, 2016. Web. 20 Apr 2017. [https://www.attivio.com/blog/post/survey-big-data-decision-makers]
Good governance stems from a deep understanding of how stakeholder groups interact with each other and their respective accountabilities and responsibilities. Without these things, organizational functions tend to interfere with each other, blurring the lines between governance and management and promoting ad–hoc decision making that undermines governance.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This storyboard will take you through the steps to develop a security governance and management model and implement essential governance processes.
This tool will help you determine governance and management accountabilities and responsibilities and use them to build a visual governance and management model.
This template will help you to implement or revise your organizational structure.
These templates will help you determine the role a steering committee will play in your governance and management model.
Once this governing document is customized, ensure the appropriate security policies are developed as well.
These templates will serve as the foundation of your security policy exception approval processes.
Many security leaders complain about a lack of governance and management in their organizations. They have policies and processes but find neither have had the expected impact and that the organization is teetering on the edge of lawlessness, with stakeholder groups operating in ways that interfere with each other (usually due to poorly defined accountabilities).
Among the most common examples is security's relationship to the business. When these groups don't align, they tend to see each other as adversaries and make decisions in line with their respective positions: security endorses one standard, the business adopts another.
The consequences of this are vast. Such an organization is effectively opposed to itself. No wonder policy and process have not resolved the issue.
At a practical level, good governance stems from understanding how different stakeholder groups interact, providing inputs and outputs to each other and modeling who is accountable for what. But this implied accountability model needs to be formalized (perhaps even modified) before governance can help all stakeholder groups operate as strategic partners with clearly defined roles, responsibilities, and decision-making power. Only when policies and processes reflect this will they serve as effective tools to support governance.

Logan Rohde
Senior Research Analyst, Security & Privacy
Info-Tech Research Group
| Your Challenge | Common Obstacles | Info-Tech's Approach |
Ineffective governance and management processes, if they are adopted at all, can lead to:
|
Most governance and management initiatives stumble because they do not address governance as a set of interactions and influences that stakeholders have with and over each other, seeing it instead as policy, process, and risk management. Challenges include:
| You will be able to establish a robust governance model to support the current and future state of your organization by accounting for these three essential parts:
|
Info-Tech Insight
Good governance stems from a deep understanding of how stakeholder groups interact with each other and their respective accountabilities and responsibilities. Without these things, organizational functions tend to interfere with each other, blurring the lines between governance and management and promoting ad hoc decision making that undermines governance.
This blueprint will solve the above challenges by helping you model your organization's governance structure and implement processes to support the essential governance areas: policy, risk, and performance metrics.
Percentage of organizations that have yet to fully advance to a maturity-based approach to security
70%
Source: McKinsey, 2021
Early adopter infrastructure
63%
Security leaders not reporting to the board about risk or incident detection and prevention.
Source: LogRhythm, 2021
46%
Those who report that senior leadership is confident cybersecurity leaders understand business goals.
Source: LogRhythm, 2021
Governance is often mistaken for an organization's formalized policies and processes. While both are important governance supports, they do not provide governance in and of themselves.
For governance to work well, an organization needs to understand how stakeholder groups interact with each other. What inputs and outputs do they provide? Who is accountable? Who is responsible? These are the questions one needs to ask before designing a governance structure. Failing to account for any of these three elements tends to result in overlap, inefficiency, and a lack of accountability, creating flawed governance.
"Information security governance is the guiding hand that organizes and directs risk mitigation efforts into a business-aligned strategy for the entire organization."
Steve Durbin,
Chief Executive,
Information Security Forum, Forbes, 2023
Info-Tech's Governance and Management research uses the logic of COBIT's governance and management framework but distills this guidance into a practical, easy-to-implement series of steps, moving beyond the rudimentary logic of COBIT to provide an actionable and personalized governance model.


The distinction that COBIT draws between governance and management is roughly equivalent to that of accountability and responsibility, as seen in the RACI* model.
There can be several stakeholders responsible for something, but only one party can be accountable.
Use this guidance to help determine the accountabilities and responsibilities of your governance and management model.
*Responsible, Accountable, Consulted, Informed

A security governance framework is a system that will design structures, processes, accountability definitions, and membership assignments that lead the security department toward optimal results for the business.
Governance is performed in three ways:
| 1 Evaluate | 2 Direct | 3 Monitor |
|---|---|---|
| For governance to be effective it must account for stakeholder interests and business needs. Determining what these are is the vital first step. | Governance is used to determine how things should be done within an organization. It sets standards and provides oversight so decisions can be made during day-to-day management. | Governance needs change and inefficiencies need to be revised. Therefore, monitoring key performance indicators is an essential step to course correct as organizational needs evolve. |
"Governance specifies the accountability framework and provides oversight to ensure that risks are adequately mitigated, while management ensures that controls are implemented to mitigate risks. Management recommends security strategies. Governance ensures that security strategies are aligned with business objectives and consistent with regulations."
- EDUCAUSE

Specific
Measurable
Achievable
Relevant
Time-Bound
| Examples |
| Security's risk analyses will be included as part of the business decision-making process within three months after completing the governance initiative. |
| Increase rate of security risk analysis using risk appetite within three months of project completion. |
| Have stakeholder engagement supply input into security risk-management decisions within three months of completing phase one of blueprint. |
| Reduce time to approve policy exceptions by 25%. |
| Reduce security risk related to policy non-compliance by 50% within one year. |
| Develop five KPIs to measure progress of governance and management within three months of completing blueprint. |
| 1. Design Your Governance Model | 2. Implement Essential Governance Processes | |
|---|---|---|
| Phase Steps |
|
|
| Phase Outcomes |
|
|
The key is in stakeholder interactions, not policy and process
Good governance stems from a deep understanding of how stakeholder groups interact with each other and their respective accountabilities and responsibilities. Without these things, organizational functions tend to interfere with each other, blurring the lines between governance and management and promoting ad hoc decision making that undermines governance.
Policy, process, and org. charts support governance but do not produce it on their own
To be effective, these things need to be developed with the accountabilities and influence of the organizational functions that produce them.
A lack of business alignment does not mean you're doomed to fail
While the highest levels of governance maturity depend on strong security-business alignment, there are still tactics one can use to improve governance.
All organizations have governance
Sometimes it is poorly defined, ineffective, and occurs in the same place as management, but it exists at some level, acting as the decision-making apparatus for an organization (i.e. what can and cannot occur).
Risk tolerances are variable across lines of business
This can lead to misalignments between security and the business, as each may have their own tolerance for particular risks. The remedy is to understand the risk appetite of the business and allow this to inform security risk management decisions.
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
Security Governance Model Tool
Security Governance Organizational Structure Template
Information Security Steering Committee Charter & RACI
Policy Exceptions-Handling Workflow
Policy Exception Tracker and Request Form
Key deliverable:
By the end of this blueprint, you will have created a personalized governance model to map your stakeholders' accountabilities, responsibilities, and key interactions.
| IT Benefits | Business Benefits |
|---|---|
|
|
| DIY Toolkit | Guided Implementation | Workshop | Consulting |
|---|---|---|---|
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Diagnostics and consistent frameworks are used throughout all four options.
| Phase 1 | Phase 2 | |||
|---|---|---|---|---|
| Call #1: Scope requirements, objectives, and your specific challenges. | Call #2: Determine governance requirements. Call #3: Review governance model. |
Call #4: Determine KPIs. Call #5: Stand up steering committee. |
Call #6: Set risk appetite. Call #7: Establish policy lifecycle. |
Call #8: Revise exception-handing process. |
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is 4 to 8 calls over the course of 2 to 3 months.
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
| Activities | Evaluate | Direct | Monitor | Implement Essential Governance Processes | Next Steps and Wrap-Up (offsite) |
| 1.1 Prioritize governance accountabilities 1.2 Prioritize management responsibilities 1.3 Evaluate organizational structure |
2.1 Align with business 2.2 Build security governance and management model 2.3 Visualize security governance and management model |
3.1 Develop governance and management KPIs | 4.1 Draft steering committee charter 4.2 Complete steering committee RACI 4.3 Draft qualitative risk statements 4.4 Define policy management lifecycle 4.5 Establish policy exception approval process |
5.1 Complete in-progress deliverables from previous four days 5.2 Set up review time for workshop deliverables and to discuss next steps |
|
| Deliverables |
|
|
|
|
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
Workshop Day 1 and Day 2
Security Governance and Management
Workshop Day 3 and Day 4
Security Strategy Gap Analysis or Security Program Design Factors
Phase 1
1.1 Evaluate
1.2 Direct
1.3 Monitor
Phase 2
2.1 Implement Oversight
2.2 Set Risk Appetite
2.3 Implement Policy lifecycle
Establish Security Governance & Management
This phase will walk you through the following activities:
This phase involves the following participants:
Activities
1.1.1 Prioritize governance accountabilities
1.1.2 Prioritize management responsibilities
1.1.3 Evaluate current organizational structure
This step involves the following participants:
Outcomes of this step
Design Your Governance Model
Step 1.1 > Step 1.2 > Step 1.3
| Element | Questions |
| Compliance | What voluntary or mandatory standards must be represented in my governance model? |
| Legal | What laws are the organization accountable to? Who is the accountable party? |
| Business needs | What does the business need to operate? What sort of informational or operational flows need to be accounted for? |
| Culture | How does the business operate? Are departments siloed or cooperative? Where does security fit in? |
| Decision-making process | How are decisions made? Who is involved? What information needs to be available to do so? |
| Willingness to be governed | Is the organization adverse to formal governance mechanisms? Are there any opportunities to improve alignment with the business? |
| Relevant trends | Are there recent developments (e.g. new privacy laws) that are likely to affect the organization in the future? Will this complicate or simplify governance modeling efforts? |
| Stakeholder interests | Who are the internal and external stakeholders that need to be represented in the governance model? |
The above is a summary of COBIT 2019 EDM01.01 Evaluate the governance system, along with Info-Tech-recommended questions to contextualize each element for your organization.
1-2 hours
Using the example on the next slide, complete the following steps.
Download the Security Governance Model Tool
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|

1 hours
Using the examples on the previous slide, complete the following steps.
Download Security Governance Model Tool
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|

1-3 hours
Download the Security Governance Organizational Structure Template
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Security Governance Organizational Structure Template

Activities
1.2.1 Align with the business
1.2.2 Build security governance and management model
1.2.3 Finalize governance and management model
This step involves the following participants:
CISO
CIO
Business representative
Outcomes of this step
Design Your Governance Model
Step 1.1 > Step 1.2 > Step 1.3
| Element | Questions |
| Business alignment | Do we have a full understanding of the business's approach to risk and security's role to support business objectives? |
| Organizational security process | How well do our current processes work? Are we missing any key processes? |
| Steering committee | Will we use a dedicated steering committee to oversee security governance, or will another stakeholder assume this role? |
| Security awareness | Does the organization have a strong security culture? Does an effort need to be made to educate stakeholder groups on the role of security in the organization? |
| Roles and responsibilities | Does the organization use RACI charts or another system to define roles and document duties? |
| Communication flows | Do we have a good understanding of how information flows between stakeholder groups? Are there any gaps that need to be addressed (e.g. regular board reporting)? |
The above is a summary of COBIT 2019 EDM01.02 Direct the governance system, along with Info-Tech-recommended questions to contextualize each element for your organization.

1-3 hours
Info-Tech Insight
A lack of business participation does not mean your governance initiative is doomed. From this lack, we can still infer their attitudes toward security governance, and we can account for this in our governance model. This may limit the maturity your program can reach, but it doesn't prevent improvements from being made to your current security governance.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
1-2 hours
Using the example on the next slide, complete the following steps:
Note: You may wish to review Info-Tech's governance model templates before completing this activity to get an idea of what you'll be working toward in this step. See slides 37-38.
Download Security Governance Model Tool
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|


1-2 hours
Note: You do not have to use these templates. If you prefer, you can use them as inspiration and design your own model.
Download Security Governance Model Templates
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|

Activities
1.3.1 Develop governance and management KPIs
This step involves the following participants:
Outcomes of this step
Key performance indicators
Design Your Governance Model
Step 1.1 > Step 1.2 > Step 1.3
| Element | Questions |
| Metrics | Does the organization have a well-developed metrics program or will this need to be taken up as a separate effort? Have we considered what outcomes we are hoping to see as a result of implementing a new governance and management model? |
| Existing and emerging threats | What has changed or is likely to change in the future that may destabilize our governance program? What do we need to do to mitigate any security risks to our organizational governance and management? |
The above is a summary of COBIT 2019 EDM01.03 Monitor the governance system, along with Info-Tech-recommended questions to contextualize each element for your organization.
1-2 hours
This activity is meant to provide a starting point for key governance metrics. To develop a comprehensive metrics program, see Info-Tech's Build a Security Metrics Program to Drive Maturity blueprint.
Note: Try to phrase each KPI using percents, which helps to add context to the metric and will make it easier to explain when reporting metrics in the future.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
| Desired Outcome | Success Criteria | Possible KPI |
| Security team is consulted before critical business decisions are made | The business evaluates Security's recommendations before starting new projects | % of critical business decisions with Security consultation |
| Greater alignment over risk appetite | The business does not take on initiatives with excessive security risks | % of incidents stemming from not following Security's risk management recommendations |
| Reduced number of policy exceptions | Policy exceptions are only granted when a clear need is present and a formal process is followed | % of incidents stemming from policy exceptions |
| Improved policy adherence | Policies are understood and followed throughout the organization | % of incidents stemming from policy violations |
Baseline metrics will be improved through:
| Metric | Current | Goal |
| % of critical business decisions with Security consultation | 20% | 100% |
| % of incidents stemming from not following Security's risk management recommendations | 65% | 0% |
| % of incidents stemming from policy exceptions | 35% | 5% |
| % of incidents stemming from policy violations | 40% | 5% |
| % of ad hoc decisions made (i.e. not accounted for by governance model | 85% | 5% |
| % of accepted security risks evaluated against risk appetite | 50% | 100% |
| % of deferred steering committee decisions (i.e. decisions not made ASAP after issue arises) | 50% | 5% |
| % of policies approved within target window (e.g. 1 month) | 20% | 100% |
Phase 1
1.1 Evaluate
1.2 Direct
1.3 Monitor
Phase 2
2.1 Implement Oversight
2.2 Set Risk Appetite
2.3 Implement Policy Lifecycle
This phase will walk you through the following activities:
This phase involves the following participants:
Establish Security Governance & Management
Activities
2.1.1 Draft steering committee charter
2.1.2 Complete steering committee RACI
This step involves the following participants:
Outcomes of this step
Steering Committee Charter and RACI
Implement Essential Governance Processes
Step 2.1 > Step 2.2 > Step 2.3
1-3 hours
This activity is meant to provide a starting point for your steering committee. If a more comprehensive approach is desired, see Info-Tech's Improve Security Governance With a Security Steering Committee blueprint.
Download Information Security Steering Committee Charter
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Example steering committee
CISO
CRO
Internal Audit
CIO
Business Leaders
HR
Legal
| Strategic Oversight | Policy Governance |
|---|---|
|
|
| Risk Governance | Monitoring and Reporting |
|---|---|
|
|
1-3 hours
Note: All tasks must have accountability and responsibility assigned (sometimes a single stakeholder is accountable and responsible). However, not all tasks will have someone consulted or informed.
Download Information Security Steering Committee RACI Chart
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Activities
2.2.1 Draft qualitative risk statements
This step involves the following participants:
Outcomes of this step
Qualitative risk appetite
Implement Essential Governance Processes
Step 2.1 > Step 2.2 > Step 2.3
Setting risk appetite is a key governance function, as it structures how your organization will deal with the risks it will inevitably face - when they can be accepted, when they need to be mitigated, and when they must be rejected entirely.
It is important to note that risk appetite and risk tolerance are not the same. Risk appetite refers to the amount of risk the organization is willing to accept as part of doing business, whereas risk tolerance has more to do with individual risks affecting one or more lines of business that exceed that appetite. Such risks are often tolerated as individual cases that can be mitigated to an acceptable level of risk even though it exceeds the risk-appetite threshold.

1-3 hours
This activity is meant to provide a starting point for risk governance. To develop a comprehensive risk-management program, see Info-Tech's Combine Security Risk Management Components Into One Program blueprint.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Activities
2.3.1 Model your policy lifecycle
2.3.2 Establish exception-approval process
This step involves the following participants:
Outcomes of this step
Policy lifecycle
Exceptions-handling process
Implement Essential Governance Processes
Step 2.1 > Step 2.2 > Step 2.3
1-3 hours
This activity is meant to provide a starting point for policy governance. To develop a comprehensive policy-management program, see Info-Tech's Develop and Deploy Security Policies blueprint.
Download the Security Policy Lifecycle Template
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
The security policy lifecycle is an integral component of the security policy program and adds value by:

Diagram inspired by: ComplianceBridge, 2021
1-3 hours
Download the Security Policy Exception Approval Workflow
Download the Security Policy Exception Tracker
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Before granting an exception:
Sources: University of Virginia; CIS
You have now established a formal governance model for your organization - congratulations! Building this model and determining stakeholders' accountabilities and responsibilities is a big step.
Remember to continue to use the evaluate-direct-monitor framework to make sure your governance model evolves as organizational governance matures and priorities shift.
If you would like additional support, have our analysts guide you through an Info-Tech workshop or Guided Implementation.
Contact your account representative for more information.
workshops@infotech.com
1-888-670-8889
To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
The following are sample activities that will be conducted by Info-Tech analysts with your team:
Build Governance Model
Build a customized security governance model for your organization.
Develop policy lifecycle
Develop a policy lifecycle and exceptions-handling process.
Build an Information Security Strategy
Design a Business-Focused Security Program
Combine Security Risk Management Components Into One Program

Michelle Tran
Consulting Industry
One anonymous contributor
Durbin, Steve. "Achieving The Five Levels Of Information Security Governance." Forbes, 4 Apr. 2023. Accessed 4 Apr. 2023.
Eiden, Kevin, et al. "Organizational Cyber Maturity: A Survey of Industries." McKinsey & Company, 4 Aug. 2021. Accessed 25 Apr. 2023.
"Information Security Exception Policy." Center for Internet Security, 2020. Accessed 14 Apr. 2023.
"Information Security Governance." EDUCAUSE, n.d. Accessed 27 Apr. 2023.
ISACA. COBIT 2019 Framework: Governance and Management Objectives. GF Books, 2018.
Policies & Procedures Team. "Your Policy for Policies: Creating a Policy Management Framework." ComplianceBridge, 30 Apr. 2021. Accessed 27 Apr. 2023.
"Security and the C-Suite: Making Security Priorities Business Priorities." LogRhythm, Feb. 2021. Accessed 25 Apr 2023.
University of Virginia. "Policy, Standards, and Procedures Exceptions Process." Information Security at UVA, 1 Jun. 2022. Accessed 14 Apr. 2023
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Confirm the list of Agile skills that you wish to measure.
Define what it means to attain specific agile skills through a defined ascension path of proficiency levels, and standardized skill expectations.
Determine the roll-out and communication plan that suits your organization.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Learn about and define the Agile skills that are important to your organization.
Define the different levels of attainment when it comes to your Agile skills.
Define the standards on a per-role basis.
Get a clear view of the Agile skills important into meet your Agile transformation goals in alignment with organizational objectives.
Set a clear standard for what it means to meet your organizational standards for Agile skills.
1.1 Review and update the Agile skills relevant to your organization.
1.2 Define your Agile proficiency levels to evaluate attainment of each skill.
1.3 Define your Agile team roles.
1.4 Define common experience levels for your Agile roles.
1.5 Define the skill expectations for each Agile role.
A list of Agile skills that are consistent with your Agile transformation
A list of proficiency levels to be used during your Agile skills assessment
A confirmed list of roles that you wish to measure on your Agile teams
A list of experience levels common to Agile team roles (example: Junior, Intermediate, Senior)
Define the skill expectations for each Agile role
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this research to identify and quantify the potential financial impacts of vendors’ poor performance. Use Info-Tech’s approach to look at the financial impact from various perspectives to better prepare for issues that may arise.
By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

Vendors are becoming more influential and essential to the operation of organizations. Often the sole risk consideration of a business is whether the vendor meets a security standard, but vendors can negatively impact organizations’ budgets in various ways. Fortunately, though inherent risk is always present, organizations can offset the financial impacts of high-risk vendors by employing due diligence in their vendor management practices to help manage the overall risks.
Frank Sewell
Research Director, Vendor Management
Info-Tech Research Group
| Your Challenge
As vendors become more prevalent in organizations, organizations increasingly need to understand and manage the potential financial impacts of vendors’ actions. It is only a matter of time until a vendor mistake impacts your organization. Make sure you are prepared to manage the adverse financial consequences. |
Common Obstacles
Identifying and managing a vendor’s potential financial impact requires multiple people in the organization across several functions – and those people all need educating on the potential risks. Organizational leadership is often unaware of decisions on organizational risk appetite and tolerance, and they assume there are more protections in place against risk impact than there truly are. |
Info-Tech’s Approach
Vendor management practices educate organizations on the different potential financial impacts that vendors may incur and suggest systems to help manage them. Prioritize and classify your vendors with quantifiable, standardized rankings. Prioritize focus on your high-risk vendors. Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool. |
Companies without good vendor management risk initiatives will take on more risk than they should. Solid vendor management practices are imperative –organizations must evolve to ensure that vendors deliver services according to performance objectives and that risks are managed accordingly.

