IBM i Migration Considerations

Don’t be overwhelmed by IBM i migration options.

Executive Summary

Your Challenge

IBM i remains a vital platform and now many CIO, CTO, and IT leaders are faced with the same IBM i challenges regardless of industry focus; how do you evaluate the future viability of this platform, assess the future fit and purpose, develop strategies, and determine the future of this platform for your organization?

Common Obstacles

For organizations that are struggling with the iSeries/IBM i platform, resourcing challenges are typically the culprit. An aging population of RPG programmers and system administrators means organizations need to be more proactive in maintaining in-house expertise. Migrating off the iSeries/IBM i platform is a difficult option for most organizations due to complexity, switching costs in the short term, and a higher long-term TCO.

Info-Tech Approach

The most common tactic is for the organization to better understand its IBM i options and adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house. To make the evident, obvious: the options here for the non-commodity are not as broad as with commodity server platforms. Options include co-location, onsite outsourcing, managed hosting, and public cloud services.

Info-Tech Insight

“For over twenty years, IBM was ‘king,’ dominating the large computer market. By the 1980s, the world had woken up to the fact that the IBM mainframe was expensive and difficult, taking a long time and a lot of work to get anything done. Eager for a new solution, tech professionals turned to the brave new concept of distributed systems for a more efficient alternative. On June 21, 1988, IBM announced the launch of the AS/400, their answer to distributed computing.” (Dale Perkins)

Review

We help IT leaders make the most of their IBM i environment.

Problem Statement:

The IBM i remains a vital platform for many businesses and continues to deliver exceptional reliability and performance and play a key role in the enterprise. With the limited resources at hand, CIOs and the like must continually review and understand their migration path with the same regard as any other distributed system roadmap.

This research is designed for:

• IT strategic direction decision makers
• IT managers responsible for an existing iSeries or IBM i platform
• Organizations evaluating platforms for mission-critical applications

This research will help you:

1. Evaluate the future viability of this platform.
2. Assess the fit, purpose, and price.
3. Develop strategies for overcoming potential challenges.
4. Determine the future of this platform for your organization.

The “fit for purpose” plot

Thought Model We will investigate the aspect of different IBM i scenarios as they impact business, what that means, and how that can guide the questions that you are asking as you move to an aligned IBM i IT strategy. Our model considers: Importance to Business Outcomes Important to strategic objectives Provides competitive advantage Non-commodity IT service or process Specialized in-house knowledge required Vendor’s Performance Advantage Talent or access to skills Economies of scale or lower cost at scale Access to technology Info-Tech Insights With multiple control points to be addressed, care must be taken in simplifying your options while addressing all concerns to ease operational load.

IBM i environments are challenging

Understand your options

Co-Location

Provider manages the data center hardware environment.

Onsite Sourcing

A provider will support the hardware/system environment at the client’s site.

Managed Hosting

Transition legacy application environment to an off-prem hosted multi-tenanted environment.

Public Cloud

Leverage “public cloud” alternatives with AWS, Google, or Microsoft AZURE.

Understand your vendors

Activity

Understand your vendor options

Activities:

1. Create your vendor profiles
2. Score vendor responses
3. Develop and manage your vendor agenda

This activity involves the following participants:

• IT strategic direction decision makers
• IT managers responsible for an existing iSeries or IBM i platform

Outcomes of this step:

• Vendor Profile Template
• Completed IT Infrastructure Outsourcing Scoring Tool

Info-Tech Insights

This check-point process creates transparency around agreement costs with the business and gives the business an opportunity to re-evaluate its requirements for a potentially leaner agreement.

1. Create your vendor profiles

Define what you are looking for:

2. Score your vendor responses

Use the IT Infrastructure Outsourcing Scoring Tool to manage vendor responses.

Use Info-Tech’s IT Infrastructure Outsourcing Scoring Tool to systematically score your vendor responses. The overall quality of the IBM i questions can help you understand what it might be like to work with the vendor. Consider the following questions: Is the vendor clear about what it’s able to offer? Is its response transparent? How much effort did the vendor put into answering the questions? Does the vendor seem like someone you would want to work with? Once you have the vendor responses, you will select two or three vendors to continue assessing in more depth leading to an eventual final selection.

Info-Tech Insights

Watch out for misleading scores that result from poorly designed criteria weightings.

3. Develop your vendor agenda

Related Info-Tech Research

Effectively Acquire Infrastructure Services
Acquiring a service is like buying an experience. Don’t confuse the simplicity of buying hardware with buying an experience.

Outsource IT Infrastructure to Improve System Availability, Reliability, and Recovery
There are very few IT infrastructure components you should be housing internally – outsource everything else.

Build Your Infrastructure Roadmap
Move beyond alignment: Put yourself in the driver’s seat for true business value.

Define Your Cloud Vision
Make the most of cloud for your organization.

Document Your Cloud Strategy
Drive consensus by outlining how your organization will use the cloud.

Create a Right-Sized Disaster Recovery Plan
Close the gap between your DR capabilities and service continuity requirements.

Create a Better RFP Process
Improve your RFPs to gain leverage and get better results.

Research Authors

Darin Stahl, Principal Research Advisor, Info-Tech Research Group Principal Research Advisor within the Infrastructure Practice and leveraging 38+ years of experience, his areas of focus include: IT Operations Management, Service Desk, Infrastructure Outsourcing, Managed Services, Cloud Infrastructure, DRP/BCP, Printer Management, Managed Print Services, Application Performance Monitoring (APM), Managed FTP, and non-commodity servers (zSeries, mainframe, IBM i, AIX, Power PC).

Troy Cheeseman, Practice Lead, Info-Tech Research Group Troy has over 24 years of experience and has championed large, enterprise-wide technology transformation programs, remote/home office collaboration and remote work strategies, BCP, IT DRP, IT Operations and expense management programs, international right placement initiatives, and large technology transformation initiatives (M&A). Additionally, he has deep experience working with IT solution providers and technology (cloud) start-ups.

Research Contributors

Dan Duffy, President & Owner, Mid-Range Dan Duffy is the President and Founder of Mid-Range Computer Group Inc., an IBM Platinum Business Partner. Dan and his team have been providing the Canadian and American IBM Power market with IBM infrastructure solutions including private cloud, hosting and disaster recovery, high availability and data center services since 1988. He has served on numerous boards and associations including the Toronto Users Group for Mid-Range Systems (TUG), the IBM Business Partners of the Americas Advisory Council, the Cornell Club of Toronto, and the Notre Dame Club of Toronto. Dan holds a Bachelor of Science from Cornell University.

George Goodall, Executive Advisor, Info-Tech Research Group George Goodall is an Executive Advisor in the Research Executive Services practice at Info-Tech Research Group. George has over 20 years of experience in IT consulting, enterprise software sales, project management, and workshop delivery. His primary focus is the unique challenges and opportunities in organizations with small and constrained IT operations. In his long tenure at Info-Tech, George has covered diverse topics including voice communications, storage, and strategy and governance.

Bibliography

“Companies using IBM i (formerly known as i5/OS).” Enlyft, 21 July 2021. Web.

Connor, Clare. “IBM i and Meeting the Challenges of Modernization.” Ensono, 22 Mar. 2022. Web.

Huntington, Tom. “60+ IBM i User Groups and Communities to Join?” HelpSystems, 16 Dec. 2021. Web.

Perkins, Dale. “The Road to Power Cloud: June 21st 1988 to now. The Journey Continues.” Mid-Range, 1 Nov. 2021. Web.

Prickett Morgan, Timothy. “How IBM STACKS UP POWER8 AGAINST XEON SERVERS.” The Next Platform, 13 Oct. 2015. Web.

“Why is AS/400 still used? Four reasons to stick with a classic.” NTT, 21 July 2016. Web.

Appendix

Public Cloud Provider Notes

Define Your Cloud Vision

Define your cloud vision before it defines you

Analyst perspective

Use the cloud’s strengths. Mitigate its weaknesses.

The cloud isn’t magic. It’s not necessarily cheaper, better, or even available for the thing you want it to do. It’s not mysterious or a cure-all, and it does take a bit of effort to systematize your approach and make consistent, defensible decisions about your cloud services. That’s where this blueprint comes in.

Your cloud vision is the culmination of this effort all boiled down into a single statement: “This is how we want to use the cloud.” That simple statement should, of course, be representative of – and built from – a broader, contextual strategy discussion that answers the following questions: What should go to the cloud? What kind of cloud makes sense? Should the cloud deployment be public, private, or hybrid? What does a migration look like? What risks and roadblocks need to be considered when exploring your cloud migration options? What are the “day 2” activities that you will need to undertake after you’ve gotten the ball rolling?

Taken as a whole, answering these questions is difficult task. But with the framework provided here, it’s as easy as – well, let’s just say it’s easier.