This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.
Out of scope:
This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.
In this blueprint, we’ll explore financial risks and their impacts.
Identifying negative actions is paramount to assessing the overall financial impact on your organization, starting in the due diligence phase of the vendor assessment and continuing throughout the vendor lifecycle.

Loss of business represents the largest share of the breach
38%Avg. $1.59M |
Global average cost of a vendor breach
$4.2M |
Percentage of breaches in 2020 caused by business associates
40.2%23.2% YoY(year over year) |
| (Source: “Cost of a Data Breach Report 2021,” IBM, 2021) | (Source: “Vendor Risk Management – A Growing Concern,” Stern Security, 2021) | |
Hospitals often rely on vendors to manage their data center environments but rarely understand the downstream financial impacts if that vendor fails to perform.
For example, a vendor implements a patch out of cycle with no notice to the IT group. Suddenly all IT systems are down. It takes 12 hours for the IT teams to return systems to normal. The downstream impacts are substantial.
Assessing financial impacts is an ongoing, educative, and collaborative multidisciplinary process that vendor management initiatives are uniquely designed to coordinate and manage for organizations.
| Insight 1 | Vendors are becoming more and more crucial to organizations’ overall operations, and most organizations have a poor understanding of the potential impacts they represent.
Is your vendor solvent? Do they have enough staff to accommodate your needs? Has their long-term planning been affected by changes in the market? Are they unique in their space? |
| Insight 2 | Financial impacts from other risk types deserve just as much focus as security alone, if not more.
Examples include penalties and fines, loss of revenue due to operational impacts, vendor replacement costs, hidden costs in poorly understood contracts, and lack of contractual protections. |
| Insight 3 | There is always an inherent risk in working with a vendor, but organizations should financially quantify how much each risk may impact their budget.
A significant concern for organizations is quantifying different types of risks. When a risk occurs, the financial losses are often poorly understood, with unbudgeted financial impacts. |
Inherent risks from negative actions are pervasive throughout the entire vendor lifecycle. Collaboratively understanding those risks and working together to put proper management in place enables organizations to get the most value out of the relationship with the least amount of risk.

|
Visit Info-Tech’s VMO ROI Calculator and Tracker |
Input: List of identified potential risk scenarios scored by likelihood and financial impact, List of potential management of the scenarios to reduce the risk
Output: Comprehensive financial risk profile on the specific vendor solution
Materials: Whiteboard/flip charts, Financial Risk Impact Tool to help drive discussion
Participants: Vendor Management – Coordinator, IT Operations, Legal/Compliance/Risk Manager, Finance/Procurement
Vendor management professionals are in an excellent position to collaboratively pull together resources across the organization to determine potential risks. By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.
Download the Financial Risk Impact Tool
Never underestimate the value of keeping the relationship moving forward.Examples of items and activities to monitor include; | ![]() | |
|
| |
Info-Tech InsightMany organizations do not have the resources to dedicate to annual risk assessments of all vendors. Consider timing ongoing risk assessments to align with contract renewal, when you have the most leverage with the vendor. | Visit Info-Tech’s Risk Register Tool | |
|
![]() |
|
![]() |
![]() |
Design and Build an Effective Contract Lifecycle Management Process
|
![]() |
Identify and Reduce Agile Contract Risk
|
![]() |
Jump Start Your Vendor Management Initiative
|
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Assess whether you’re ready to optimize the service desk with a shift-left strategy, get buy-in for the initiative, and define metrics to measure success.
Build strategy and identify specific opportunities to shift service support left to Level 1 through knowledge sharing and other methods, to the end-user through self-service, and to automation and AI.
Identify, track, and implement specific shift-left opportunities and document a communications plan to increase adoption.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Define how shift left would apply in your organization, get buy-in for the initiative, and define metrics to measure success.
Defined scope and objectives for the shift-left initiative
Buy-in for the program
Metrics to keep the project on track and evaluate success
1.1 Review current service desk structure
1.2 Discuss challenges
1.3 Review shift-left model and discuss how it would apply in your organization
1.4 Complete the Shift-Left Prerequisites Assessment
1.5 Complete a RACI chart for the project
1.6 Define and document objectives
1.7 Review the stakeholder buy-in presentation
1.8 Document critical success factors
1.9 Define KPIs and metrics
Shift-left scope
Completed shift-left prerequisites assessment
RACI chart
Defined objectives
Stakeholder buy-in presentation
Critical success factors
Metrics to measure success
Build strategy and identify specific opportunities to shift service support left to Level 1 through knowledge sharing and other methods.
Identified initiatives to shift work to Level 1
Documented knowledge management process workflows and strategy
2.1 Identify barriers to Level 1 resolution
2.2 Discuss knowledgebase challenges and areas for improvement
2.3 Optimize KB input process
2.4 Optimize KB usage process
2.5 Optimize KB review process
2.6 Discuss and document KCS strategy and roles
2.7 Document knowledge success metrics
2.8 Brainstorm additional methods of increasing FLR
KB input workflow
KB usage workflow
KB review workflow
KCS strategy and roles
Knowledge management metrics
Identified opportunities to shift to Level 1
Build strategy and identify specific opportunities to shift service support left to the end user through self-service and to automation and AI.
Identified initiatives to shift work to self-service and automation
Evaluation of self-service portal and identified opportunities for improvement
3.1 Review existing self-service portal and discuss vision
3.2 Identify opportunities to improve portal accessibility, UI, and features
3.3 Evaluate the user-facing knowledgebase
3.4 Optimize the ticket intake form
3.5 Document plan to improve, communicate, and evaluate portal
3.6 Map the user experience with a workflow
3.7 Document your AI strategy
3.8 Identify candidates for automation
Identified opportunities to improve portal
Improvements to knowledgebase
Improved ticket intake form
Strategy to communicate and measure success of portal
Self-service resolution workflow
Strategy to apply AI and automation
Identified opportunities to shift tasks to automation
Build an action plan to implement shift left, including a communications strategy.
Action plan to track and implement shift-left opportunities
Communications plan to increase adoption
4.1 Examine process workflows for shift-left opportunities
4.2 Document shift-left-specific responsibilities for each role
4.3 Identify and track shift-left opportunities in the action plan
4.4 Brainstorm objections and responses
4.5 Document communications plan
Incident management workflow with shift-left opportunities
Shift left responsibilities for key roles
Shift-left action plan
Objection handling responses
Communications plan
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Describe your application vision and set the right modernization expectations with your stakeholders.
Focus your modernization efforts on the business opportunities that your stakeholders care about.
Describe your modernization initiatives and build your modernization tactical roadmap.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discuss the goals of your application modernization initiatives
Define your digital application vision and priorities
List your modernization principles
Clear application modernization objectives and high priority value items
Your digital application vision and attributes
Key principles that will guide your application modernization initiatives
1.1 State Your Objectives
1.2 Characterize Your Digital Application
1.3 Define Your Modernization Principles
Application modernization objectives
Digital application vision and attributes definitions
List of application modernization principles and guidelines
Identify the value streams and business capabilities that will benefit the most from application modernization
Conduct a change tolerance assessment
Build your modernization strategic roadmap
Understanding of the value delivery improvements modernization can bring
Recognizing the flexibility and tolerance of your organization to adopt changes
Select an approach that best fits your organization’s goals and capacity
2.1 Identify the Opportunities
2.2 Define Your Modernization Approach
Value streams and business capabilities that are ideal modernization opportunities
Your modernization strategic roadmap based on your change tolerance and modernization approach
Identify the most appropriate modernization technique and the scope of changes to implement your techniques
Develop an actionable tactical roadmap to complete your modernization initiatives
Clear understanding of what must be changed to the organization and application considering your change tolerance
An achievable modernization plan
3.1 Shortlist Your Modernization Techniques
3.2 Roadmap Your Modernization Initiatives
Scope of your application modernization initiatives
Your modernization tactical roadmap
The most successful organizations recognize that learning is critical to adjusting quickly and effectively to their new reality. This requires L&D to reimagine their approach to deliver learning that enables the organization’s immediate and evolving priorities.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Involve key stakeholders, identify immediate priorities, and conduct high-level triage of L&D.
Determine learning needs and ability to realistically deliver learning. Leverage existing or curate learning content that can support learning needs.
Identify technical requirements for the chosen delivery method and draft a four- to six-week action plan.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Evaluate and understand your current SQA capabilities, as well as the degree to which metric objectives are being met.
Identify and define SQA processes and metrics needed to meet quality objectives set by development teams and the business.
Build your SQA plan and optimization roadmap.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
To help you assess and understand your current SQA capabilities as well as the degree to which metric objectives are being met.
An analysis of current SQA practices to provide insight into potential inefficiencies, opportunities, and to provide the business with sufficient rationale for improving current quality assurance initiatives.
1.1 Conduct a high-level assessment of where to focus your current state analysis.
1.2 Document your high-level development process.
1.3 Create a RACI chart to understand roles and responsibilities.
1.4 Perform a SIPOC-MC analysis for problem areas identified in your SDLC.
1.5 Identify the individual control points involved with passing software artifacts through SDLC stages being assessed.
1.6 Identify problem areas within your SDLC as they relate to SQA.
Understanding of current overall development process and where it is most weak in the context of quality assurance
Understanding of assigned roles and responsibilities across development teams, including individuals who are involved with making quality-related decisions for artifact hand-off
Identification of problem areas within SQA process for further analysis
To help you identify and define SQA processes and metrics needed to meet quality objectives set out by development teams and the business.
A revised list of key SQA tasks along with metrics and associated tolerance limits used universally for all development projects.
2.1 Establish SQA metrics and tolerance limits across your SDLC.
2.2 Determine your target state for SQA processes within the define/design stage of the SDLC.
2.3 Determine your target state for SQA processes within the development stage of the SDLC.
2.4 Determine your target state for SQA processes within the testing stage of the SDLC.
2.5 Determine your target state for SQA processes within the deploy/release stage of the SDLC.
Identification of the appropriate metrics and their associated tolerance limits to provide insights into meeting quality goals and objectives during process execution
Identification of target state SQA processes that are required for ensuring quality across all development projects
Based on discovered inefficiencies, define optimization initiatives required to improve your SQA practice.
Optimization initiatives and associated tasks required to address gaps and improve SQA capabilities.
3.1 Determine optimization initiatives for improving your SQA process.
3.2 Gain the full scope of effort required to implement your SQA optimization initiatives.
3.3 Identify the enablers and blockers of your SQA optimization.
3.4 Define your SQA optimization roadmap.
Prioritized list of optimization initiatives for SQA
Assessment of level of effort for each SQA optimization initiative
Identification of enablers and blockers for optimization initiatives
Identification of roadmap timeline for implementing optimization initiatives
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This is a story that should make you perk up.
I know of a department that was eager to launch their new product. The strain was severe. The board was breathing down their necks. Rivals were catching up (or so they thought).
"Let's get this thing live, prove the market wants it, then we'll circle back and handle all the security and stability backlog items." For the product owner, at the time, that seemed the right thing to do.
They were hacked 48 hours after going live.
Customer information was stolen. The brand's reputation suffered. The decision led to a months-long legal nightmare. And they still had to completely rebuild the system. Making stability and security bolt-on items is never a good idea.
See, I understand. When the product owner is pressing for user experience enhancements and you're running out of time for launch, it's easy to overlook those "non-functional requirements." Yet, we should avoid blaming the product owner. The PO is under pressure from many stakeholders, and a delayed launch may also come with significant costs.
Load balancing isn't visible to customers, after all. Penetration testing doesn't excite them. Failure mechanisms don't matter to them. This statement is true until a malfunction impacts a client. Then it suddenly becomes the most important thing in the world.
However, I know that ignoring non-functional requirements (NFRs) can lead to failed businesses (or business lines). This elevates these issues beyond mere technical inconveniences. NFRs are designed with the client in mind.
Look at it this way. When your system crashes during periods of high traffic, how does the user experience change? How satisfied are customers when their personal information is stolen? When it takes 30 seconds for your website to load, how does that conversion rate look?
Let me expose you to some consultant figures. The average cost of IT outages is $5,600 per minute, according to a 2014 Gartner study. That figure can rise to $300,000 per hour for larger businesses. The reality is that in your department, you will rarely reach these numbers. When we look at current (2020-2025) and expected (2026) trends, the typical operational loss numbers in international commercial banking or insurance are closer to 100K for high-impact incidents that are handled within 2–3 hours.
Obviously, your numbers will vary. And if you don't know what your costs are, now would be a good time to discover that. This does not imply that you should simply accept the risks associated with such situations. You must fix or mitigate such opportunities for hackers to get in. Do so at the appropriate cost for your business.
Data breaches are a unique phenomenon. According to IBM's Cost of a Data Breach Report 2025, a data breach typically costs $4.44 million, and detecting and containing it takes an average of 241 days. Some preview data from the 2025 report include that 97% of organizations that reported on the study indicated that they lacked access controls for their AI systems. That means that many companies don't even have the basics in order. And AI-related breaches are just going to accelerate. AI security defenses will help lower the cost of such breaches.
Despite the decreasing cost of these breaches, I anticipate an increase in their frequency in the upcoming years.
This means that non-functional requirements in terms of security and resilience should take a more prominent place in the prioritizations. Your client depends on your systems being safe, resilient, and performant.
And yet, this is where some leaders make mistakes. I have the impression they believe that client-focused design means more functionality and elegant interfaces. They prioritize user experience enhancements over system reliability.
I want to share a key fact that distinguishes successful businesses: customers desire more than just a good product. It must always function for them. And that means following certain procedures. They are not there to hamper you; they are there to retain customers.
88% of online shoppers are less likely to visit a website again after a negative experience, according to research from Forrester. Amazon found that they lose 1% of sales for every 100 ms of latency. That 100 milliseconds adds up to millions of lost profits when billions of dollars are at stake.
You run the risk of more than just technical difficulties when you deprioritize safety. Customer trust, revenue stability, competitive advantage, adherence to the law, costs, and team morale are all at stake.
Allow me to illustrate what I see happening during development cycles.
The team tests the happy flow. The user successfully logs in. The user navigates with ease. The user makes the purchase without any problems. The user logs off without incident.
"Excellent! Publish it!"
However, what occurs if 1000 users attempt to log in at once? What occurs if an attempt is made to insert malicious code into your contact form? During a transaction, what happens if your database connection fails?
These are not extreme situations. These are real-life occurrences.
Fifty percent of data center managers and operators reported having an impactful outage in the previous three years, according to the Uptime Institute's 2025 Global Data Center Survey. Note that this is at the infra level. The biggest contributor is power outages. What role does power play in ensuring a smooth flow? Power will not always flow as you want it, so plan for lack of power and for spikes.
With regard to software failures, the spread of possible causes widens. AI is a big contributor. AI is typically brought in to accelerate development and assist in coding. But it tends to introduce subtle bugs and vulnerabilities that a seasoned developer has to review and solve.
Another upcoming article will discuss how faster release cycles often lead to a rush in testing. This should not be the case; by spending some time automating your (non-)regression test bank, you will gain speed. But you have to invest time in building the test suite.
Can your system handle success? This question should keep every executive awake at night.
I've witnessed businesses invest millions in advertising campaigns to drive traffic to systems that fail due to their success. Consider describing to your board how your greatest marketing victory became your worst operational mishap.
Managing traffic spikes is only one aspect of load balancing. It is about ensuring that your business can handle opportunities without being overwhelmed.
Let's now address the most pressing issue: security.
The majority of leaders consider security to be like insurance, something you hope you never need. The fact that security is more than just protection, however, will alter the way you approach every project. It's approval to develop.
According to the Ponemon Institute's 2025 Cost of Insider Threats Global Report, the average annualized cost of insider threats, defined as employee negligence, criminal insiders, and credential thieves, has risen to $17.4 million per incident, up from $15.4 million in 2022. The number of discovered and analyzed incidents increased from 3,269 in 2018 to 7,868 in 2025 research studies.
Cybersecurity Ventures predicts that cybercrime will cost the global economy $10.5 trillion annually by 2025.
The most fascinating thing, though, is that companies that invest in proactive security see measurable outcomes. Organizations that allocate over 10% of their IT budget to cybersecurity have a 2.5-fold higher chance of experiencing no security incidents than those that allocate less than 1%, per Deloitte's Future of Cyber Survey.
By hardening your systems against common attack vectors, you can scale quickly without worrying about the future. You can handle sensitive data with confidence, enter new markets without fear, establish partnerships that require trust, and focus on innovation instead of crisis management.
Allow me to explain this in a way that will satisfy your CFO.
Retention is equal to reliability. Customers return when a system functions reliably (given you sell items they want). The Harvard Business Review claims that a 5% increase in customer retention rates boosts profits by 25% to 95%. It is five to twenty-five times less expensive to retain customers than to acquire new ones.
Scalability is equal to security. Secure systems can handle larger client volumes, more sensitive data, and higher-value transactions. 69% of board members and C-suite executives think that privacy and cyber risks could affect their company's ability to grow, according to PwC.
Profit is equal to performance. You lose conversions for every second of load time. Google discovered that the likelihood of a bounce rises by 32% as page load time increases from 1 to 3 seconds. It increases by 90% from 1 second to 5 seconds. Walmart discovered that every second improvement in page load time led to a 2% increase in conversions.
Reputation is equal to resilience. Guess which company benefits when your system works while your competitors' systems fail? Failures reduce trust. 71% of consumers will actively advocate against companies they don't trust, and 67% of consumers will stop purchasing from them, according to Edelman's 2023 Trust Barometer. While the 2025 report does not present comparative numbers, distrust impacting consumer behavior is likely to be even more prevalent.
Reframe this discussion with your executives and team
The numbers support this point. Businesses that invest in operational resilience see three times higher profit margins and 2.5 times higher revenue growth than their counterparts, according to McKinsey's 2023 State of Organizations report. In 2025 we see a focus on AI, but the point remains.
These metrics will grab the attention when you're presenting them.
Although the average cost of downtime varies by industry, it is always high.
The impact of a security breach on customer lifetime value is equally uncomfortable. Following a data breach, 78% of consumers will cease interacting with a brand online, and 36% will never do so again, according to Ping Identity's 2023 Consumer Identity Breach Report.
Every second that the system is unavailable results in a rapidly mounting loss of money. That's about $3,170 per minute of full downtime for a business that makes $100 million a year. We're talking about $31,700 per minute for billion-dollar businesses. Again, your experience may differ, but it's important to note that this cost is often unseen yet undeniable. If you want to calculate this more granularly, then I have a calculation method for you that is easy to implement.
There is a discernible trend in the cost of rebuilding versus building correctly the first time. Resolving a problem in production can cost four to five times as much as fixing it during design, and it can cost up to 100 times as much as fixing it during the requirements and design phase, according to IBM's Systems Sciences Institute.
This is what you should do right away.
Please begin by reviewing your current primary systems. When they're under stress, what happens? What occurs if they are attacked? What occurs if they don't work? 40% of businesses that suffer a significant system failure never reopen, although only 23% of organizations have tested their disaster recovery plans in the previous year, according to Gartner. Companies we work with test their systems at least once per year. If the results are unsatisfactory, we conduct a retest to ensure they meet our standards.
Next, please determine the actual cost of addressing issues at a later stage. Add in the costs of customer attrition, security breaches, downtime, and reconstruction. To lend credibility to your calculations, try to work out exact numbers for your company. Industry standards (like in this article) will give you indicators, but you need to know your figures.
Third, recast your non-functional needs as business needs. Consider focusing on strategies for managing success rather than solely discussing load balancing. Instead of discussing security testing, focus on revenue protection.
Fourth, consider safety when defining "done." Until a feature is dependable, secure, and scalable, it isn't considered complete. Projects that incorporate non-functional requirements from the outset have a threefold higher chance of success, per the Standish Group's 2023 Chaos Report.
Fifth, use system dependability as a differentiator in the marketplace. You're up when your rivals are down. You're safe when they're compromised.
I understand that resilience isn't sexy. I am aware that UI enhancements are more exciting than infrastructure resilience.
And yet, I know that businesses that prioritize safety will survive and lead after seeing others thrive and fail based on this one choice. Customers trust them. They are capable of scaling without breaking. Because they are confident that their systems can manage whatever comes next, they are the ones who get a good night's sleep.
Resilient organizations are twice as likely to surpass customer satisfaction goals and are 2.5 times more likely to achieve revenue growth of 10% or more.
Resilience represents the most significant competitive advantage. You have a choice. Just keep in mind that your clients are depending on you to do the job correctly.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Read our executive brief to understand our approach to SDLC optimization and why we advocate a holistic approach for your company.
This phase helps you understand your business goals and priorities. You will document your current SDLC process and find where the challenges are.
Prioritize your initiatives and formalize them in a roll-out strategy and roadmap. Communicate your plan to all your stakeholders.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Standardize your product quality definition and your QA roles, processes, and guidelines according to your business and IT priorities.
Build a solid set of good practices to define your defect tolerances, recognize the appropriate test coverage, and communicate your test results.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discuss your quality definition and how quality is interpreted from both business and IT perspectives.
Review your case for strengthening your QA practice.
Review the standardization of QA roles, processes, and guidelines in your organization.
Grounded understanding of quality that is accepted across IT and between the business and IT.
Clear QA roles and responsibilities.
A repeatable QA process that is applicable across the delivery pipeline.
1.1 List your QA objectives and metrics.
1.2 Adopt your foundational QA process.
Quality definition and QA objectives and metrics.
QA guiding principles, process, and roles and responsibilities.
Discuss the practices to reveal the sufficient degree of test coverage to meet your acceptance criteria, defect tolerance, and quality definition.
Review the technologies and tools to support the execution and reporting of your tests.
QA practices aligned to industry good practices supporting your quality definition.
Defect tolerance and acceptance criteria defined against stakeholder priorities.
Identification of test scenarios to meet test coverage expectations.
2.1 Define your defect tolerance.
2.2 Model and prioritize your tests.
2.3 Develop and execute your QA activities.
2.4 Communicate your QA activities.
Defect tolerance levels and courses of action.
List of test cases and scenarios that meet test coverage expectations.
Defined test types, environment and data requirements, and testing toolchain.
Test dashboard and communication flow.
Effective service metrics will provide the following service gains:
Which will translate into the following relationship gains:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify the appropriate service metrics based on stakeholder needs.
Present the right metrics in the most interesting and stakeholder-centric way possible.
Run a pilot with a smaller sample of defined service metrics, then continuously validate your approach and make refinements to the processes.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Define stakeholder needs for IT based on their success criteria and identify IT services that are tied to the delivery of business outcomes.
Derive meaningful service metrics based on identified IT services and validate that metrics can be collected and measured.
Design meaningful service metrics from stakeholder needs.
Validate that metrics can be collected and measured.
1.1 Determine stakeholder needs, goals, and pain points.
1.2 Determine the success criteria and related IT services.
1.3 Derive the service metrics.
1.4 Validate the data collection process.
1.5 Validate metrics with stakeholders.
Understand stakeholder priorities
Adopt a business-centric perspective to align IT and business views
Derive meaningful business metrics that are relevant to the stakeholders
Determine if and how the identified metrics can be collected and measured
Establish a feedback mechanism to have business stakeholders validate the meaningfulness of the metrics
Determine the most appropriate presentation format based on stakeholder needs.
Ensure the metrics are presented in the most interesting and stakeholder-centric way possible to guarantee that they are read and used.
2.1 Understand the different presentation options.
2.2 Assess stakeholder needs for information.
2.3 Select and design the metric report.
Learn about infographic, scorecard, formal report, and dashboard presentation options
Determine how stakeholders would like to view information and how the metrics can be presented to aid decision making
Select the most appropriate presentation format and create a rough draft of how the report should look
Run a pilot with a smaller sample of defined service metrics to validate your approach.
Make refinements to the implementation and maintenance processes prior to activating all service metrics.
High user acceptance and usability of the metrics.
Processes of identifying and presenting metrics are continuously validated and improved.
3.1 Select the pilot metrics.
3.2 Gather data and set initial targets.
3.3 Generate the reports and validate with stakeholders.
3.4 Implement the service metrics program.
3.5 Track and maintain the metrics program.
Select the metrics that should be first implemented based on urgency and impact
Complete the service intake form for a specific initiative
Create a process to gather data, measure baselines, and set initial targets
Establish a process to receive feedback from the business stakeholders once the report is generated
Identify the approach to implement the metrics program across the organization
Set up mechanism to ensure the success of the metrics program by assessing process adherence and process validity
“Service metrics are one of the key tools at IT’s disposal in articulating and ensuring its value to the business, yet metrics are rarely designed and used for that purpose.
Creating IT service metrics directly from business and stakeholder outcomes and goals, written from the business perspective and using business language, is critical to ensuring that the services that IT provides are meeting business needs.
The ability to measure, manage, and improve IT service performance in relation to critical business success factors, with properly designed metrics, embeds IT in the value chain of the business and ensures IT’s focus on where and how it enables business outcomes.”
Valence Howden,
Senior Manager, CIO Advisory
Info-Tech Research Group
This Research Is Designed For:
|
This Research Will Help You:
|
This Research Will Also Assist:
|
This Research Will Help Them
|
What are service metrics?Service metrics measure IT services in a way that relates to a business outcome. IT needs to measure performance from the business perspective using business language. |
Why do we need service metrics?
To ensure the business cares about the metrics that IT produces, start with business needs to make sure you’re measuring the right things. This will give IT the opportunity talk to the right stakeholders and develop metrics that will meet their business needs. Service metrics are designed with the business perspective in mind, so they are fully aligned with business objectives. |
| Perspectives Matter
Different stakeholders will require different types of metrics. A CEO may require metrics that provide a snapshot of the critical success of the company while a business manager is more concerned about the performance metrics of their department. |
What are the benefits of implementing service metrics?
Service metrics help IT communicate with the business in business terms and enables IT to articulate how and where they provide business value. Business stakeholders can also easily understand how IT services contribute to their success. |
| A significantly higher proportion of CIOs than CEOs feel that there is significant improvement necessary for business value metrics and stakeholder satisfaction reporting. | N=364
|
|
When considering only CEOs who said that stakeholder satisfaction reporting needed significant improvement, the average satisfaction score goes down to 61.6%, which is a drop in satisfaction of 12%.
|
| When the CIOs believe business value metrics weren’t required, 50% of their CEOs said that significant improvements were necessary.
|
|
A business process consists of multiple business activities. In many cases, these business activities require one or more supporting IT services.
|
For each business process, business stakeholders and their goals and objectives should be identified.
For each business activity that supports the completion of a business process, define the success criteria that must be met in order to produce the desirable outcome. Identify the IT services that are used by business stakeholders for each business activity. Measure the performance of these services from a business perspective to arrive at the appropriate service metrics. |
Stakeholders have different goals and objectives; therefore, it is critical to identify what type of metrics should be presented to each stakeholder.
Business Metrics
Determine Business SuccessBusiness metrics are derived from a pure business perspective. These are the metrics that the business stakeholders will measure themselves on, and business success is determined using these metrics. |
|
Service Metrics
Manage Service Value to the BusinessService metrics are used to measure IT service performance against business outcomes. These metrics, while relating to IT services, are presented in business terms and are tied to business goals. |
|
IT Metrics
Enable Operational ExcellenceIT metrics are internal to the IT organization and used to manage IT service delivery. These metrics are technical, IT-specific, and drive action for IT. They are not presented to the business, and are not written in business language. |
At the very least, IT needs to have a service-oriented view and understand the specific needs and objectives associated with each stakeholder.
Once IT can present service metrics that the business cares about, it can continue on the service provider journey by managing the performance of services based on business needs, determine and influence service demand, and assess service value to maximize benefits to the business.
|
Business Relationship ManagementBRM works to understand the goals and objectives of the business and inputs them into the design of the service metrics. Service MetricsBRM leverages service metrics to help IT organizations manage the relationship with the business. BRM articulates and manages expectations and ensures IT services are meeting business requirements. |
![]() | Service Level ManagementSLM works with the business to understand service requirements, which are key inputs in designing the service metrics. Service MetricsSLM leverages service metrics in overseeing the day-to-day delivery of IT services. It ensures they are provided to meet expected service level targets and objectives. |
Effective service metrics will provide the following service gains:
Conventional Wisdom |
Info-Tech Perspective |
| Metrics are measured from an application or technology perspective | Metrics need to be derived from a service and business outcome perspective. |
| The business doesn’t care about metrics | Metrics are not usually designed to speak in business terms about business outcomes. Linking metrics to business objectives creates metrics that the business cares about. |
| It is difficult to have a metrics discussion with the business | It is not a metrics/number discussion, it is a discussion on goals and outcomes. |
| Metrics are only presented for the implementation of the service, not the ongoing outcome of the service | IT needs to focus on service outcome and not project outcome. |
| Quality can’t be measured | Quality must be measured in order to properly manage services. |
1 |
2 |
3 |
| Design Your Metrics | Develop and Validate Reporting | Implement, Track, and Maintain |
|
|
|
| Start the development and creation of your service metrics by keeping business perspectives in mind, so they are fully aligned with business objectives. | Identify the most appropriate presentation format based on stakeholder preference and need for metrics. | Track goals and success metrics for your service metrics programs. It allows you to set long-term goals and track your results over time. |
The CIO must actively demonstrate support for the service metrics program and lead the initial discussions to determine what matters to business leaders.
It is critical to determine if the designed service metrics are fulfilling their intended purpose. The process of maintaining the service metrics program and the outcomes of implementing service metrics need to be monitored and tracked.
| Validating Service Metrics Design | |
Target Outcome |
Related Metrics |
| The business is enabled to identify and improve service performance to their end customer | # of improvement initiatives created based on service metrics $ cost savings/revenue generated due to actions derived from service metrics |
|
Procedure to validate the usefulness of IT metrics |
# / % of service metrics added/removed per year |
| Alignment between IT and business objectives and processes | Business’ satisfaction with IT |
It is critical to determine if the designed service metrics are fulfilling their intended purpose. The process of maintaining the service metrics program and the outcomes of implementing service metrics need to be monitored and tracked.
| Validating Service Metrics Process | |
Target Outcome | Related Metrics |
| Properly defined service metrics aligned with business goals/outcomes Easy understood measurement methodologies | % of services with (or without) defined service metrics % of service metrics tied to business goals |
| Consistent approach to review and adjust metrics | # of service metrics adjusted based on service reviews % of service metrics reviewed on schedule |
In a study done by the Aberdeen Group, organizations engaged in the use of metrics benchmarking and measurement have:
|
A service metric is defined for: “Response time for Business Application A”
The expected response time has not been achieved and this is visible in the service metrics. The reduced performance has been identified as having an impact of $250,000 per month in lost revenue potential. The service metric drove an action to perform a root-cause analysis, which identified a network switch issue and drove a resolution action to fix the technology and architect redundancy to ensure continuity. The fix eliminated the performance impact, allowing for recovery of the $250K per month in revenue, improved end-user confidence in the organization, and increased use of the application, creating additional revenue. |
| CASE STUDY |
Industry: Manufacturing | Source: CIO interview and case material |
| Situation
The manufacturing business operates within numerous countries and requires a lot of coordination of functions and governance oversight. The company has monthly meetings, both regional and national, and key management and executives travel to attend and participate in the meetings. ComplicationWhile the meetings provide a lot of organizational value, the business has grown significantly and the cost of business travel has started to become prohibitive. ActionIt was decided that only a few core meetings would require onsite face-to-face meetings, and for all other meetings, the company would look at alternative means. The face-to-face aspect of the meetings was still considered critical so they focused on options to retain that aspect. The IT organization identified that they could provide a video conferencing service to meet the business need. The initiative was approved and rolled out in the organization. |
Result:IT service metrics needed to be designed to confirm that the expected value outcome of the implementation of video conferencing was achieved. Under the direction of the CIO, the business goals and needs driving use of the service (i.e. reduction in travel costs, efficiency, no loss of positive outcome) were used to identify success criteria and key questions to confirm success. With this information, the service manager was able to implement relevant service metrics in business language and confirmed an 80% adoption rate and a 95% success rate in term meetings running as expected and achieving core outcomes. |
Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.
This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.
This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
| 1. Design the Metrics | 2. Design Reports and Dashboards | 3. Implement, Track, and Maintain | |
Best-Practice Toolkit |
|
|
|
Guided Implementations |
|
|
|
Onsite Workshop |
Module 1: Derive Service Metrics From Business Goals |
Module 2: Select and Design Reports and Dashboards |
Module 3: Implement, Track, and Maintain Your Metrics to Ensure Success |
Phase 1 Outcome:
|
Phase 2 Outcome:
|
Phase 3 Outcome:
|
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | |
Design the Metrics |
Determine Presentation Format and Implement Metrics |
Gather Service Level Requirements |
Monitor and Improve Service Levels |
|
Activities |
|
|
|
|
Deliverables |
|
|
|
|
| PHASE 1 | PHASE 2 | PHASE 3 | ||
1.1Derive the Service Metrics |
1.2Validate the Metrics |
2.1Determine Reporting Format |
3.1Select Pilot Metrics |
3.2Activate and Maintain Metrics |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 1.1: Design Metrics | Step 1.2: Validate the Metrics |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
|
Step 1 Derive your service metrics Metrics Worksheet |
|
Step 2 Validate your metrics Metrics Worksheet |
|
Step 3 Confirm with stakeholders Metrics Tracking Sheet |
Defined IT Service Metrics |
| Service metrics must be designed with the business perspective in mind so they are fully aligned with business objectives.
Thus, IT must start by identifying specific stakeholder needs. The more IT understands about the business, the more relevant the metrics will be to the business stakeholders. |
|
1.1 Metrics Development Workbook
This workbook guides the development and creation of service metrics that are directly tied to stakeholder needs.
This process will ensure that your service metrics are designed with the business perspective in mind so they are fully aligned with business objectives.
Download the Metrics Development Workbook. |
|
1.1 0.5 Hour
Who are your stakeholders?
|
Video Conferencing Case Study For this phase, we will demonstrate how to derive the service metrics by going through the steps in the methodology. At a manufacturing company, the CIO’s main stakeholder is the CEO, whose chief concern is to improve the financial position of the company. |
1.2 0.5 Hour
What are their goals and pain points?
|
VC Case Study One of the top initiatives identified by the company to improve financial performance was to reduce expense. Because the company has several key locations in different states, company executives used to travel extensively to carry out meetings at each location. Therefore, travel expenses represent a significant proportion of operational expenses and reducing travel costs is a key goal for the company’s executives. |
1.3 0.5 HourWhat do the stakeholders need to know?
| VC Case Study The CEO needs to have assurance that without executives traveling to each location, remote meetings can be as effective as in-person meetings. These meetings must provide the same outcome and allow executives to collaborate and make similar strategic decisions without the onsite, physical presence. Therefore, the success criteria are:
|
1.4 1 HourWhat does IT need to measure?
| VC Case Study The IT department decides to implement the video conferencing service to reduce the number of onsite meetings. This technology would allow executives to meet remotely with both audio and video and is the best option to replicate a physical meeting. The service is initially available to senior executives and will be rolled out to all internal users once the initial implementation is deemed successful. To determine the success of the service, the following needs to be measured:
|
1.5 0.5 HourDerive your service metrics
| VC Case Study In the previous step, IT identified that it must measure the outcomes of VC meetings, quality of the VC meetings, and the reduction in travel expenses. From these, the appropriate service metrics can be derived to answer the needs of the CEO. IT needs to measure:
IT also identified the following business metrics:
|
| Can you measure it? | The first question IT must answer is whether the metric is measurable. IT must identify the data source, validate its ability to collect the data, and specify the data requirement. Not all metrics can be measured! |
| How will you measure it? | If the metric is measurable, the next step is to create a way to measure the actual data. In most cases, simple formulas that can be easily understood are the best approach. |
| Define your actions | Metrics must be used to drive or reinforce desirable outcomes and behaviors. Thus, IT must predetermine the necessary actions associated with the different metric levels, thresholds, or trends. |
1.6 0.5 HourINSTRUCTIONS
| VC Case Study Using the metric derived from the video conferencing service example, IT wants to measure the % of VC meetings successfully delivered. What are the data sources?
|
1.6 0.5 HourINSTRUCTIONS
| VC Case Study Data requirement for percent of successful VC meetings:
|
1.7 0.5 HourINSTRUCTIONS
| VC Case Study Metric: Percent of VC meetings delivered successfully IT is able to determine the total number of VC meetings that took place and the number of VC service requests to the help desk. That makes it possible to use the following formula to determine the success percentage of the VC service: ((total # VC) – (# of VC with identified incidents)) / (total # VC) * 100 |
1.7 1.5 HourINSTRUCTIONSCentered on the defined metrics and their calculations, IT can decide on the actions that should be driven out of each metric based on one of the following scenarios:
| VC Case Study If the success rate of the VC meetings is below 90%, IT needs to focus on determining if there is a common cause and identify if this is a consistent downward trend. A root-cause analysis is performed that identifies that network issues are causing difficulties, impacting the connection quality and usability of the VC service. |
1.8 1 Hour
INPUT: Selected service metrics, Discussion with the business
OUTPUT: Validated metrics with the business
Materials: Metrics with calculation methodology
Participants: IT and business stakeholders, Service owners
| Service Metric | Corresponding Business Goal |
Measurement Method |
Defined Actions |
| Who are IT’s stakeholders? | The financial institution provides various banking solutions to its customers. Retail banking is a core service offered by the bank and the VP of retail banking is a major stakeholder of IT. |
| What are their goals and pain points? | The VP of retail banking’s highest priorities are to increase revenue, increase market share, and maintain the bank’s brand and reputation amongst its customers. |
| What do they need to know? | In order to measure success, the VP of retail banking needs to determine performance in attracting new clients, retaining clients, expanding into new territory, and whether they have increased the number of services provided to existing clients. |
| What does IT need to measure? | The recent implementation of an online banking service is a key initiative that will keep the bank competitive and help retail banking meet its goals. The key indicators of this service are: the total number of clients, the number of products per client, percent of clients using online banking, number of clients by segment, service, territory. |
| Derive the service metrics | Based on the key indicators, IT can derive the following service metrics: 1. Number of product applications originated from online banking 2. Customer satisfaction/complaints As part of the process, IT also identified some business metrics, such as the number of online banking users per month or the number of times a client accesses online banking per month. |
| CASE STUDY |
Industry: Manufacturing | Source: CIO |
| Challenge | Solution | Results |
| The IT organization needed to generate metrics to show the business whether the video conferencing service was being adopted and if it was providing the expected outcome and value.
Standard IT metrics were technical and did not provide a business context that allowed for easy understanding of performance and decision making. |
The IT organization, working through the CIO and service managers, sat down with the key business stakeholders of the video conferencing service.
They discussed the goals for the meeting and defined the success criteria for those goals in the context of video conference meeting outcomes. The success criteria that were discussed were then translated into a set of questions (key performance indicators) that if answered, would show that the success criteria were achieved. |
The service manager identified what could be measured to answer the defined questions and eliminated any metrics that were either business metrics or non-IT related.
The remaining metrics were identified as the possible service metrics, and the ability to gather the information and produce the metric was confirmed. Service metrics were defined for:
|

|
|
1.1 |
|
Determine stakeholder needs, goals, and pain points
The onsite analyst will help you select key stakeholders and analyze their business objectives and current pain points. |
1.2 |
|
Determine the success criteria and related IT services
The analyst will facilitate a discussion to uncover the information that these stakeholders care about. The group will also identify the IT services that are supporting these objectives. |