Jeremy Roberts

Research Director, Infrastructure and Operations

Info-Tech Research Group

Executive Summary

Your Challenge

• You are both extrinsically motivated to move to the cloud (e.g. by vendors) and intrinsically motivated by internal digital transformation initiatives.
• You need to define the cloud’s true value proposition for your organization without assuming it is an outsourcing opportunity or will save you money.
• Your industry, once cloud-averse, is now normalizing the use of cloud services, but you have not established a basic cloud vision from which to develop a strategy at a later point.

Common Obstacles

• Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
• Many organizations have a foot in the cloud already, but these decisions have been made in an ad hoc rather than systematic fashion.
• You lack a consistent framework to assess your workloads’ suitability for the cloud.

Info-Tech's Approach

• Evaluate workloads’ suitability for the cloud using Info-Tech’s methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
• Codify risks tied to workloads’ cloud suitability and plan mitigations.
• Build a roadmap of initiatives for actions by workload and risk mitigation.
• Define a cloud vision to share with stakeholders.

Info-Tech Insight: 1) Base migration decisions on cloud characteristics. If your justification for the migration is simply getting your workload out of the data center, think again. 2) Address the risks up front in your migration plan. 3) The cloud changes roles and calls for different skill sets, but Ops is here to stay.

Your challenge

This research is designed to help organizations who need to:

• Identify workloads that are good candidates for the cloud.
• Develop a consistent, cost-effective approach to cloud services.
• Outline and mitigate risks.
• Define your organization’s cloud archetype.
• Map initiatives on a roadmap.
• Communicate your cloud vision to stakeholders so they can understand the reasons behind a cloud decision and differentiate between different cloud service and deployment models.
• Understand the risks, roadblocks, and limitations of the cloud.

“We’re moving from a world where companies like Oracle and Microsoft and HP and Dell were all critically important to a world where Microsoft is still important, but Amazon is now really important, and Google also matters. The technology has changed, but most of the major vendors they’re betting their business on have also changed. And that’s super hard for people..” –David Chappell, Author and Speaker

Common obstacles

These barriers make this challenge difficult to address for many organizations:

• Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
• Many organizations already have a foot in the cloud, but the choice to explore these solutions was made in an ad hoc rather than systematic fashion. The cloud just sort of happened.
• The lack of a consistent assessment framework means that some workloads that probably belong in the cloud are kept on premises or with hosted services providers – and vice versa.
• Securing cloud expertise is remarkably difficult – especially in a labor market roiled by the global pandemic and the increasing importance of cloud services.

Standard cloud challenges

30% of all cloud spend is self-reported as waste. Many workloads that end up in the cloud don’t belong there. Many workloads that do belong in the cloud aren’t properly migrated. (Flexera, 2021)

44% of respondents report themselves as under-skilled in the cloud management space. (Pluralsight, 2021)

Info-Tech’s approach

Goals and drivers

• Service model
  • What type of cloud makes the most sense for workload archetypes? When does it make sense to pick SaaS over IaaS, for example?
• Delivery model
  • Will services be delivered over the public cloud, a private cloud, or a hybrid cloud? What challenges accompany this decision?

• Migration Path
  • What does the migration path look like? What does the transition to the cloud look like, and how much effort will be required? Amazon’s 6Rs framework captures migration options: rehosting, repurchasing, replatforming, and refactoring, along with retaining and retiring. Each workload should be assessed for its suitability for one or more of these paths.

• Support model
  • How will services be provided? Will staff be trained, new staff hired, a service provider retained for ongoing operations, or will a consultant with cloud expertise be brought on board for a defined period? The appropriate support model is highly dependent on goals along with expected outcomes for different workloads.

Highlight risks and roadblocks

Formalize cloud vision

Document your cloud strategy

The Info-Tech difference:

1. Determine the hypothesized value of cloud for your organization.
2. Evaluate workloads with 6Rs framework.
3. Identify and mitigate risks.
4. Identify cloud archetype.
5. Plot initiatives on a roadmap.
6. Write action plan statement and goal statement.

What is the cloud, how is it deployed, and how is service provided?