1.5 |
|
Derive the service metrics
Based on the key performance indicators obtained in the previous page, derive meaningful business metrics that are relevant to the stakeholders. |
1.6 |
|
Validate the data collection process
The analyst will help the workshop group determine whether the identified metrics can be collected and measured. If so, a calculation methodology is created. |
1.7 |
|
Validate metrics with stakeholders
Establish a feedback mechanism to have business stakeholders validate the meaningfulness of the metrics. |
| PHASE 1 | PHASE 2 | PHASE 3 | ||
1.1Derive the Service Metrics | 1.2Validate the Metrics | 2.1Determine Reporting Format | 3.1Select Pilot Metrics | 3.2Activate and Maintain Metrics |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 2.1: Select Presentation Format | Step 2.2: Review Design |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
|
Step 1 Understand the pros and cons of different reporting styles |
|
Step 2 Determine your reporting and presentation style Presentation Format Selection |
|
Step 3 Design your metrics reports |
Validated Service Reports |
The reports must also display information in a way that generates actions. If your stakeholders cannot make decisions, kick off activities, or ask questions based on your reports, then they have no value.
| Dashboard (PwC. “Mega-Trends and Implications.”)
|
Infographic (PwC. “Healthcare’s new entrants.”)
|
| Report (PwC Blogs. “Northern Lights.”)
|
Scorecard (PwC. “Annual Report 2015.”)
|
A dashboard is a reporting method that provides a dynamic at-a-glance view of key metrics from the perspective of key stakeholders. It provides a quick graphical way to process important performance information in real time.
| Features
Typically web-based Dynamic data that is updated in real time |
Advantage
Aggregates a lot of information into a single view Presents metrics in a simplistic style that is well understood Provides a quick point-in-time view of performance Easy to consume visual presentation style |
Disadvantage
Complicated to set up well. Promotes a short-term outlook – focus on now, no historical performance and no future trends. Doesn’t provide the whole picture and story. Existing dashboard tools are often not customized enough to provide real value to each stakeholder. |
![]() (Source: PwC. “Mega-Trends and Implications.”) |
Metrics presented through online dashboards are calculated in real time, which allows for a dynamic, current view into the performance of IT services at any time. |
An infographic is a graphical representation of metrics or data, which is used to show information quickly and clearly. It’s based on the understanding that people retain and process visual information more readily than written details.
| Features
Turns dry into attractive –transforms data into eye-catching visual memory that is easier to retain Can be used as the intro to a formal report There are endless types of infographics |
Advantage
Easily consumable Easy to retain Eye catching Easily shared Spurs conversation Customizable |
Disadvantage
Require design expertise and resources Can be time consuming to generate Could be easily misinterpreted Message can be lost with poor design |
![]() (Source: PwC. “Healthcare’s new entrants…”) |
There is no limit when it comes to designing an infographic. The image used here visually articulates the effects of new entrants pulling away the market. |
A formal report is a more structured and official reporting style that contains detailed research, data, and information required to enable specific business decisions, and to help evaluate performance over a defined period of time.
| Definition
Metrics can be presented as a component of a periodic, formal report A physical document that presents detailed information to a particular audience |
Advantage
More detailed, more structured and broader reporting period Formal, shows IT has put in the effort Effectively presents a broader and more complete story Targets different stakeholders at the same time |
Disadvantage
Requires significant effort and resources Higher risk if the report does not meet the expectation of the business stakeholder Done at a specific time and only valuable for that specific time period Harder to change format |
![]() (Source: PwC Blogs. “Northern Lights: Where are we now?”) |
An effective report incorporates visuals to demonstrate key improvements.
Formal reports can still contain visuals, but they are accompanied with detailed explanations. |
A scorecard is a graphic view of the progress and performance over time of key performance metrics. These are in relation to specified goals based on identified critical stakeholder objectives.
| Features Incorporates multiple metrics effectively. Scores services against the most important organizational goals and objectives. Scorecards may tie back into strategy and different perspectives of success. | Advantage Quick view of performance against objectives Measure against a set of consistent objectives Easily consumable Easy to retain | Disadvantage Requires a lot of forethought |
![]() (PwC. “Annual Report 2015.”) |
Scorecards provide a summary of performance that is directly linked to the organizational KPIs. |
2.1 Metrics Presentation Format Selection Guide
In this section, you will determine the optimal reporting style for the service metrics.
This guide contains four questions, which will help IT organizations identify the most appropriate presentation format based on stakeholder preference and needs for metrics.
|
|
| Download the Metrics Presentation Format Selection Guide. | |
2.1 2 Hours
INPUT: Identified stakeholder and his/her role
OUTPUT: Proper presentation format based on need for information
Materials: Metrics Presentation Format Selection Guide
Participants: BRM, SLM, Program Manager
After deciding on the report type to be used to present the metric, the organization needs to consider how stakeholders will consume the metric.
There are three options based on stakeholder needs and available presentation options within IT.
2.2 30 Minutes
Be sure to consider access rights for more senior reports. Site and user access permissions may need to be defined based on the level of reporting.
| CASE STUDY |
Industry: Manufacturing | Source: CIO Interview |
| The Situation
The business had a clear need to understand if the implementation of video conferencing would allow previously onsite meetings to achieve the same level of effectiveness. Reporting ContextProvided reports had always been generated from an IT perspective and the business rarely used the information to make decisions. The metrics needed to help the business understand if the meetings were remaining effective and be tied into the financial reporting against travel expenses, but there would be limited visibility during the executive meetings. |
ApproachThe service manager reviewed the information that he had gathered to confirm how often they needed information related to the service. He also met with the CIO to get some insight into the reports that were already being provided to the business, including the ones that were most effective. ConsiderationsThe conversations identified that there was no need for a dynamic real-time view of the performance of the service, since tracking of cost savings and utility would be viewed monthly and quarterly. They also identified that the item would be discussed within a very small window of time during the management meetings. The SolutionIt was determined that the best style of reporting for the metric was an existing scorecard that was produced monthly, using some infographics to ensure that the information is clear at a glance to enable quick decision making. |

|
|
2.1 |
|
Understand the different presentation options
The onsite analyst will introduce the group to the communication vehicles of infographic, scorecard, formal report, and dashboard. |
2.1 |
|
Assess stakeholder needs for information
For selected stakeholders, the analyst will facilitate a discussion on how stakeholders would like to view information and how the metrics can be presented to aid decision making. |

2.2 |
|
Select and design the metric report
Based on the discussion, the working group will select the most appropriate presentation format and create a rough draft of how the report should look. |
| PHASE 1 | PHASE 2 | PHASE 3 | ||
1.1Derive the Service Metrics | 1.2Validate the Metrics | 2.1Determine Reporting Format | 3.1Select Pilot Metrics | 3.2Activate and Maintain Metrics |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 3.1: Select and Launch Pilot Metrics | Step 3.2: Track and Maintain the Metrics |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
|
Step 1 Run your pilot Metrics Tracking Tool |
|
Step 2 Validate success Metrics Tracking Tool |
|
Step 3 Implement your metrics program in batches Metrics Tracking Tool |
Active Service Metrics Program |
This allows you to validate your approach and make refinements to the implementation and maintenance processes where necessary, prior to activating all service metrics.
3.1
The Metrics Tracking Tool will enable you to track goals and success metrics for your service metrics programs. It allows you to set long-term goals and track your results over time.
There are three sections in this tool:
|
3.1 30 MinutesINPUT: Identified services, Business feedback
OUTPUT: Services with most urgent need or impact
Materials: Service catalog or list of identified services
Participants: BRM, SLM, Business representatives
To start the implementation of your service metrics program and drive wider adoption, you need to run a pilot using a smaller subset of metrics.
To determine the sample for the pilot, consider metrics that:
Metrics that meet two or more criteria are ideal for the pilot
3.2 1 HourINPUT: Identified metrics
OUTPUT: A data collection mythology, Metrics tracking
Materials: Metrics
Participants: SLM, BRM, Service owner
You will need to start collection and validation of your identified data in order to calculate the results for your pilot metrics.
3.3 1 HourINPUT: Historical data/baseline data
OUTPUT: Realistic initial target for improvement
Materials: Metrics Tracking Tool
Participants: BRM, SLM, Service owner
Identify an initial service objective based on one or more of the following options:
The target may not always be a number - it could be a trend. The initial target will be changed after review with stakeholders
3.4 1 HourINPUT: SLM and BRM SOPs or responsibility documentations
OUTPUT: Integrate service metrics into the SLM/BRM role
Materials: SLM / BRM reports
Participants: SLM, BRM, CIO, Program manager, Service manager
The service metrics program is usually initiated, used, and maintained by the SLM and BRM functions.
Ensure that the metrics pilot is integrated with those functions by:
3.5 1 HourINPUT: Identified metrics, Selected presentation format
OUTPUT: Metrics reports that are ready for distribution
Materials: Metrics Presentation Format Selection Guide
Participants: BRM, SLM, CIO, Business representatives
Once you have completed the calculation for the pilot metrics:
3.6 1 HourINPUT: Feedback from pilot, Services in batch
OUTPUT: Systematic implementation of metrics
Materials: Metrics Tracking Tool
Participants: BRM, SLM, Program manager
Upon completion of the pilot, move to start the broader implementation of metrics across the organization:
3.7 1.5 HourINPUT: Feedback from business stakeholders
OUTPUT: Modification to individual metrics or to the process
Materials: Metrics Tracking Tool, Metrics Development Workbook
Participants: CIO, BRM, SLM, Program manager, Service owner
Once service metrics and reporting become active, it is necessary to determine the review time frame for your metrics to ensure they remain useful.
3.7
Based on the outcome of the review meeting, decide what needs to be done for each metric, using the following options:
| Add
A new metric is required or an existing metric needs large-scale changes (example: calculation method or scope). |
Change
A minor change is required to the presentation format or data. Note: a major change in a metric would be performed through the Add option. |
| Remove
The metric is no longer required, and it needs to be removed from reporting and data gathering. A final report date for that metric should be determined. |
Maintain
The metric is still useful and no changes are required to the metric, its measurement, or how it’s reported. |
| VC CASE STUDY | Industry: Manufacturing | Source: CIO Interview |
Reviewing the value of active metricsWhen the video conferencing service was initially implemented, it was performed as a pilot with a group of executives, and then expanded for use throughout the company. It was understood that prior to seeing the full benefit in cost reduction and increased efficiency and effectiveness, the rate of use and adoption had to be understood. The primary service metrics created for the service were based on tracking the number of requests for video conference meetings that were received by the IT organization. This identified the growth in use and could be used in conjunction with financial metrics related to travel to help identify the impact of the service through its growth phase. Once the service was adopted, this metric continued to be tracked but no longer showed growth or expanded adoption. The service manager was no longer sure this needed to be tracked. |
Key ActivityThe metrics around requests for video conference meetings were reviewed at the annual metrics review meeting with the business. The service manager asked if the need for the metric, the goal of tracking adoption, was still important for the business. The discussion identified that the adoption rate was over 80%, higher than anticipated, and that there was no value in continuing to track this metric. Based on the discussion, the adoption metrics were discontinued and removed from data gathering and reporting, while a success rate metric was added (how many meetings ran successfully and without issue) to ensure the ongoing value of the video conferencing service. |

![]() |
|
3.1 |
|
Select the pilot metrics
The onsite analyst will help the workshop group select the metrics that should be first implemented based on the urgency and impact of these metrics. |
3.2 |
|
Gather data and set initial targets
The analyst will help the group create a process to gather data, measure baselines, and set initial targets. |

3.5 |
|
Generate the reports and validate with stakeholders
The Info-Tech analyst will help the group establish a process to receive feedback from the business stakeholders once the report is generated. |
3.6 |
|
Implement the service metrics program
The analyst will facilitate a discussion on how to implement the metrics program across the organization. |
3.7 |
|
Track and maintain the metrics program
Set up a mechanism to ensure the success of the metrics program by assessing process adherence and process validity. |
Service metrics are critical to ensuring alignment of IT service performance and business service value achievement.
Service metrics reinforce positive business and end-user relationships by providing user-centric information that drives responsiveness and consistent service improvement.
Poorly designed metrics drive unintended and unproductive behaviors that have negative impacts on IT and produce negative service outcomes.
| Name | Organization |
| Joe Evers | Joe Evers Consulting |
| Glen Notman | Associate Partner, Citihub |
| David Parker | Client Program Manager, eHealth Ontario |
| Marianne Doran Collins | CIO, The CIO-Suite, LLC |
| Chris Kalbfleisch | Manager, Service Management, eHealth Ontario |
| Joshua Klingenberg | BHP Billiton Canada Inc. |
|
Design & Build a User-Facing Service Catalog The user-facing service catalog is the go-to place for IT service-related information. |
|
Unleash the True Value of IT by Transforming Into a Service Provider Earn your seat at the table and influence business strategy by becoming an IT service provider. |
Pollock, Bill. “Service Benchmarking and Measurement: Using Metrics to Drive Customer Satisfaction and Profits.” Aberdeen Group. June 2009. http://722consulting.com/ServiceBenchmarkingandMeasurement.pdf
PwC. “Mega-Trends and Implications.” RMI Discussion. LinkedIn SlideShare. September 2015. http://www.slideshare.net/AnandRaoPwC/mega-trends-and-implications-to-retirement
PwC. “Healthcare’s new entrants: Who will be the industry’s Amazon.com?” Health Research Institute. April 2014. https://www.pwc.com/us/en/health-industries/healthcare-new-entrants/assets/pwc-hri-new-entrant-chart-pack-v3.pdf
PwC. “Northern Lights: Where are we now?” PwC Blogs. 2012. http://pwc.blogs.com/files/12.09.06---northern-lights-2--summary.pdf
PwC. “PwC’s key performance indicators
The TY advisory service is tailored to your needs. It combines the best of traditional IT consulting expertise with the analysis and remedial solutions of an expert bureau.
When you observe specific symptoms, TY analyses the exact areas that contribute to these symptoms.
TY specializes in IT Operations and goes really deep in that area. We define IT Operations as the core service you deliver to your clients:
When you see your operation running smoothly, it looks obvious and simple, but it is not. IT Operations is a concerto, under the leadership of a competent IT Ops Conductor-Manager. IT Ops keeps the lights on and ensures your reputation with your clients and the market as a whole as a predictable and dependable business partner. And we help you achieve this, based on more than 30 years of IT Ops experience.
As most companies' business services are linked at the hip with IT, your IT Operations, in other words, are your key to a successful business.
That is why we work via a simple value-based proposition. We discuss your wants and together discover your needs. Once we all agree, only then do we make our proposal. Anything you learned on the way, is yours to keep and use.
Gert has advised clients on what to do before issues happen. We have also worked to bring companies back from the brink after serious events. TY has brought services back after big incidents.
You need to get it done, not in theory, but via actionable advice and if required, via our actions and implementation prowess. It's really elementary. Anyone can create a spreadsheet with to-do lists and talk about how resilience laws like DORA and NIS2 need to be implemented.
It's not the talk that counts, it's the walk. Service delivery is in our DNA. Resilience is our life.
Good governance directly ensures happy clients because staff knows what to do when and allows them leeway in improving the service. And this governance will satisfy auditors.
Incidents erode client confidence in your service and company. You must get them fixed in accordance with their importance,
You don't want repeat incidents! Tackle the root causes and fix issues permanently. Save money by doing this right.
You must update your services to stay the best in your field. Do it in a controlled yet efficient way. Lose overhead where you can, add the right controls where you must.
The base for most of your processes. You gotta know what you have and how it works together to provide the services to your clients.
IT monitoring delivers business value by catching issues before they become problems. With real-time insights into system performance and security, you can minimize downtime, improve efficiency, and make better decisions that keep your operations strong and your customers happy.
Bring all the IT Operations services together and measure how they perform versus set business relevant KPI's
Disaster recovery is your company's safety net for getting critical systems and data back up and running after a major disruption, focusing on fast IT recovery and minimizing financial and operational losses, whereas business continuity ensures the entire business keeps functioning during and after the crisis.
Business continuity is keeping your company running smoothly during disruptions by having the right plans, processes, and backups in place to minimize downtime and protect your operations, customers, and reputation. We go beyond disaster recovery and make sure your critical processes can continue to function.
Hope for the best, but plan for the worst. When you embark on a new venture, know how to get out of it. Planning to exit is best done in the very beginning, but better late than when it is too late.
We base our analysis on over 30 years experience in corporate and large volume dynamic services. Unique to our service is that we take your company culture into account, while we adjust the mindset of the experts working in these areas.
Your people are what will make these processes work efficiently. We take their ideas, hard capabilities and leadership capabilities into account and improve upon where needed. That helps your company and the people themselves.
We look at the existing governance and analyse where they are best in class or how we can make them more efficient. We identify the gaps and propose remedial updates. Our updates are verified through earlier work, vetted by first and second line and sometimes even regulators
Next we decide with you on how to implement the updates to the areas that need them.
Please schedule your complimentary 30-minute discovery call below.
There is no financial commitment required from you. During this meeting we discus further in detail the issue at hand and the direction of the ideal solution and the way of working.
We take in the information of our talks and prepare the the roadmap to the individualized solution for you.
By now, TY has a good idea of how we can help you, and we have prepared a roadmap to solving the issue. In this meeting we present the way forward our way of working and what it will require from you.
If you decide this is not what you expected, you are free to take the information provided so far and work with it yourself.
After the previous meeting and agreement in principle, you will have by now received our offer.
When you decide to work together, we start our partnership and solve the issue. We work to ensure you are fully satisfied with the result.
Business process automation (BPA) has gained momentum, especially as pilots result in positive outcomes such as improved customer experience, efficiencies, and cost savings. Stakeholders want to invest more in BPA solutions and scale initial successes across different business and IT functions.
But it’s critical to get it right and not fall into the hype so that the costs don’t outweigh the benefits.
Ultimately, all BPA initiatives should align with a common vision.
Organizations should adopt a methodical approach to growing their BPA, taking cost, talent availability, and goals into account.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This blueprint helps you develop a strategy justify the scaling and maturing of your business process automation (BPA) practices and capabilities to fulfill your business priorities.
Document your business process automation strategy in the language your stakeholders understand. Tailor this document to fit your BPA objectives and initiatives.
Evaluate the maturity of the key capabilities of your BPA practice to determine its readiness to support complex and scaled BPA solutions.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the business priorities and your stakeholders' needs that are driving your business process automation initiatives while abiding by the risk and change appetite of your organization.
Translate business priorities to the context of business process automation.
Arrive at a common definition of business value.
Come to an understanding of the needs, concerns, and problems of BPA stakeholders.
Discover organizational risk and change tolerance and appetite.
1.1 Set the Business Context
1.2 Understand Your Stakeholder Needs
1.3 Build Your Risk & Change Profile
Business problem, priorities, and business value definition
Customer and end-user assessment (e.g. personas, customer journey)
Risk and change profile
Set reasonable and achievable expectations for your BPA initiatives and practices, and select the right BPA opportunities to meet these expectations.
Align BPA objectives and metrics to your business priorities.
Create guiding principles that support your organization’s and team’s culture.
Define a vision of your target-state BPA practice
Create a list of BPA opportunities that will help build your practice and meet business priorities.
2.1 Define Your BPA Expectations
2.2 List Your Guiding Principles
2.3 Envision Your BPA Target State
2.4 Build Your Opportunity Backlog
BPA problem statement, objectives, and metrics
BPA guiding principles
Desired scaled BPA target state
Prioritized BPA opportunities
Evaluate the current state of your BPA practice and its readiness to support scaled and complex BPA solutions.
List key capabilities to implement and optimize to meet the target state of your BPA practice.
Brainstorm solutions to address the gaps in your BPA capabilities.
3.1 Assess Your BPA Maturity
BPA maturity assessment
Identify high-priority key initiatives to support your BPA objectives and goals, and establish the starting point of your BPA strategy.
Create an achievable roadmap of BPA initiatives designed to deliver good practices and valuable automations.
Perform a risk assessment of your BPA initiatives and create mitigations for high-priority risks.
Find the starting point in the development of your BPA strategy.
4.1 Roadmap Your BPA Initiatives
4.2 Assess and Mitigate Your Risks
4.3 Complete Your BPA Strategy
List of BPA initiatives and roadmap
BPA initiative risk assessment
Initial draft of your BPA strategy
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the foundational components and drivers of the broader concept of sustainability: environmental, social, and governance (ESG) and IT’s roles within an organization’s ESG program. Learn about the functional business areas involved, the roles they play and how they interact with each other to drive program success.
Environmental, social, and governance (ESG) is a corporate imperative that is tied to long-term value creation. An organization's social license to operate and future corporate performance depends on managing ESG factors well.
Central to an ESG program is having a good understanding of the ESG factors that may have a material impact on enterprise value and key internal and external stakeholders. A comprehensive ESG strategy supported by strong governance and risk management is also essential to success.
Capturing relevant data and applying it within risk models, metrics, and internal and external reports is necessary for sharing your ESG story and measuring your progress toward meeting ESG commitments. Consequently, the data challenges have received a lot of attention, and IT leaders have a role to play as strategic partner and enabler to help address these challenges. However, ESG is more than a data challenge, and IT leaders need to consider the wider implications in managing third parties, selecting tools, developing supporting IT architecture, and ensuring ethical design.
For many organizations, the ESG program journey has just begun, and collaboration between IT and risk, procurement, and compliance will be critical in shaping program success.
Donna Bales
Principal Research Director
Info-Tech Research Group
An organization's approach to ESG cannot be static or tactical. ESG is a moving landscape that requires a flexible, holistic approach across the organization. It must become part of the way you work and enable an active response to changing conditions.
The ability of a corporation and broader society to endure and survive over the long term by managing adverse impacts well and promoting positive opportunities.
Source: United Nations