Cloud Characteristics

1. On-demand self-service: the ability to access reosurces instantly without vendor interaction
2. Broad network access: all services delivered over the network
3. Resource pooling: multi-tenant environment (shared)
4. Rapid elasticity: the ability to expand and retract capabilities as needed
5. Measured service: transparent metering

Service Model:

1. Software-as-a-Service: all but the most minor configuration is done by the vendor
2. Platform-as-a-Service: customer builds the application using tools provided by the provider
3. Infrastructure-as-a-Service: the customer manages OS, storage, and the application

Delivery Model

1. Public cloud: accessible to anyone over the internet; multi-tenant environment
2. Private cloud: provisioned for a single organization with multiple units
3. Hybrid cloud: two or more connected clouds; data is portage across them
4. Community cloud: provisioned for a specific group of organizations

(National Institute of Standards and Technology)

A workload-first approach will allow you to take full advantage of the cloud’s strengths

• Under all but the most exceptional circumstances, good cloud strategies will incorporate different service models. Very few organizations are “IaaS shops” or “SaaS shops,” even if they lean heavily in one direction.
• These different service models (including non-cloud options like colocation and on-premises infrastructure) each have different strengths. Part of your cloud strategy should involve determining which of the services makes the most sense for you.
• Own the cloud by understanding which cloud (or non-cloud!) offering makes the most sense for you given your unique context.

Migration paths

In a 2016 blog post, Amazon introduced a framework for understanding cloud migration strategies. The framework presented here is slightly modified – including a “relocate” component rather than a “retire” component – but otherwise hews close to the standard.

These migration paths reflect organizational capabilities and desired outcomes in terms of service models – cloud or otherwise. Retention means keeping the workload where it is, in a datacenter or a colocation service, or relocating to a colocation or hosted software environment. These represent the “non-cloud” migration paths.

In the graphic on the right, the paths within the red box lead to the cloud. Rehosting means lifting and shifting to an infrastructure environment. Migrating a virtual machine from your VMware environment on premises to Azure Virtual machines is a quick way to realize some benefits from the cloud. Migrating from SQL Server on premises to a cloud-based SQL solution looks a bit more like changing platforms (replatforming). It involves basic infrastructure modification without a substantial architectural component.

Refactoring is the most expensive of the options and involves engaging the software development lifecycle to build a custom solution, fundamentally rewriting the solution to be cloud native and take advantage of cloud-native architectures. This can result in a PaaS or an IaaS solution.

Finally, repurchasing means simply going to market and procuring a new solution. This may involve migrating data, but it does not require the migration of components.

Migration Paths

Retain (Revisit)

• Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

Relocate

• Move the workload between datacenters or to a hosted software/colocation provider.

Rehost

• Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

Replatform

• Move the application to the cloud and perform a few changes for cloud optimizations.

Refactor

• Rewrite the application, taking advantage of cloud-native architectures.

Repurchase

• Replace with an alternative, cloud-native application and migrate the data.

Support model

Support models by characteristic

IT services, including cloud services, can be delivered and managed in multiple ways depending on the nature of the workload and the organization’s intended path forward. Three high-level options are presented here and may be more or less valuable based on the duration of the expected engagement with the service (temporary or permanent), the skills specialization required, and the flexibility necessary to complete the job.

By way of example, a highly technical, short-term project with significant flexibility requirements might be a good fit for an expensive consultant, whereas post-implementation maintenance of a cloud email system requires relatively little specialization and flexibility and would therefore be a better fit for internal management.

There is no universally applicable rule here, but there are some workloads that are generally a good fit for the cloud and others that are not as effective, with that fit being conditional on the appropriate support model being employed.

Risks, roadblocks, and strategy components

No two cloud strategies are exactly alike, but all should address 14 key areas. A key step in defining your cloud vision is an assessment of these strategy components. Lower maturity does not preclude an aggressive cloud strategy, but it does indicate that higher effort will be required to make the transition.

Cloud archetypes – a cloud vision component

Once you understand the value of the cloud, your workloads’ general suitability for cloud, and your proposed risks and mitigations, the next step is to define your cloud archetype.

Your organization’s cloud archetype is the strategic posture that IT adopts to best support the organization’s goals. Info-Tech’s model recognizes seven archetypes, divided into three high-level archetypes.

After consultation with your stakeholders, and based on the results of the suitability and risk assessment activities, define your archetype. The archetype feeds into the overall cloud vision and provides simple insight into the cloud future state for all stakeholders.

The cloud vision itself is captured in a “vision statement,” a short summary of the overall approach that includes the overall cloud archetype.

Info-Tech’s methodology for defining your cloud vision

Insight summary

The cloud may not be right for you – and that’s okay!