Survey key stakeholders to obtain a more holistic viewpoint of expectations and the industry landscape and gain credibility through the process.
Example: Beverage Company
"If ESG is the framework of non-financial risks that may have a material impact on the company's stakeholders, corporate governance is the process by which the company's directors and officers manage those risks."
– Zurich Insurance
47% of companies reported that the full board most commonly oversees climate related risks and opportunities while 20% delegate to an existing board governance committee (EY Research, 2021).
| Governance Layer | Responsibilities |
|---|---|
| Board |
|
| Oversight | |
| Executive leadership |
|
| Oversight and strategic direction | |
| Management |
|
| Execution |
– "Aligning nonfinancial reporting..." EY, 2020
Organizational Goals
| NET NEW | ENHANCEMENT |
|---|---|
| Climate disclosure | Data quality management |
| Assurance specific to ESG reporting | Risk sensing and assessment |
| Supply chain transparency tied back to ESG | Managing interconnections |
| Scenario analysis | |
| Third-party ratings and monitoring |
Integrate ESG risks early, embrace uncertainty by staying flexible, and strive for continual improvement.
"The typical consumer company's supply chain ... [accounts] for more than 80% of greenhouse-gas emissions and more than 90% of the impact on air, land, water, biodiversity, and geological resources."
– McKinsey & Company, 2016
"Forty-five percent of survey respondents say that they either have no visibility into their upstream supply chain or that they can see only as far as their first-tier suppliers."
– "Taking the pulse of shifting supply chains," McKinsey & Company, 2022
Example metrics for ESG factors
IT leaders need to work collaboratively with risk management to optimize decision making and continually improve ESG performance and disclosure.
"A great strategy meeting is a meeting of the minds."
– Max McKeown
Keep your data model flexible and digital where possible to enable data interoperability.
"You can have data without information, but you cannot have information without data."
– Daniel Keys Moran
Organizations will rely on IT for execution, and IT leaders will need to be ready
| TERM | DEFINITON |
|---|---|
| Corporate Social Responsibility | Management concept whereby organizations integrate social and environmental concerns in their operations and interactions with their stakeholders. |
| Chief Sustainability Officer | Steers sustainability commitments, helps with compliance, and helps ensure internal commitments are met. Responsibilities may extend to acting as a liaison with government and public affairs, fostering an internal culture, acting as a change agent, and leading delivery. |
| ESG | An acronym that stands for environment, social, and governance. These are the three components of a sustainability program. |
| ESG Standard | Contains detailed disclosure criteria including performance measures or metrics. Standards provide clear, consistent criteria and specifications for reporting. Typically created through consultation process. |
| ESG Framework | A broad contextual model for information that provides guidance and shapes the understanding of a certain topic. It sets direction but does not typically delve into the methodology. Frameworks are often used in conjunction with standards. |
| ESG Factors | The factors or issues that fall under the three ESG components. Measures the sustainability performance of an organization. |
| ESG Rating | An aggregated score based on the magnitude of an organization's unmanaged ESG risk. Ratings are provided by third-party rating agencies and are increasingly being used for financing, transparency to investors, etc. |
| ESG Questionnaire | ESG surveys or questionnaires are administered by third parties and used to assess an organization's sustainability performance. Participation is voluntary. |
| Key Risk Indicator (KRI) | A measure to indicate the potential presence, level, or trend of a risk. |
| Key Performance Indicator (KPI) | A measure of deviation from expected outcomes to help a firm see how it is performing. |
| Materiality | Material topics are topics that have a direct or indirect impact on an organization's ability to create, preserve, or erode economic, environment and social impact for itself and its stakeholder and society as a whole |
| Materiality Assessment | A materiality assessment is a tool to identify and prioritize the ESG issues most critical to the organization. |
| Risk Sensing | The range of activities carried out to identify and understand evolving sources of risk that could have a significant impact on the organization (e.g. social listening). |
| Sustainability | The ability of an organization and broader society to endure and survive over the long term by managing adverse impacts well and promoting positive opportunities. |
| Sustainalytics | Now part of Morningstar. Sustainalytics provides ESG research, ratings, and data to institutional investors and companies. |
| UN Guiding Principles on Business and Human Rights (UNGPs) | UN Guiding Principles on Business and Human Rights (UNGPs) provide an essential methodological foundation for how impacts across all dimensions should be assessed. |
| STANDARD | DEFINITION AND FOCUS |
|---|---|
| CDP | CDP has created standards and metrics for comparing sustainability impact. Focuses on environmental data (e.g. carbon, water, and forests) and on data disclosure and benchmarking. |
| (Formally Carbon Disclosure Project) | Audience: All stakeholders |
| Dow Jones Sustainability Indices (DJSI) | Heavy on corporate governance and company performance. Equal balance of economic, environmental, and social. |
| Audience: All stakeholders | |
| Global Reporting Initiative (GRI) | International standards organization that has a set of standards to help organizations understand and communicate their impacts on climate change and social responsibility. The standard has a strong emphasis on transparency and materiality, especially on social issues. |
| Audience: All stakeholders | |
| International Sustainability Standards Board (ISSB) | Standard-setting board that sits within the International Financial Reporting Standards (IFRS) Foundation. The IFRS Foundation is a not-for-profit, public-interest organization established to develop high-quality, understandable, enforceable, and globally accepted accounting and sustainability disclosure standards. |
| Audience: Investor-focused | |
| United Nations Sustainable Development Goals (UNSDG) | Global partnership across sectors and industries to achieve sustainable development for all (17 Global Goals) |
| Audience: All stakeholders | |
| Sustainability Accounting Standards Board (SASB) | Industry-specific standards to help corporations select topics that may impact their financial performance. Focus on material impacts on financial condition or operating performance. |
| Audience: Investor-focused | |
| Task Force Of Climate-related Disclosures (TCFD; created by the Financial Stability Board) | Standards framework focused on the impact of climate risk on financial and operating performance. More broadly the disclosures inform investors of positive and negative measures taken to build climate resilience and make transparent the exposure to climate-related risk. |
| Audience: Investors, financial stakeholders |
Anne-Titia Bove and Steven Swartz, McKinsey, "Starting at the source: Sustainability in supply chains", 11 November 2016
Accenture, "The Greater Wealth Transfer – Capitalizing on the intergenerational shift in wealth", 2012
Beth Kaplan, Deloitte, "Preparing for the ESG Landscape, Readiness and reporting ESG strategies through controllership playbook", 15 February 2022
Bjorn Nilsson et al, McKinsey & Company, "Financial institutions and nonfinancial risk: How corporates build resilience," 28 February 2022
Bolden, Kyle, Ernst and Young, "Aligning nonfinancial reporting with your ESG strategy to communicate long-term value", 18 Dec. 2020
Canadian Securities Administrators, "Canadian securities regulators seek comment on climate-related disclosure requirements", 18 October 2021
Carol A. Adams et al., Global Risk Institute, "The double-materiality concept, Application and issues", May 2021
Dunstan Allison-Hope et al, BSR, "Impact-Based Materiality, Why Companies Should-Focus Their Assessments on Impacts Rather than Perception", 3 February 2022
EcoVadis, "The World's Most Trusted Business Sustainability Ratings",
Ernst and Young, "Four opportunities for enhancing ESG oversight", 29 June 2021
Federal Ministry of Labour and Social Affairs, The Act on Corporate Due Diligence Obligations in Supply Chains (Gesetz über die unternehmerischen Sorgfaltspflichten in Lieferketten)", Published into Federal Law Gazette, 22, July 2021
"What Every Company Needs to Know", Sustainalytics
Global Risk Institute, The GRI Perspective, "The materiality madness: why definitions matter", 22 February 2022
John P Angkaw "Applying ERM to ESG Risk Management", 1 August 2022
Hillary Flynn et al., Wellington Management, "A guide to ESG materiality assessments", June 2022
Katie Kummer and Kyle Lawless, Ernst and Young, "Five priorities to build trust in ESG", 14 July 2022
Knut Alicke et al., McKinsey & Company, "Taking the pulse of shifting supply chains", 26 August 2022
Kosmas Papadopoulos and Rodolfo Arauj. The Harvard School Forum on Corporate Governance, "The Seven Sins of ESG Management", 23 September 2020
KPMG, Sustainable Insight, "The essentials of materiality assessment", 2014
Lorraine Waters, The Stack, "ESG is not an environmental issue, it's a data one", 20 May 2021
Marcel Meyer, Deloitte, "What is TCFD and why does it matter? Understanding the various layers and implications of the recommendations",
Michael W Peregnne et al., "The Harvard Law School Forum on Corporate Governance, The Important Legacy of the Sarbanes Oxley Act," 30 August 2022
Michael Posner, Forbes, "Business and Human Rights: Looking Ahead To The Challenges Of 2022", 15 December 2021
Myles Corson and Tony Kilmas, Ernst and Young, "How the CFO can balance competing demands and drive future growth", 3 November 2020
Novisto, "Navigating Climate Data Disclosure", 2022
Novisto, "XBRL is coming to corporate sustainability reporting", 17 April 2022
"Official Journal of the European Union, Regulation (EU) 2019/2088 of the European Parliament and of the Council of 27 November 2019 on sustainability-related disclosures in the financial services sector", 9 December 2019
Osler, "ESG and the future of sustainability", Podcast, 01 June 2022
Osler, "The Rapidly Evolving World of ESG Disclosure: ISSB draft standards for sustainability and climate related disclosures", 19 May 2022
Sarwar Choudhury and Zach Johnston, Ernst and Young "Preparing for Sox-Like ESG Regulation", 7 June 2022
Securities and Exchange Commission, "The Enhancement and Standardization of Climate-related Disclosures for Investors", 12 May 2022
"Securities and Exchange Commission, SEC Proposes Rules on Cybersecurity, Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, 9 May 2022
Sean Brown and Robin Nuttall, McKinsey & Company, "The role of ESG and purpose", 4 January 2022
Statement by Chair Gary Gensler, "Statement on ESG Disclosure Proposal", 25 May 2022
Svetlana Zenkin and Peter Hennig, Forbes, "Managing Supply Chain Risk, Reap ESG Rewards", 22 June 2022
Task Force on Climate Related Financial Disclosures, "Final Report, Recommendations of the Task Force on Climate-related Financial Disclosures", June 2017
World Economic Forum, "Why sustainable governance and corporate integrity are crucial for ESG", 29 July 2022
World Economic Forum (in collaboration with PwC) "How to Set Up Effective Climate Governance on Corporate Boards, Guiding Principles and questions", January 2019
World Economic Forum, "Defining the "G" in ESG Governance Factors at the Heart of Sustainable Business", June 2022
World Economic Forum, "The Risk and Role of the Chief Integrity Officer: Leadership Imperatives in and ESG-Driven World", December 2021
World Economic Forum, "How to Set Up Effective Climate Governance on Corporate Boards Guiding principles and questions", January 2019
Zurich Insurance, "ESG and the new mandate for corporate governance", 2022
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Our systematic approach will ensure that the correct procedure for selecting a security outsourcing partner is implemented. This blueprint will help you build and implement your security policy program by following our three-phase methodology: determine what to outsource, select the right MSSP, and manage your MSSP.
This modifiable template is designed to introduce consistency and outline key requirements during the request for proposal phase of selecting an MSSP.
The need for specialized security services is fast becoming a necessity to most organizations. However, resource challenges will always mean that organizations will still have to take practical measures to ensure that the time, quality, and service that they require from outsourcing partners have been carefully crafted and packaged to elicit the right services that cover all their needs and requirements.
Organizations must ensure that security partners are aligned not only with their needs and requirements, but also with the corporate culture. Rather than introducing hindrances to daily operations, security partners must support business goals and protect the organization’s interests at all times.
And as always, outsource only your responsibilities and do not outsource your accountability, as that will cost you in the long run.
Danny Hammond
Research Analyst
Security, Risk, Privacy & Compliance Practice
Info-Tech Research Group
Your ChallengeA lack of high-skill labor increases the cost of internal security, making outsourcing more appealing. A lack of time and resources prevents your organization from being able to enable security internally. Due to a lack of key information on the subject, you are unsure which functions should be outsourced versus which functions should remain in-house. Having 24/7/365 monitoring in-house is not feasible for most firms. There is difficulty measuring the effectiveness of managed security service providers (MSSPs). |
Common ObstaclesInfoSec leaders will struggle to select the right outsourcing partner without knowing what the organization needs, such as:
InfoSec leaders must understand the business environment and their own internal security needs before they can select an outsourcing partner that fits. |
Info-Tech’s ApproachInfo-Tech’s Select a Security Outsourcing Partner takes a multi-faceted approach to the problem that incorporates foundational technical elements, compliance considerations, and supporting processes:
|
Mitigate security risks by developing an end-to-end process that ensures you are outsourcing your responsibilities and not your accountability.
This research is designed to help organizations select an effective security outsourcing partner.
Outsourcing is effective, but only if done right
The problem with selecting an outsourcing partner isn’t a lack of qualified partners, it’s the lack of clarity about an organization's specific security needs.

Source: IBM, 2022 Cost of a Data Breach; N=537.
Determine what responsibilities you can outsource to a service partner. Analyze which responsibilities you should outsource versus keep in-house? Do you require a service partner based on identified responsibilities?
Refine the list of role-based requirements, variables, and features you will require. Use a well-known list of critical security controls as a framework to determine these activities and send out RFPs to pick the best candidate for your organization.
Adopt a program to manage your third-party service security outsourcing. Trust your managed security service providers (MSSP) but verify their results to ensure you get the service level you were promised.
IT/InfoSec BenefitsReduces complexity within the MSSP selection process by highlighting all the key steps to a successful selection program. Introduces a roadmap to clearly educate about the do’s and don’ts of MSSP selection. Reduces costs and efforts related to managing MSSPs and other security partners. |
Business BenefitsAssists with selecting outsourcing partners that are essential to your organization’s objectives. Integrates outsourcing into corporate culture, leveraging organizational requirements while maximizing value of outsourcing. Reduces security outsourcing risk. |
Overarching insight: You can outsource your responsibilities but not your accountability.
Determine what to outsource: Assess your responsibilities to determine which ones you can outsource. It is vital that an understanding of how outsourcing will affect the organization, and what cost savings, if any, to expect from outsourcing is clear in order to generate a list of responsibilities that can/should be outsourced.
Select the right partner: Create a list of variables to evaluate the MSSPs and determine which features are important to you. Evaluate all potential MSSPs and determine which one is right for your organization
Manage your MSSP: Align the MSSP to your organization. Adopt a program to monitor the MSSP which includes a long-term strategy to manage the MSSP.
Identifying security needs and requirements = Effective outsourcing program: Understanding your own security needs and requirements is key. Ensure your RFP covers the entire scope of your requirements; work with your identified partner on updates and adaptation, where necessary; and always monitor alignment to business objectives.
Phase |
Purpose |
Measured Value |
| Determine what to outsource | Understand the value in outsourcing and determining what responsibilities can be outsourced. | Cost of determining what you can/should outsource:
|
| Select the right partner | Select an outsourcing partner that will have the right skill set and solution to identified requirements. | Cost of ranking and selecting your MSSPs:
|
| Manage your third-party service security outsourcing | Use Info-Tech’s methodology and best practices to manage the MSSP to get the best value. | Cost of creating and implementing a metrics program to manage the MSSP:
|
After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
Overall Impact: 8.9 /10
Overall Average Cost Saved: $22,950
Overall Average Days Saved: 9
DIY Toolkit
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
Guided Implementation
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
Workshop
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
Consulting
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."
Without the control over the areas in which employees are working, businesses are opening themselves up to a greater degree of risk during the pandemic. How does a business raise awareness for employees who are going to be working remotely?
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use Info-Tech’s training materials to get you started on remote training and awareness.
By signing an agreement with Gert Taeymans bvba, Client declares that he agrees with the Terms and Conditions referred to hereafter. Terms and conditions on Client's order form or any other similar document shall not be binding upon Gert Taeymans bvba.
The prices, quantities and delivery time stated in any quotation are not binding upon Gert Taeymans bvba. They are commercial estimates only which Gert Taeymans bvba will make reasonable efforts to achieve. Prices quoted in final offers will be valid only for 30 days. All prices are VAT excluded and do not cover expenses, unless otherwise agreed in writing. Gert Taeymans bvba reserves the right to increase a quoted fee in the event that Client requests a variation to the work agreed.
The delivery times stated in any quotation are of an indicative nature and not binding upon Gert Taeymans bvba, unless otherwise agreed in writing. Delivery times will be formulated in working days. In no event shall any delay in delivery be neither cause for cancellation of an order nor entitle Client to any damages.
Amendments or variations of the initial agreement between Client and Gert Taeymans bvba will only be valid when accepted by both parties in writing.
Any complaints concerning the performance of services must be addressed to Gert Taeymans bvba in writing and by registered mail within 7 working days of the date of the performance of the services.
In no event shall any complaint be just cause for non-payment or deferred payment of invoices. Any invoice and the services described therein will be deemed irrevocably accepted by Client if no official protest of non-payment has been sent by Client within 7 working days from the date of the mailing of the invoice.
Client shall pay all invoices of Gert Taeymans bvba within thirty (30) calendar days of the date of invoice unless otherwise agreed in writing by Gert Taeymans bvba. In the event of late payment, Gert Taeymans bvba may charge a monthly interest on the amount outstanding at the rate of two (2) percent with no prior notice of default being required, in which case each commenced month will count as a full month. Any late payment will entitle Gert Taeymans bvba to charge Client a fixed handling fee of 300 EUR. All costs related to the legal enforcement of the payment obligation, including lawyer fees, will be charged to Client.
In no event will Gert Taeymans bvba be liable for damages of any kind, including without limitation, direct, incidental or consequential damages (including, but not limited to, damages for lost profits, business interruption and loss of programs or information) arising out of the use of Gert Taeymans bvba services.
Gert Taeymans bvba collects personal data from Client for the performance of its services and the execution of its contracts. Such personal data can also be used for direct marketing, allowing Gert Taeymans bvba to inform Client of its activities on a regular basis. If Client objects to the employment of its personal data for direct marketing, Client must inform Gert Taeymans bvba on the following address: gert@gerttaeymans.consulting.
Client can consult, correct or amend its personal data by addressing such request to Gert Taeymans bvba by registered mail. Personal data shall in no event be sold, rented or made available to other firms or third parties where not needed for the execution of the contract. Gert Taeymans bvba reserves the right to update and amend its privacy policy from time to time to remain consistent with applicable privacy legislation.
The logo of the Client will be displayed on the Gert Taeymans bvba website, together with a short description of the project/services.
Any changes to Client’s contact information such as addresses, phone numbers or e-mail addresses must be communicated to Gert Taeymans bvba as soon as possible during the project.
Both parties shall maintain strict confidence and shall not disclose to any third party any information or material relating to the other or the other's business, which comes into that party's possession and shall not use such information and material. This provision shall not, however, apply to information or material, which is or becomes public knowledge other than by breach by a party of this clause.
Gert Taeymans bvba has the right at any time to change or modify these terms and conditions at any time without notice.
The agreement shall be exclusively governed by and construed in accordance with the laws of Belgium. The competent courts of Antwerp, Belgium will finally settle any dispute about the validity, the interpretation or the execution of this agreement.
These Terms and Conditions are the only terms and conditions applicable to both parties.
If any provision or provisions of these Terms and Conditions shall be held to be invalid, illegal or unenforceable, such provision shall be enforced to the fullest extent permitted by applicable law, and the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use this blueprint to standardize your service desk by assessing your current capability and laying the foundations for your service desk, design an effective incident management workflow, design a request fulfillment process, and apply the discussions and activities to make an actionable plan for improving your service desk.
This tool is designed to assess your service desk process maturity, identify gaps, guide improvement efforts, and measure your progress.
Use this template to organize information about the service desk challenges that the organization is facing, make the case to build a right-sized service desk to address those challenges, and outline the recommended process changes.
Use the RACI template to determine roles for your service desk initiatives and to build ownership around them. Use the template and replace it with your organization's information.
The template will help you identify service desk roles and responsibilities, build ticket management processes, put in place sustainable knowledgebase practices, document ticket prioritization scheme and SLO, and document ticket workflows.
Use this tool to help review the quality of tickets handled by agents and discuss each technician's technical capabilities to handle tickets.
The Workflow Library provides examples of typical workflows that make up the bulk of the incident management and request fulfillment processes at the service desk.
The Ticket Categorization Schemes provide examples of ticket categories to organize the data in the service desk tool and produce reports that help managers manage the service desk and meet business requirements.
The Knowledge Manager's role is to collect, synthesize, organize, and manage corporate information in support of business units across the enterprise.
An accurate and comprehensive record of the incident management process, including a description of the incident, any workarounds identified, the root cause (if available), and the profile of the incident's source, will improve incident resolution time.
Use this template to develop a communication plan that outlines what stakeholders can expect as the process improvements recommended in the Standardize the Service Desk blueprint are implemented.
The Service Desk Roadmap helps track outstanding implementation activities from your service desk standardization project. Use the roadmap tool to define service desk project tasks, their owners, priorities, and timeline.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discover your challenges and understand what roles, metrics, and ticket handling procedures are needed to tackle the challenges.
Set a clear understanding about the importance of service desk to your organization and service desk best practices.
1.1 Assess current state of the service desk.
1.2 Review service desk and shift-left strategy.
1.3 Identify service desk metrics and reports.
1.4 Identify ticket handling procedures
Current state assessment
Shift-left strategy and implications
Service desk metrics and reports
Ticket handling procedures
Build workflows for incident and critical incident tickets.
Distinguish incidents from service requests.
Ticket categorization facilitates ticket. routing and reporting.
Develop an SLA for your service desk team for a consistent service delivery.
2.1 Build incident and critical incident management workflows.
2.2 Design ticket categorization scheme and proper ticket handling guidelines.
2.3 Design incident escalation and prioritization guidelines.
Incident and critical incident management workflows
Ticket categorization scheme
Ticket escalation and prioritization guidelines
Build service request workflows and prepare self-service portal.
Standardize request fulfilment processes.
Prepare for better knowledge management and leverage self-service portal to facilitate shift-left strategy.
3.1 Build service request workflows.
3.2 Build a targeted knowledgebase.
3.3 Prepare for a self-serve portal project.
Distinguishing criteria for requests and projects
Service request workflows and SLAs
Knowledgebase article template, processes, and workflows
Now that you have laid the foundation of your service desk, put all the initiatives into an action plan.
Discuss priorities, set timeline, and identify effort for your service desk.
Identify the benefits and impacts of communicating service desk initiatives to stakeholders and define channels to communicate service desk changes.
4.1 Build an implementation roadmap.
4.2 Build a communication plan
Project implementation and task list with associated owners
Project communication plan and workshop summary presentation
"Customer service issues are rarely based on personality but are almost always a symptom of poor and inconsistent process. When service desk managers are looking to hire to resolve customer service issues and executives are pushing back, it’s time to look at improving process and the support strategy to make the best use of technicians’ time, tools, and knowledge sharing. Once improvements have been made, it’s easier to make the case to add people or introduce automation.
Replacing service desk solutions will also highlight issues around poor process. Without fixing the baseline services, the new solution will simply wrap your issues in a prettier package.
Ultimately, the service desk needs to be the entry point for users to get help and the rest of IT needs to provide the appropriate support to ensure the first line of interaction has the knowledge and tools they need to resolve quickly and preferably on first contact. If your plans include optimization to self-serve or automation, you’ll have a hard time getting there without standardizing first."
Principal Research Director, Infrastructure & Operations Practice
Info-Tech Research Group
Service desk improvement is an exercise in organizational change. Engage specialists across the IT organization in building the solution. Establish a single service-support team across the IT group and enforce it with a cooperative, customer-focused culture. Don’t be fooled by a tool that’s new. A new service desk tool alone won’t solve the problem. Service desk maturity improvements depend on putting in place the right people and processes to support the technology
Source: Info-Tech, 2019 Responses (N=189 organizations)
Info-Tech Research Group’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified the service desk as an area to leverage.
Since 2013, Info-Tech has surveyed over 40,000 business stakeholders as part of our CIO Business Vision program.
Business stakeholders ranked the following 12 core IT services in terms of importance:
Learn more about the CIO Business Vision Program.
On average, organizations that were satisfied with service desk effectiveness rated all other IT processes 46% higher than dissatisfied end users.
Organizations that were satisfied with service desk timeliness rated all other IT processes 37% higher than dissatisfied end users.More than one hundred organizations engaged with Info-Tech, through advisory calls and workshops, for their service desk projects in 2016. Their goal was either to improve an existing service desk or build one from scratch.
Organizations that estimate the business impact of each project phase help us shed light on the average measured value of the engagements.
"The analysts are an amazing resource for this project. Their approach is very methodical, and they have the ability to fill in the big picture with detailed, actionable steps. There is a real opportunity for us to get off the treadmill and make real IT service management improvements"
- Rod Gula, IT Director
American Realty Advisors
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Project Summary
Service Desk Standard Operating Procedures
Service Desk Maturity Assessment Tool
Service Desk Implementation Roadmap
Incident, knowledge, and request management workflows
Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks).
IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved.
Compliance: Compliance audits are more manageable because the documentation is already in place.
Transparency: Visually documented processes answer the common business question of “why does that take so long?”
Cost savings: Work solved at first contact or with a minimal number of escalations will result in greater efficiency and more cost-effective support. This will also lead to better customer service.
Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff
IT automation built on poorly defined, unoptimized processes leads to inconsistent results.
Documenting SOPs to prepare for an audit becomes a major time-intensive project.
Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.
Support costs are highest through inefficient processes, and proactive work becomes more difficult to schedule, making the organization vulnerable to costly disruptions.
Contact your account representative or email Workshops@InfoTech.com for more information.

Alignment on the challenges that the service desk faces, an assessment of the current state of service desk processes and technologies, and baseline metrics against which to measure improvements.
Deliverables
Embrace standardization
Increase business satisfaction
Reduce recurring issues
Increase efficiency and lower operating costs
When he joined Westminster College as CIO in 2006, the department faced several infrastructure challenges, including:
As the CIO investigated how to address the infrastructure challenges, he realized people cared deeply about how IT spent its time.
The project load of IT staff increased, with new projects coming in every day.
With a long project list, it became increasingly important to improve the transparency of project request and prioritization.
Some weeks, staff spent 80% of their time working on projects. Other weeks, support requirements might leave only 10% for project work.
He addressed the infrastructure challenges in part by analyzing IT’s routine processes.
Internally, IT had inefficient support processes that reduced the amount of time they could spend on projects.
They undertook an internal process analysis effort to identify processes that would have a return on investment if they were improved. The goal was to reduce operational support time so that project time could be increased.
Five years later, they had a better understanding of the organization's operational support time needs and were able to shift workloads to accommodate projects without compromising support.
Estimated Time: 45 minutes
A. As a group, outline the areas where you think the service desk is experiencing challenges or weaknesses. Use sticky notes or a whiteboard to separate the challenges into People, Process, and Technology so you have a wholistic view of the constraints across the department.
B. Think about the following:
C. Document challenges in the Service Desk Project Summary.
Participants:
A current-state assessment will help you build a foundation for process improvements. Current-state assessments follow a basic formula:
Ideally, the current-state assessment should align the delivery of IT services with organizational needs. The assessment should achieve the following goals:
“How do you know if you aren’t mature enough? Nothing – or everything – is recorded and tracked, customer satisfaction is low, frustration is high, and there are multiple requests and incidents that nobody ever bothers to address.”
Rob England
IT Consultant & Commentator
Owner Two Hills
Also known as The IT Skeptic
The Service Desk Maturity Assessmenttool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.
The tool will help guide improvement efforts and measure your progress.
The tool is intended for periodic use. Review your answers each year and devise initiatives to improve the process performance where you need it most.
Where do I find the data?Consult:
This step will walk you through the following activities:
This step involves the following participants:
Identifying who is accountable for different support practices in the service desk will allow workload to be distributed effectively between functional teams and individuals. Closing the gaps in responsibilities will enable the execution of a shift-left strategy.
Deliverables
If you try to standardize service desk processes without engaging specialists in other parts of the IT organization, you will fail. Everyone in IT has a role to play in providing service support and meeting service-level agreements.
Specialists tend to distance themselves from service support as they progress through their career to focus on projects.
However, their cooperation is critical to the success of the new service desk. Not only do they contribute to the knowledgebase, but they also handle escalations from tiers 1 and 2.
Responsible: This person is the staff member who completes the work. Assign at least one Responsible for each task, but this could be more than one.
Accountable: This team member delegates a task and is the last person to review deliverables and/or task. Sometimes Responsible and Accountable can be the same staff. Make sure that you always assign only one Accountable for each task and not more.
Consulted: People who do not carry out the task but need to be consulted. Typically, these people are subject matter experts or stakeholders.
Informed: People who receive information about process execution and quality and need to stay informed regarding the task.
A RACI analysis is helpful with the following:
Notes:
Participants
What You'll Need
Regardless of the service desk structure chosen to meet your service support requirements, end users should be in no doubt about how to access the service.
Provide end users with:
A single point of contact will ensure:
This prevents ad hoc ticket channels such as shoulder grabs or direct emails, chats, or calls to a technician from interrupting work.
A single point of contact does not mean the service desk is only accessible through one intake channel, but rather all tickets are directed to the service desk (i.e. tier 1) to be resolved or redirected appropriately.
Source: Info-Tech, 2019 Responses (N=189 organizations)
Info-Tech Research Group’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified the service desk as an area to leverage.
Since 2013, Info-Tech has surveyed over 40,000 business stakeholders as part of our CIO Business Vision program.
Business stakeholders ranked the following 12 core IT services in terms of importance:
Learn more about the CIO Business Vision Program.
On average, organizations that were satisfied with service desk effectiveness rated all other IT processes 46% higher than dissatisfied end users.
Organizations that were satisfied with service desk timeliness rated all other IT processes 37% higher than dissatisfied end users.More than one hundred organizations engaged with Info-Tech, through advisory calls and workshops, for their service desk projects in 2016. Their goal was either to improve an existing service desk or build one from scratch.
Organizations that estimate the business impact of each project phase help us shed light on the average measured value of the engagements.
"The analysts are an amazing resource for this project. Their approach is very methodical, and they have the ability to fill in the big picture with detailed, actionable steps. There is a real opportunity for us to get off the treadmill and make real IT service management improvements"
- Rod Gula, IT Director
American Realty Advisors
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Project Summary
Service Desk Standard Operating Procedures
Service Desk Maturity Assessment Tool
Service Desk Implementation Roadmap
Incident, knowledge, and request management workflows
Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks).
IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved.
Compliance: Compliance audits are more manageable because the documentation is already in place.
Transparency: Visually documented processes answer the common business question of “why does that take so long?”
Cost savings: Work solved at first contact or with a minimal number of escalations will result in greater efficiency and more cost-effective support. This will also lead to better customer service.
Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff
IT automation built on poorly defined, unoptimized processes leads to inconsistent results.
Documenting SOPs to prepare for an audit becomes a major time-intensive project.
Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.
Support costs are highest through inefficient processes, and proactive work becomes more difficult to schedule, making the organization vulnerable to costly disruptions.
Contact your account representative or email Workshops@InfoTech.com for more information.

Alignment on the challenges that the service desk faces, an assessment of the current state of service desk processes and technologies, and baseline metrics against which to measure improvements.
Deliverables
Embrace standardization
Increase business satisfaction
Reduce recurring issues
Increase efficiency and lower operating costs
When he joined Westminster College as CIO in 2006, the department faced several infrastructure challenges, including:
As the CIO investigated how to address the infrastructure challenges, he realized people cared deeply about how IT spent its time.
The project load of IT staff increased, with new projects coming in every day.
With a long project list, it became increasingly important to improve the transparency of project request and prioritization.
Some weeks, staff spent 80% of their time working on projects. Other weeks, support requirements might leave only 10% for project work.
He addressed the infrastructure challenges in part by analyzing IT’s routine processes.
Internally, IT had inefficient support processes that reduced the amount of time they could spend on projects.
They undertook an internal process analysis effort to identify processes that would have a return on investment if they were improved. The goal was to reduce operational support time so that project time could be increased.
Five years later, they had a better understanding of the organization's operational support time needs and were able to shift workloads to accommodate projects without compromising support.
Estimated Time: 45 minutes
A. As a group, outline the areas where you think the service desk is experiencing challenges or weaknesses. Use sticky notes or a whiteboard to separate the challenges into People, Process, and Technology so you have a wholistic view of the constraints across the department.
B. Think about the following:
C. Document challenges in the Service Desk Project Summary.
Participants:
A current-state assessment will help you build a foundation for process improvements. Current-state assessments follow a basic formula:
Ideally, the current-state assessment should align the delivery of IT services with organizational needs. The assessment should achieve the following goals:
“How do you know if you aren’t mature enough? Nothing – or everything – is recorded and tracked, customer satisfaction is low, frustration is high, and there are multiple requests and incidents that nobody ever bothers to address.”
Rob England
IT Consultant & Commentator
Owner Two Hills
Also known as The IT Skeptic
The Service Desk Maturity Assessmenttool helps organizations assess their service desk process maturity and focus the project on the activities that matter most.
The tool will help guide improvement efforts and measure your progress.
The tool is intended for periodic use. Review your answers each year and devise initiatives to improve the process performance where you need it most.
Where do I find the data?Consult:
This step will walk you through the following activities:
This step involves the following participants:
Identifying who is accountable for different support practices in the service desk will allow workload to be distributed effectively between functional teams and individuals. Closing the gaps in responsibilities will enable the execution of a shift-left strategy.
Deliverables
If you try to standardize service desk processes without engaging specialists in other parts of the IT organization, you will fail. Everyone in IT has a role to play in providing service support and meeting service-level agreements.
Specialists tend to distance themselves from service support as they progress through their career to focus on projects.
However, their cooperation is critical to the success of the new service desk. Not only do they contribute to the knowledgebase, but they also handle escalations from tiers 1 and 2.
Responsible: This person is the staff member who completes the work. Assign at least one Responsible for each task, but this could be more than one.
Accountable: This team member delegates a task and is the last person to review deliverables and/or task. Sometimes Responsible and Accountable can be the same staff. Make sure that you always assign only one Accountable for each task and not more.
Consulted: People who do not carry out the task but need to be consulted. Typically, these people are subject matter experts or stakeholders.
Informed: People who receive information about process execution and quality and need to stay informed regarding the task.
A RACI analysis is helpful with the following:
Notes:
Participants
What You'll Need
A tiered generalist service desk with a first-tier resolution rate greater than 60% has the best operating cost and customer satisfaction of all competing service desk structural models.
Estimated Time: 45 minutes
Participants
Shift-left strategy:
Identify process gaps that you need to fill to support the shift-left strategy and discuss how you could adopt or improve the shift-left strategy, using the discussion questions below as a guide.
Which process gaps do you need to fill to identify ticket trends?
Which processes do you most need to improve to support a shift-left strategy?
Document in the Project Summary
Managers and analysts will have service desk metrics and reports that help set expectations and communicate service desk performance.
Deliverables
Start with the following questions:
Work with business unit leaders to develop an action plan.
Remember to communicate what you do to address stakeholder grievances.
The service recovery paradox is a situation in which end users think more highly of IT after the organization has corrected a problem with their service compared to how they would regard the company if the service had not been faulty in the first place.
The point is that addressing issues (and being seen to address issues) will significantly improve end-user satisfaction. Communicate that you’re listening and acting, and you should see satisfaction improve.
Presentation is everything:
If you are presenting outside of IT, or using operational metrics to create strategic information, be prepared to:
For example, “Number of incidents with ERP system has decreased by 5% after our last patch release. We are working on the next set of changes and expect the issues to continue to decrease.”
Tickets MUST:
Emphasize that reports are analyzed regularly and used to manage costs, improve services, and request more resources.
Service Desk Manager: Technical staff can help themselves analyze the backlog and improve service metrics if they’re looking at the right information. Ensure their service desk dashboards are helping them identify high-priority and quick-win tickets and anticipate potential SLA breaches.
Metrics should be tied to business requirements and show how well IT is meeting those requirements and where obstacles exist.
Technicians require mostly real-time information in the form of a dashboard, providing visibility into a prioritized list of tickets for which they are responsible.
Supervisors need tactical information to manage the team and set client expectations as well as track and meet strategic goals.
Managers and executives need summary information that supports strategic goals. Start by looking at executive goals for the support team and then working through some of the more tactical data that will help support those goals.
Example:
First-call resolution (FCR), end-user satisfaction, and number of tickets reopened all work together to give you a complete picture. As FCR goes up, so should end-user satisfaction, as number of tickets re-opened stays steady or declines. If the three metrics are heading in different directions, then you know you have a problem.
Internal metrics provide you with information about your actual performance. With the right continual improvement process, you can improve those metrics year over year, which is a better measure of the performance of your service desk.
Whether a given metric is the right one for your service desk will depend on several different factors, not the least of which include:
Take external metrics with a grain of salt. Most benchmarks represent what service desks do across different industries, not what they should do. There also might be significant differences between different industries in terms of the kinds of tickets they deal with, differences which the overall average obscures.
The right metrics can tell the business how hard IT works and how many resources it needs to perform:
Metrics should be tied to business requirements. They tell the story of how well IT is meeting those requirements and help identify when obstacles get in the way. The latter can be done by pointing to discrepancies between the internal metrics you expected to reach but didn’t and external metrics you trust.
Ultimately, everything boils down to cost containment (measured by cost per ticket) and quality of service (measured by customer satisfaction).
Cost per ticket is a measure of the efficiency of service support:
Cost per ticket is the total monthly operating expense of the service desk divided by the monthly ticket volume. Operating expense includes the following components:
Participants
What You'll Need
Managers and analysts will have best practices for ticket handling and troubleshooting to support ITSM data quality and improve first-tier resolution.
DELIVERABLES
If end users are avoiding your service desk, you may have an intake problem. Create alternative ways for users to seek help to manage the volume; keep in mind not every request is an emergency.
The two most efficient intake channels should be encouraged for the majority of tickets.
The two most traditional and fastest methods to get help must deal with emergencies and escalation effectively.
If many tickets are missing, help service support staff understand the need to collect the data. Reports will be inaccurate and meaningless if quality data isn’t entered into the ticketing system.
Better data leads to better decisions. Use the Ticket and Call Quality Assessment Toolto check-in on the ticket and call quality monthly for each technician and improve service desk data quality.
Participants
What You'll Needs
Workflows for incident management and critical incident management will improve the consistency and quality of service delivery and prepare the service desk to negotiate reliable service levels with the organization.
DELIVERABLES
End users think more highly of IT after the organization has corrected a problem with their service than they would have had the service not been faulty in the first place.
Use the service recovery paradox to your advantage. Address service desk challenges explicitly, develop incident management processes that get services back online quickly, and communicate the changes.
If you show that the service desk recovered well from the challenges end users raised, you will get greater loyalty from them.
The role of an incident coordinator or manager can be assigned to anyone inside the service desk that has a strong knowledge of incident resolution, attention to detail, and knows how to herd cats.
In organizations with high ticket volumes, a separate role may be necessary.
Everyone must recognize that incident management is a cross-IT organization process and it does not have to be a unique service desk process.
An incident coordinator is responsible for:
Ben Rodrigues developed a progressive plan to create a responsive, service-oriented culture for the service support organization.
"When I joined the organization, there wasn’t a service desk. People just phoned, emailed, maybe left [sticky] notes for who they thought in IT would resolve it. There wasn’t a lot of investment in developing clear processes. It was ‘Let’s call somebody in IT.’
I set up the service desk to clarify what we would do for end users and to establish some SLAs.
I didn’t commit to service levels right away. I needed to see how many resources and what skill sets I would need. I started by drafting some SLA targets and plugging them into our tracking application. I then monitored how we did on certain things and established if we needed other skill sets. Then I communicated those SOPs to the business, so that ‘if you have an issue, this is where you go, and this is how you do it,’ and then shared those KPIs with them.
I had monthly meetings with different function heads to say, ‘this is what I see your guys calling me about,’ and we worked on something together to make some of the pain disappear."
-Ben Rodrigues
Director, IT Services
Gamma Dynacare
End Users
Technicians
Managers
Consistent incident management processes will improve end-user satisfaction with all other IT services.
However, be prepared to overcome these common obstacles as you put the process in place, including:
Participants
What You’ll Need
Different ticket types are associated with radically different prioritization, routing, and service levels. For instance, most incidents are resolved within a business day, but requests take longer to implement.
If you fail to distinguish between ticket types, your metrics will obscure service desk performance.
Organizations sometimes mistakenly classify small projects as service requests, which can compromise your data, resulting in a negative impact to the perceived value of the service desk.
Defining the differences between service requests and incidents is not just for reporting purposes. It also has a major impact on how service is delivered.
Incidents are unexpected disruptions to normal business processes and require attempts to restore services as soon as possible (e.g. the printer is not working).
Service requests are tasks that don’t involve something that is broken or has an immediate impact on services. They do not require immediate resolution and can typically be scheduled (e.g. new software).
Estimated Time: 60 minutes
Participants
What You’ll Need
Discuss these elements to see how the organization will handle them.
Critical incidents are high-impact, high-urgency events that put the effectiveness and timeliness of the service desk center stage.
Build a workflow that focuses on quickly bringing together the right people to resolve the incident and reduces the chances of recurrence.
Estimated Time: 60 minutes
Participants
What You’ll Need
When it comes to communicating during major incidents, it’s important to get the information just right. Users don’t want too little, they don’t want too much, they just want what’s relevant to them, and they want that information at the right time.
As an IT professional, you may not have a background in communications, but it becomes an important part of your job. Broad guidelines for good communication during a critical incident are:
Why does communication matter?
Sending the wrong message, at the wrong time, to the wrong stakeholders, can result in:
End users understand that sometimes things break. What’s important to them is that (1) you don’t repeatedly have the same problem, (2) you keep them informed, and (3) you give them enough notice when their systems will be impacted and when service will be returned.
In the middle of resolving a critical incident, the last thing you have time for is worrying about crafting a good message. Create a series of templates to save time by providing automated, tailored messages for each stage of the process that can be quickly altered and sent out to the right stakeholders.
Once templates are in place, when the incident occurs, it’s simply a matter of:
Tell users the information they need to know when they need to know it. If a user is directly impacted, tell them that. If the incident does not directly affect the user, the communication may lead to decreased customer satisfaction or failure to pay attention to future relevant messaging.
You’ll need distinct messages for distinct audiences. For example:
Some questions to assist you:
Customer experience programs with a combination of relationship and transactional surveys tend to be more effective. Merging the two will give a wholistic picture of the customer experience.
Relationship surveys focus on obtaining feedback on the overall customer experience.
Transactional surveys are tied to a specific interaction or transaction your end users have with a specific product or service.
A simple quantitative survey at the closing of a ticket can inform the service desk manager of any issues that were not resolved to the end user’s satisfaction. Take advantage of workflows to escalate poor results immediately for quick follow-up.
If a more complex survey is required, you may wish to include some of these questions:
Please rate your overall satisfaction with the way your issue was handled (1=unsatisfactory, 5=fantastic)
Add an open-ended, qualitative question to put the number in context, and solicit critical feedback:
What could the service desk have done to improve your experience?
Successful customer satisfaction programs respond effectively to both positive and negative outcomes. Late or lack of responses to negative comments may increase customer frustration, while not responding at all to the positive comments may give the perception of indifference. If customers are taking the time to fill out the survey, good or bad, they should be followed up with
Take these steps to handle survey feedback:
When you combine the tracking and analysis of relationship and transactional survey data you will be able to dive into specific issues, identify trends and patterns, assess impact to users, and build a plan to make improvements.
Once the survey data is centralized, categorized, and available you can start to focus on metrics. At a minimum, for transactional surveys, consider tracking:
For relationship surveys, consider tracking:
Image Source: Info-Tech End User Satisfaction Report
Prioritize company-wide improvement initiatives by those that have the biggest impact to the entire customer base first and then communicate the plan to the organization using a variety of communication channels that will draw your customers in, e.g. dashboards, newsletters, email alerts.
Consider automating or using your ITSM notification system as a direct communication method to inform the service desk manager of negative survey results.
This step involves the following participants:
The reviewed ticket categorization scheme will be easier to use and deploy more consistently, which will improve the categorization of data and the reliability of reports.
DELIVERABLES
Too many options cause confusion; too few options provide little value. As you build the classification scheme over the next few slides, let call routing and reporting requirements be your guide.
Effective classification schemes are concise, easy to use correctly, and easy to maintain.
Don’t do it alone! Collaborate with managers in the specialized IT groups responsible for root-cause analysis to develop a categorization scheme that makes sense for them.
Start with asset types if asset management and configuration management processes figure prominently in your practice or on your service management implementation roadmap.
Building the Categories
Ask these questions:
Need to make quick progress? Use Info-Tech Research Group’s Service Desk Ticket Categorization Schemes template.
Think about how you will use the data to determine which components need to be included in reports. If components won’t be used for reporting, routing, or warranty, reporting down to the component level adds little value.
Start with asset services if service management generally figures prominently in your practice, especially service catalog management.
Building the Categories
Ask these questions:
Need to make quick progress? Use Info-Tech Research Group’s Service Desk Ticket Categorization Schemes template.
Remember, ticket categories are not your only source of reports. Enhance the classification scheme with resolution and status codes for more granular reporting.
Participants
What You’ll Need
Resolution codes differ from detailed resolution notes.
Ticket statuses are a helpful field for both IT and end users to identify the current status of the ticket and to initiate workflows.
Common Examples:
Resolution Codes
Status Fields
Discuss:
Draft:
Participants
What You’ll Need
The reviewed ticket escalation and prioritization will streamline queue management, improve the quality of escalations, and ensure agents work on the right tickets at the right time.
DELIVERABLES
Mission-critical systems or problems that affect many people should always come first (i.e. Severity Level 1).
The bulk of reported problems, however, are often individual problems with desktop PCs (i.e. Severity Level 3 or 4).
Some questions to consider when deciding on problem severity include:
Decide how many severity levels the organization needs the service desk to have. Four levels of severity are ideal for most organizations.
Estimated Time: 60 minutes
Document in the SOP
Participants
What You'll Need
Estimated Time: 60 minutes
Instructions:
For each incident priority level, define the associated:
Participants
What You'll Need
Use the table on the previous slide as a guide.
Escalation is not about admitting defeat, but about using your resources properly.
Defining procedures for escalation reduces the amount of time the service desk spends troubleshooting before allocating the incident to a higher service tier. This reduces the mean time to resolve and increases end-user satisfaction.
You can correlate escalation paths to ticket categories devised in step 2.2.
Estimated Time: 60 minutes
Instructions
Estimated Time: 60 minutes
Participants
What You'll Need
Workflows for service requests will improve the consistency and quality of service delivery and prepare the service desk to negotiate reliable service levels with the organization.
DELIVERABLES
Standardize requests to develop a consistent offering and prepare for a future service catalog.
Document service requests to identify time to fulfill and approvals.
Identify which service requests can be auto-approved and which will require a workflow to gain approval.
Document workflows and analyze them to identify ways to improve SLAs. If any approvals are interrupting technical processes, rearrange them so that approvals happen before the technical team is involved.
Determine support levels for each service offering and ensure your team can sustain them.
Where it makes sense, automate delivery of services such as software deployment.
The distinction between service requests and small projects has two use cases, which are two sides of the same resourcing issue.
What’s the difference between a service request and a small project?
Example: A mid-sized organization goes on a hiring blitz and needs to onboard 150 new employees in one quarter. Submitting and scheduling 150 requests for onboarding new employees would require much more time and resources.
Common Characteristics of Projects:
Projects require greater risk, effort, and resources than a service request and should be redirected to the PMO.
Standard Requests
Non-Standard Requests
The service desk can’t and shouldn’t distinguish between requests and projects on its own. Instead, engage stakeholders to determine where to draw the line.
Whatever criteria you choose, define them carefully.
Be pragmatic: there is no single best set of criteria and no single best definition for each criterion. The best criteria and definitions will be the ones that work in your organizational context.
Participants
What You'll Need
New service desk managers sometimes try to standardize request fulfilment processes on their own only to encounter either apathy or significant resistance to change.
Moving to a tiered generalist service desk with a service-oriented culture, a high first-tier generalist resolution rate, and collaborative T2 and T3 specialists can be a big change. It is critical to get the request workflows right.
Don’t go it alone. Engage a core team of process champions from all service support. With executive support, the right process building exercises can help you overcome resistance to change.
Consider running the process building activities in this project phase in a working session or a workshop setting.
If they build it, they will come. Service desk improvement is an exercise in organizational change that crosses IT disciplines. Organizations that fail to engage IT specialists from other silos often encounter resistance to change that jeopardizes the process improvements they are trying to make. Overcome resistance by highlighting how process changes will benefit different groups in IT and solicit the feedback of specialists who can affect or be affected by the changes.
Move approvals out of technical IT processes to make them more efficient. Evaluate all service requests to see where auto-approvals make sense. Where approvals are required, use tools and workflows to manage the process.
Example:
As standard service requests should follow standard, repeatable, and predictable steps to fulfill, they can be documented with workflows.
Ensure there is a standard and predictable methodology for assessing non-standard requests; inevitably those requests may still cause delay in fulfillment.
Create a process to ensure reasonable expectations of delivery can be set with the end user and then identify what technology requests should become part of the existing standard offerings.
Participants
What You'll Need
These should all be scheduled services. Anything that is requested as a rush needs to be marked as a higher urgency or priority to track end users who need training on the process.
Critique workflows for efficiencies and effectiveness:
Participants
What You'll Need
The section will introduce service catalogs and get the organization to envision what self-service tools it might include.
DELIVERABLES
Gathering, analyzing, storing & sharing knowledge to reduce the need to rediscover known solutions.
Organized repository of IT best practices and knowledge gained from practical experiences.
Give end users a chance to resolve simple issues themselves without submitting a ticket.
Shared resource for service desk staff and managers to share and use knowledge.
Service desk teams are often overwhelmed by the idea of building and maintaining a comprehensive integrated knowledgebase that covers an extensive amount of information.
Don’t let this idea stop you from building a knowledgebase! It takes time to build a comprehensive knowledgebase and you must start somewhere.
Start with existing documentation or knowledge that depends on the expertise of only a few people and is easy to document and you will already see the benefits.
Then continue to build and improve from there. Eventually, knowledge management will be a part of the culture.
Inventory and consolidate existing documentation, then evaluate it for audience relevancy, accuracy, and usability. Use the exercise and the next slides to develop a knowledgebase template.
Assign a knowledge manager to monitor creation and edit and maintain database.
The knowledge manager role will likely be a role assigned to an existing resource rather than a dedicated position.
Options include:
Determine which features your organization needs and check to see if your tools have them.
For more information on knowledgebase improvement, refer to Info-Tech’s Optimize the Service Desk With a Shift-Left Strategy.
Workflow should include:
Participants
What You’ll Need
Write and critique knowledgebase articles.
Audience: Technician
Audience: End users
Participants
What You’ll Need
The section prepares you to tackle a self-service portal project once the service desk standardization is complete.
DELIVERABLES
Some companies use vending machines as a form of self serve. Users can enter their purchase code and “buy” a thin client, mouse, keyboard, software, USB keys, tablet, headphones, or loaners.
Building the basics first will provide your users with immediate value. Incrementally add new features to your portal.
Don’t build a portal framed around current offerings and capabilities just for the sake of it. Build the portal based on what your users want and need if you want them to use it.
The portal should be designed for users to self-serve, and thus self-service must be seamless, clear, and attractive to users.
Keep in mind that users may not have high technical literacy or be familiar with terminology that you find commonplace. Use terms that are easy to understand.
Ensure that users can find what they’re looking for both by browsing the site and by using search functionality.
If multiple departments (i.e. HR, Finance) use or will use a portal, set up a shared portal so that users won’t have to guess where to go to ask for help.
You will know how to navigate the portal better than anyone, but that doesn’t mean it’s intuitive for a new user. Test the portal with users to collect and incorporate feedback.
Image source: Cherwell Service Management
Image source: Team Dynamix
For more information on building self-service portal, refer to Info-Tech’s Optimize the Service Desk with a Shift-Left Strategy
Participants
What You’ll Need
A service catalog is a communications device that lists the IT services offered by an organization. The service catalog is designed to enable the creation of a self-service portal for the end user. The portal augments the service desk so analysts can spend time managing incidents and providing technical support.
The big value comes from workflows:
There are three types of catalogs:
Image courtesy of University of Victoria
Sample Service Catalog Efforts
“I would say a client with 2,000 users and an IT department with a couple of hundred, then you're looking at six months before you have the catalog there.”
– Service Catalog Implementation Specialist,
Health Services
Identify stakeholders who can contribute to the project.
Evaluate tool options.
Identify the high-level tasks that need to be done.
Document the plan and tasks in the Service Desk Roadmap.
Examples of publicly posted service catalogs:
University of Victoria is an example of a catalog that started simple and now includes multiple divisions, notifications, systems status, communications, e-commerce, incident registration, and more.
Indiana University is a student, faculty, and staff service catalog and self-service portal that goes beyond IT services.
The communication plan and project summary will help project managers outline recommendations and communicate their benefits.
DELIVERABLES
An effective communication plan will:
Build a communication plan to:
Estimated Time: 45 minutes
Develop a stakeholder analysis.
Craft key messages tailored to each stakeholder group.
Finalize the communication plan.
Participants
The implementation plan will help track and categorize the next steps and finalize the project.
DELIVERABLES
Estimated Time: 45 minutes
Determine the sequence of improvement initiatives that have been identified throughout the project.
The purpose of this exercise is to define a timeline and commit to initiatives to reach your goals.
Instructions:
Participants
Document using the Roadmap tool.
ImplementHardware and Software Asset Management
Optimize Change Management Incident and Problem Management Build a Continual Improvement Plan for the Service DeskThe Standardize blueprint reviews service desk structures and metrics and builds essential processes and workflows for incident management, service request fulfillment, and knowledge management practices.
Once the service desk is operational, there are three paths to basic ITSM maturity:
Solicit targeted department feedback on core IT service capabilities, IT communications, and business enablement. Use the results to assess the satisfaction of end users, with each service broken down by department and seniority level.
“Help Desk Staffing Models: Simple Analysis Can Save You Money.” Giva, Inc., 2 Sept. 2009. Web.
Marrone et al. “IT Service Management: A Cross-national Study of ITIL Adoption.” Communications of the Association for Information Systems: Vol. 34, Article 49. 2014. PDF.
Rumburg, Jeff. “Metric of the Month: First Level Resolution Rate.” MetricNet, 2011. Web.
“Service Recovery Paradox.” Wikipedia, n.d. Web.
Tang, Xiaojun, and Yuki Todo. “A Study of Service Desk Setup in Implementing IT Service Management in Enterprises.” Technology and Investment: Vol. 4, pp. 190-196. 2013. PDF.
“The Survey of Adult Skills (PIAAC).” Organisation for Economic Co-operation and Development (OECD), 2016. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Plan out your employee engagement program and launch the Employee Experience Monitor survey for your team.
Interpret your Employee Experience Monitor results, understand what they mean in the context of your team, and involve your staff in brainstorming engagement initiatives.
Select engagement initiatives for maximal impact, create an action plan, and establish open and ongoing communication about engagement with your team.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Set up the EXM and collect a few months of data to build on during the workshop.
Arm yourself with an index of employee experience and candid feedback from your team to use as a starting point for your engagement program.
1.1 Identify EXM use case.
1.2 Identify engagement program goals and obstacles.
1.3 Launch EXM.
Defined engagement goals.
EXM online dashboard with three months of results.
To understand the current state of engagement and prepare to discuss the drivers behind it with your staff.
Empower your leadership team to take charge of their own team's engagement.
2.1 Review EXM results to understand employee experience.
2.2 Finalize focus group agendas.
2.3 Train managers.
Customized focus group agendas.
Establish an open dialogue with your staff to understand what drives their engagement.
Understand where in your team’s experience you can make the most impact as an IT leader.
3.1 Identify priority drivers.
3.2 Identify engagement KPIs.
3.3 Brainstorm engagement initiatives.
3.4 Vote on initiatives within teams.
Summary of focus groups results
Identified engagement initiatives.
Learn the characteristics of successful engagement initiatives and build execution plans for each.
Choose initiatives with the greatest impact on your team’s engagement, and ensure you have the necessary resources for success.
4.1 Select engagement initiatives with IT leadership.
4.2 Discuss and decide on the top five engagement initiatives.
4.3 Create initiative project plans.
4.4 Build detailed project plans.
4.5 Present project plans.
Engagement project plans.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use Info-Tech’s licensing best practices to avoid the common mistakes of overspending on IBM licensing or failing an IBM audit.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify the symptoms of inadequate IT support of digital marketing to diagnose the problems in your organization.
Identify the untapped digital marketing value in your organization to understand where your organization needs to improve.
Develop a plan for communicating with stakeholders to ensure buy-in to the digital marketing capability building project.
Assess how well each digital channel reaches target segments. Identify the capabilities that must be built to enable digital channels.
Assess the people, processes, and technologies required to build required capabilities and determine the best fit with your organization.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine the fit of each digital channel with your organizational goals.
Determine the fit of digital channels with your organizational structure and business model.
Compare the fit of digital channels with your organization’s current levels of use to:Identify missed opportunities your organization should capitalize on.Identify digital channels that your organization is wasting resources on.
Identify missed opportunities your organization should capitalize on.
Identify digital channels that your organization is wasting resources on.
IT department achieves consensus around which opportunities need to be pursued.
Understanding that continuing to pursue excellent-fit digital channels that your organization is currently active on is a priority.
Identification of the channels that stopping activity on could free up resources for.
1.1 Define and prioritize organizational goals.
1.2 Assess digital channel fit with goals and organizational characteristics.
1.3 Identify missed opportunities and wasted resources in your digital channel mix.
1.4 Brainstorm creative ways to pursue untapped digital channels.
Prioritized list of organizational goals.
Assigned level of fit to digital channels.
List of digital channels that represent missed opportunities or wasted resources.
List of brainstormed ideas for pursuing digital channels.
Identify the digital channels that will be used for specific products and segments.
Identify the IT capabilities that must be built to enable digital channels.
Prioritize the list of IT capabilities.
IT and marketing achieve consensus around which digital channels will be pursued for specific product-segment pairings.
Identification of the capabilities that IT must build.
2.1 Assess digital channel fit with specific products.
2.2 Identify the digital usage patterns of target segments.
2.3 Decide precisely which digital channels you will use to sell specific products to specific segments.
2.4 Identify and prioritize the IT capabilities that need to be built to succeed on each digital channel.
Documented channel fit with products.
Documented channel usage by target segments.
Listed digital channels that will be used for each product-segment pairing.
Listed and prioritized capabilities that must be built to enable success on necessary digital channels.
Identification of the best possible way to build IT capabilities for all channels.
Creation of a plan for leveraging transformational analytics to supercharge your digital marketing strategy.
IT understanding of the costs and benefits of capability building options (people, process, and technology).
Information about how specific technology vendors could fit with your organization.
IT identification of opportunities to leverage transformational analytics in your organization.
3.1 Identify the gaps in your IT capabilities.
3.2 Evaluate options for building capabilities.
3.3 Identify opportunities for transformational analytics.
A list of IT capability gaps.
An action plan for capability building.
A plan for leveraging transformational analytics.
After three decades navigating the complexities of organizational resilience, one truth stands clearer than ever: you cannot truly protect what you do not deeply understand. And for any business, especially in today's dynamic landscape, what you do is ultimately about what you do for your customers. There is something that I see insufficiently matured or missing in many companies: building a comprehensive “service map.”
Think about it. We pour resources into product development, marketing, and sales, yet how often do we collectively pause to articulate, across all departments, exactly what services we provide to our customers? It sounds simple, doesn't it? Yet, the reality is typically a fragmented understanding, siloed information, and a distinct lack of a holistic view, except by a few key people.
Why is this clear view so critical? Because your customers don't interact with your internal departments; they interact with your services. They don't care about your organizational chart; they care about how seamlessly you meet their needs. Without a clear service map, you have blind spots. You miss opportunities for optimization, you introduce friction into customer journeys, and critically, you compromise your ability to recover when things go wrong. Resilience isn't just about bouncing back; it's about understanding what's truly essential to protect your customer relationships.
Let's make this real.
What services do banks offer? It’s far more than just “banking.” They provide:
Retail Banking: Current accounts, savings accounts, debit/credit cards, personal loans, mortgages.
Investment Services: Wealth management, brokerage, mutual funds, pension products.
Business Banking: Corporate loans, treasury services, payroll solutions, trade finance.
Digital Services: Online banking platforms, mobile apps, and payment gateways.
Advisory Services: Financial planning, retirement planning, and estate planning.
Let's hone in on an often complex offering: a pension savings product where you contribute monthly. This isn't just a “product” on a shelf; it's a living, breathing service with a distinct customer journey.
Imagine the customer journey for this:
Customer Initiates Payment (or Automated Process Triggers): On the designated payment date, a SEPA Direct Debit instruction is initiated, pulling funds from the customer's linked bank account.
Funds Transfer & Clearance: The funds travel through interbank networks, cleared and settled between the customer's bank and the financial institution’s holding accounts.
Internal Reconciliation & Allocation: Upon receipt, the funds are reconciled against the customer's pension account number and allocated to their specific pension product.
Investment Instruction: Based on the product's pre-defined investment strategy (e.g., a balanced fund, equity fund), an instruction is generated to purchase units in the underlying investments.
Market Execution: The instruction is sent to the relevant trading desks or automated systems, which execute the purchase of shares, bonds, or other assets on the stock market at prevailing market prices.
Confirmation & Update: Once the trade is settled, the customer's pension account is updated to reflect the new units purchased and the updated total value, often visible via an online portal or statement.
For every single step in this service, your organization needs robust capabilities to make these steps visible and resilient to all stakeholders who “work around that service.” This isn't just for IT; it's for compliance, operations, customer service, and even marketing.
Let's look at the same for a realtor company specializing in rental properties:
Service Map for property owners and landlords:
Property Listing & Marketing: Creating professional listings, photography, virtual tours, and advertising on various platforms (online portals, social media, and local networks).
Tenant Sourcing & Vetting: Conducting viewings, screening potential tenants (credit checks, employment verification, previous landlord references), and background checks.
Lease Agreement Management: Drafting, negotiating, and executing legally compliant rental contracts.
Property Maintenance & Repairs Coordination: Arranging routine maintenance, coordinating emergency repairs with vetted contractors, and overseeing work quality.
Property Inspections: Conducting periodic property inspections (move-in, routine, move-out) to ensure property condition and compliance with lease terms.
Compliance & Legal Guidance: Advising on landlord-tenant laws, health & safety regulations, and handling eviction processes if necessary.
Security Deposit Management: Collecting, holding, and returning security deposits in accordance with legal requirements.
Services for tenants:
Property Search & Matching: Assisting prospective tenants in finding suitable properties based on their needs and budget.
Viewing Scheduling: Arranging property viewings and providing access.
Application Processing: Guiding tenants through the application process and necessary documentation.
Lease Onboarding: Explaining lease terms, facilitating key handover, and conducting move-in inspections.
Maintenance Request Handling: A clear process for tenants to report maintenance issues and track resolution.
Emergency Support: Providing contact points and procedures for urgent property-related emergencies.
Lease Renewal & Move-out Support: Managing lease renewals, providing guidance on move-out procedures, and facilitating security deposit returns.
Many of these will require automated systems. The customer-facing ones even more so. You need to understand the customer journeys for each entry in your service map.
You need:
Comprehensive Monitoring & Alerting: Real-time visibility into every step of the journey, flagging anomalies or delays before they become customer-impacting issues. Build monitoring capabilities into the systems and build the operational capability to follow up on alerts and events. There are now products on the market that can do a lot of the heavy lifting for you. Be prepared to open your wallet. This is not cheap. I hear AI already rolling off the tongues: this is not cheap. For smaller service maps and customer journeys, consider using built-in tools and hiring a small team of people that can leverage the next points. For large institutions, let alone manufacturing, automation and continuous testing are key.
Centralized Knowledge Management: A single source of truth for service definitions, processes, dependencies, and known issues, accessible to everyone who needs it. No more tribal knowledge. For condensed setups, it can be as simple as a folder on a hard drive that contains your knowledge base articles (aka Word documents that explain the process, how it was set up, what you need to operate it etc.). Most businesses will use some form of knowledge management system that is a bit more sophisticated, perhaps even built-in to the IT Operations Management (ITOM) tooling. It's a shame it's called IT ops tooling, because you can equally use this for business process documentation. Just remember the last bullet below: DR and BCP. Your knowledge system is useless if you cannot get to it!
Robust Development & Operations Processes: Seamless collaboration between development, operations, and business teams to make sure services are built, tested, deployed, and managed efficiently and reliably. It does not really matter if you want to use DevOps, or change/run, or scrum and squads, or anything in between. Pick what works in your culture. Also, it is not one-size-fits-all. Some systems are core and require a more strict regimen; others must be able to turn on a dime. But whatever you use: keep your service and the customer journey through it front and center. Build it so that you have clearly separated “stations” where something is done to fulfill the system. Make the mental analogy with a factory. It will keep each station atomic, so that when the time comes to make changes, you can do so without having to re-invent large parts of the value delivery chain.
End-to-End Security Protocols: Protect sensitive customer data and financial transactions at every touchpoint throughout the journey. I mean, duh. You must. This is non-negotiable. This includes your backups. Large or small company, you must maintain backups. Use the 321 method: 3 copies of your data and setups on 2 different platforms or data storage carriers and 1 offsite. Your backups should include at least 1 immutable copy. That is a copy that cannot be altered. Large firms partner with their hosting companies to include that in the service offering; small companies have cheap options. I use 2 separate backup providers (total cost around €100/month at the time of writing in 2025) and my own disconnected storage carriers. I even use a backup provider and disconnected storage for my family's data (around €25/month).
Effective Disaster Recovery (DR) & Business Continuity Planning (BCP) Capabilities: Understanding critical service components, their recovery time objectives (RTOs), and recovery point objectives (RPOs) to ensure rapid restoration of service even after major disruptions. This isn't a theoretical exercise; it needs to be tested and proven. Your expectations also need to be realistic.
There are more elements to consider when building your service map and the customer journeys when it comes to resilience. Things like performance metrics, scalability, peak usage management, and so on. McKinsey wrote years ago, design for the storm, not the sunny days. That is right, but keep the design within the commercial service parameters. It is equally bad to overbuild to a $5 million system, if your expected revenue is less than $100,000 a year, than it is to use a $10,000 system to support a $5 million revenue stream. (I remember the Excel sheet from hell that actually supported a macro-economist at a large brokerage.)
Start mapping your services today. Start with what you feel are the most critical ones. You'll uncover inefficiencies, mitigate risks, and strengthen the very foundation of your customer relationships. You may even save some money.
New technologies such as generative AI, quantum computing, 5G cellular networks, and next-generation robotics are ushering in an exciting new era of business transformation. By adopting an exponential IT mindset, IT leaders will be able to lead the autonomization of business capabilities.
To capitalize on this upcoming opportunity, exponential IT leaders will have to become business advisors who unlock exponential value for the business and help mitigate exponential risk.
An exponential IT mindset means that IT leaders will need to take a lead role in transforming business capabilities.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
The role of IT has evolved throughout the past couple generations to enable fundamental business transformations. In the autonomization era, it will have to evolve again to lead the business through a world of exponential opportunity.
For more than 40 years, information technology has significantly transformed businesses, from the computerization of operations to the digital transformation of business models. As technological disruption accelerates exponentially, a world of exponential business opportunity is within reach.
Newly emerging technologies such as generative AI, quantum computing, 5G cellular networks, and next-generation robotics are enabling autonomous business capabilities.
The role of IT has evolved throughout the past couple generations to enable business transformations. In the autonomization era, it will have to evolve again. IT will have a new mission, an adapted governance structure, innovative capabilities, and an advanced partnership model.
CIOs embracing exponential IT require a new mindset. Their IT practices will need to progress to the top of the maturity ladder as they make business outcomes their own.
The use of computer devices, networks, and applications became widespread in the enterprise. The focus was on improving the efficiency of back-office tasks.
As the world became connected through the internet, new digitally enabled business models emerged in the enterprise. Orders were now being received online, and many products and services were partially or fully digitized for online fulfillment.
The global average share of customer interactions that are digital went from 36% to 58% in less than a year.*
The global average share of partially or fully digitized products went from 35% to 55% in the same period.*
The adoption of digitalized business models has accelerated during the pandemic. Post-pandemic, it is unlikely for adoption to recede.
With more business applications ported to the cloud and more data available online, “digital-first” organizations started to envisage a next wave of automation.
*Source: “How COVID-19 has pushed companies over the technology tipping point—and transformed business forever,” McKinsey & Company, 2020
We found that 63% of IT leaders plan to use AI within their organizations to automate repetitive, low-level tasks by the end of 2023.
With the release of the ChatGPT prototype in November 2022, setting a record for the fastest user growth (reaching 100 million active users just two months after launch), we foresee that AI adoption will accelerate significantly and its use will extend to more complex tasks.
As digitalization accelerates, a post-pandemic world with a largely online workforce and digitally transformed enterprise business models now enters an era where more business capabilities become autonomous, with humans at the center of a loop* that is gradually becoming larger.
Deep Learning, Quantum Computing, 5G Networks, Robotics
* Download Info-Tech’s CIO Trend Report 2019 – Become a Leader in the Loop
1980sComputerizationIT professionals gathered functional requirements from the business to help automate back-office tasks and improve operational efficiency. | 2000sDigitalizationIT professionals acquired business analysis skills and leveraged the SMAC (social, mobile, analytics, and cloud) stack to accelerate the automation of the front office and enable the digital transformation of business models. | 2020sAutonomizationIT professionals will become business advisors and enable the establishment of autonomous yet differentiated business processes and capabilities. |
While some analysts have been quick to announce the demise of the IT department and the transition of the role of IT to the business, the budgets that CIOs control have continued to rise steadily over time.
In a high-risk, high-reward endeavor to make business processes autonomous, the role of IT will continue to be pivotal, because while everyone in the organization will rush to seize the value opportunity, the technology risk will be left for IT to manage.
Autonomous processes will integrate with human-led processes, creating risks to business continuity, information security, and quality of delivery. Supplier power will exacerbate business risks.
The efficiency gains and new value chains created through artificial intelligence, robotics, and additive manufacturing will be very significant. Most of this value will be realized through the augmentation of human labor.
Autonomous solutions for productivity and back-office applications will eventually become commoditized and provided by a handful of large vendors. There will, however, be a proliferation of in-house algorithms and workflows to autonomize the middle and front office, offered by a busy landscape of industry-centric capability vendors.
Exponential IT involves IT leading the cognitive reengineering of the organization with evolved practices for:
A Connected World
An Exponential World
Research has shown that companies that are more digitally mature have higher growth than the industry average. In these companies, the CIO is part of the executive management team.
And while the role of the CIO is generally tied to their mandate within the organization, we have seen their role progress from doer to leader as IT climbs the maturity ladder.
As companies strive to succeed in the next phase of technology-driven transformation, CIOs have an opportunity to demonstrate their business leadership. To do so, they will have to provide exceptionally mature services while owning business targets.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This blueprint will help you:
This template will help you to build your proposal to transform your field services.
Many IT teams are struggling to keep up with demand while trying to refocus on customer service. With more remote workers than ever, organizations who have traditionally provided desktop and field services have been revaluating the role of the field service technicians. Add in the price of fuel, and there is even more reason to assess the support model. Often changes to the way IT does support, especially if moving centralized support to an outsourcer, is met with resistance by end users who don’t see the value of phoning someone else when their local technician is still available to problem solve. This speaks to the need to ensure the central group is providing value to end users as well as the technical team. With the challenges of finding the right number of technicians with the right skills, it’s time to rethink remote support and how that can be used to train and upskill the people you have. And it’s time to think about how to use field services tools to make the best use of your technician’s time.
Sandi Conrad
Principal Research Director
Infrastructure & Operations Practice
Info-Tech Research Group
With remote work becoming a normal employee offering for many organizations, self-serve/self-solve becoming more prominent, and a common call out to improve customer service, there is a need to re-examine the way many organizations are supplying onsite support. For organizations with a small number of offices, a central desk with remote tools may be enough or can be combined with a concierge service or technical center, but for organizations with multiple offices it becomes difficult to provide a consistent level of service for all customers unless there is a team onsite for each location. This may not be financially possible if there isn’t enough work to keep a technical team busy full-time.
Where people have a choice between calling a central phone number or talking to the technician down the hall, the in-person experience often wins out. End users may resist changes to in-person support as work is rerouted to a centralized group by choosing to wait for their favorite technician to show up onsite rather than reporting issues centrally. This can make the job of the onsite technician more challenging as they need to schedule time in every visit for unplanned work. And where technicians need to support multiple locations, travel needs to be calculated into lost technician time and costs.
Improving process will be helpful for smaller teams, but as teams expand or work gets more complicated, investment in appropriate tools to support field services technicians will enable them to be more efficient, reduce costs, and improve outcomes when visits are warranted.
With many companies having new work arrangements for users, where remote work may be a permanent offering or if your digital transformation is well underway, this provides an opportunity to rethink how field support needs to be done.
Field services is in-person support delivered onsite at one or more locations. Management of field service technicians may include queue management, scheduling service and maintenance requests, triaging incidents, dispatching technicians, ordering parts, tracking job status, and billing.
Focus on the reasons for the change to ensure the outcome can be met. Common goals include improved customer service, better technician utilization, and increased response time and stability.
|
Customer Intake Provide tools for scheduling technicians, self-serve and self- or assisted-solve through ITSM or CRM-based portal and visual remote tools. |
![]() |
Triage and Troubleshoot Upgrade remote tools to visual remote solutions to troubleshoot equipment as well as software. Eliminate no-fault-found visits and improve first-time fix rate by visually inspecting equipment before technician deployments. |
|
Improve Communications FSM GPS and SMS updates can be set to notify customers when a technician is close by and can be used for customer sign-off to immediately update service records and launch survey or customer billing where applicable. |
Schedule Technicians Field service management (FSM) ITSM modules will allow skills-based scheduling for remote technicians and determine best route for multi-site visits. |
|
|
Enable Work From Anywhere FSM mobile applications can provide technicians with daily schedules, turn-by-turn directions, access to inventory, knowledge articles, maintenance, and warranty and asset records. Visual remote captures service records and enables access to SMEs. |
Manage Expectations Know where technicians are for routing to emergency calls and managing workload using field service management solutions with GPS. |
Field services management (FSM) software is designed to improve scheduling of technicians by skills and location while reducing travel time and mileage. When integrated with ITSM software, the service record is transferred to the field technician for continuity and to prepare for the job. FSM mobile apps will enable technicians to receive schedule updates through the day and through GPS update the dispatcher as technicians move from site to site.
FSM solutions are designed to manage large teams of technicians, providing automated dispatch recommendations based on skills matching and proximity. |
Routes can be mapped to reduce travel time and mileage and adjusted to respond to emergency requests by technician skills or proximity. Automation will provide suggestions for work allocation. |
Spare parts management may be part of a field services solution, enabling technicians to easily identify parts needed and update real-time inventory as parts are deployed. |
Push notifications in real-time streamline communications from the field to the office, and enable technicians to close service records while in the field. |
Dispatchers can easily view availability, assign work orders, attach notes to work orders, and immediately receive updates if technicians acknowledge or reject a job. |
Maintenance work can be built into online checklists and forms to provide a technician with step-by-step instructions and to ensure a complete review. |
Skills and location-based routing allow dispatchers to be able to see closest tech for emergency deployments. |
Visual remote support tools enable live video sessions to clearly see what the client or field service technician sees, enabling the experts to provide real-time assistance where the experts will provide guidance to the onsite person. Getting a view of the technology will reduce issues with getting the right parts, tools, and technicians onsite and dramatically reduce second visits.
Visual remote tools can provide secure connections through any smartphone, with no need for the client to install an application. |
The technicians can take control of the camera to zoom in, turn on the flashlight for extra lighting, take photos, and save video directly to the tickets. |
Optical character recognition allows automatic text capture to streamline process to check warranty, recalls, and asset history. |
Visual, interactive workflows enhance break/fix and inspections, providing step-by-step guidance visual evidence and using AI and augmented reality to assess the images, and can provide next steps by connecting to a visual knowledgebase. |
Integration with field service management tools will allow information to easily be captured and uploaded immediately into the service record. |
Self-serve is available through many of these tools, providing step-by-step instructions using visual cues. These solutions are designed to work in low-bandwidth environments, using Wi-Fi or cellular service, and sessions can be started with a simple link sent through SMS. |
With COVID-19's rapid spread through populations, governments are looking for technology tools that can augment the efforts of manual contact tracing processes. How the system is designed is crucial to a positive outcome.
Mobile contact tracing apps that use a decentralized design approach will be the most likely to be adopted by a wide swath of the population.
There are some key considerations to realize from the way different governments are approaching contact tracing:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
The technical side of IT security demands the best security possible, but the business side of running IT demands that you determine what is cost-effective and can still do the job. You likely shrugged off the early iterations of Microsoft’s security efforts, but you may have heard that things have changed. Where do you start in evaluating Microsoft’s security products in terms of effectiveness? The value proposition sounds tremendous to the CFO, “free” security as part of your corporate license, but how does it truly measure up and how do you articulate your findings to the business?
Microsoft’s security products have improved to the point where they are often ranked competitively with mainstream security products. Depending on your organization’s licensing of Office 365/Microsoft 365, some of these products are included in what you’re already paying for. That value proposition is hard to deny.
Determine what is important to the business, and in what order of priority.
Take a close look at your current solution and determine what are table stakes, what features you would like to have in its replacement, and what your current solution is missing.
Consider Microsoft’s security solutions using an objective methodology. Sentiment will still be a factor, but it shouldn’t dictate the decision you make for the good of the business.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Examine what you are licensed for, what you are paying, what you need, and what your constraints are.
Determine what is “good enough” security and assess the needs of your organization.
Decide what you will go with and start planning your next steps.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Determine how to establish the foundation of your security operations.
Assess the maturity of your prevention, detection, analysis, and response processes.
Design a target state and improve your governance and policy solutions.
Make your case to the board and develop a roadmap for your prioritized security initiatives.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify security obligations and the security operations program’s pressure posture.
Assess current people, process, and technology capabilities.
Determine foundational controls and complete system and asset inventory.
Identified the foundational elements needed for planning before a security operations program can be built
1.1 Define your security obligations and assess your security pressure posture.
1.2 Determine current knowledge and skill gaps.
1.3 Shine a spotlight on services worth monitoring.
1.4 Assess and document your information system environment.
Customized security pressure posture
Current knowledge and skills gaps
Log register of essential services
Asset management inventory
Identify the maturity level of existing security operations program processes.
Current maturity assessment of security operations processes
2.1 Assess the current maturity level of the existing security operations program processes.
Current maturity assessment
Design your optimized target state.
Improve your security operations processes with governance and policy solutions.
Identify and prioritize gap initiatives.
A comprehensive list of initiatives to reach ideal target state
Optimized security operations with repeatable and standardized policies
3.1 Complete standardized policy templates.
3.2 Map out your ideal target state.
3.3 Identify gap initiatives.
Security operations policies
Gap analysis between current and target states
List of prioritized initiatives
Formalize project strategy with a project charter.
Determine your sourcing strategy for in-house or outsourced security operations processes.
Assign responsibilities and complete an implementation roadmap.
An overarching and documented strategy and vision for your security operations
A thorough rationale for in-house or outsourced security operations processes
Assigned and documented responsibilities for key projects
4.1 Complete a security operations project charter.
4.2 Determine in-house vs. outsourcing rationale.
4.3 Identify dependencies of your initiatives and prioritize initiatives in phases of implementation.
4.4 Complete a security operations roadmap.
Security operations project charter
In-house vs. outsourcing rationale
Initiatives organized according to phases of development
Planned and achievable security operations roadmap