Don’t think about the cloud as an inevitable next step for all workloads. The cloud is merely another tool in the toolbox, ready to be used when appropriate and put away when it’s not needed. Cloud first isn’t always the way to go.

Not all clouds are equal

It’s not “should I go to the cloud?” but “what service and delivery models make sense based on my needs and risk tolerance?” Thinking about the cloud as a binary can force workloads into the cloud that don’t belong (and vice versa).

Bottom-up is best

A workload assessment is the only way to truly understand the cloud’s value. Work from the bottom up, not the top down, understand what characteristics make a workload cloud suitable, and strategize on that basis.

Your accountability doesn’t change

You are still accountable for maintaining available, secure, functional applications and services. Cloud providers share some responsibility, but the buck stops where it always has: with you.

Don’t customize for the sake of customization

SaaS providers make money selling the same thing to everyone. When migrating a workload to SaaS, work with stakeholders to pursue standardization around a selected platform and avoid customization where possible.

Best of both worlds, worst of both worlds

Hybrid clouds are in fashion, but true hybridity comes with additional cost, administration, and other constraints. A convoy moves at the speed of its slowest member.

The journey matters as much as the destination

How you get there is as important as what “there” actually is. Any strategy that focuses solely on the destination misses out on a key part of the value conversation: the migration strategy.

Blueprint benefits

Cloud Vision Executive Presentation

This presentation captures the results of the exercises and presents a complete vision to stakeholders including a desired target state, a rubric for decision making, the results of the workload assessments, and an overall risk profile.

Cloud Vision Workbook

This workbook includes the standard cloud workload assessment questionnaire along with the results of the assessment. It also includes the milestone timeline for the implementation of the cloud vision.

Blueprint benefits

IT Benefits

• A consistent approach to the cloud takes the guesswork out of deployment decisions and makes it easier for IT to move on to the execution stage.
• When properly incorporated, cloud services come with many benefits, including automation, elasticity, and alternative architectures (micro-services, containers). The cloud vision project will help IT readers articulate expected benefits and work towards achieving them.
• A clear framework for incorporating organizational goals into cloud plans.

Business benefits

• Simple, well-governed access to high-quality IT resources.
• Access to the latest and greatest in technology to facilitate remote work.
• Framework for cost management in the cloud that incorporates OpEx and chargebacks/showbacks. A clear understanding of expected changes to cost modeling is also a benefit of a cloud vision.
• Clarity for stakeholders about IT’s response (and contribution to) IT strategic initiatives.

Measure the value of this blueprint

Don’t take our word for it:

• The cloud vision material in various forms has been offered for several years, and members have generally benefited substantially, both from cloud vision workshops and from guided implementations led by analysts.
• After each engagement, we send a survey that asks members how they benefited from the experience. Of 30 responses, the cloud vision research has received an average score of 9.8/10. Real members have found significant value in the process.
• Additionally, members reported saving between 2 and 120 days (for an average of 17), and financial savings ranged from $1,920 all the way up to $1.27 million, for an average of $170,577.90! If we drop outliers on both ends, the average reported value of a cloud vision engagement is $37, 613.
• Measure the value by calculating the time saved from using Info-Tech’s framework vs. a home-brewed cloud strategy alternative and by comparing the overall cost of a guided implementation or workshop with the equivalent offering from another firm. We’re confident you’ll come out ahead.

9.8/10 Average reported satisfaction

17 Days Average reported time savings

$37, 613 Average cost savings (adj.)

Executive Brief Case Study

Industry: Financial

Source: Info-Tech workshop

Anonymous financial institution

A small East Coast financial institution was required to develop a cloud strategy. This strategy had to meet several important requirements, including alignment with strategic priorities and best practices, along with regulatory compliance, including with the Office of the Comptroller of the Currency.

The bank already had a significant cloud footprint and was looking to organize and formalize the strategy going forward.

Leadership needed a comprehensive strategy that touched on key areas including the delivery model, service models, individual workload assessments, cost management, risk management and governance. The output had to be consumable by a variety of audiences with varying levels of technical expertise and had to speak to IT’s role in the broader strategic goals articulated earlier in the year.

Results

The bank engaged Info-Tech for a cloud vision workshop and worked through four days of exercises with various IT team members. The bank ultimately decided on a multi-cloud strategy that prioritized SaaS while also allowing for PaaS and IaaS solutions, along with some non-cloud hosted solutions, based on organizational circumstances.

Bank cloud vision

[Bank] will provide innovative financial and related services by taking advantage of the multiplicity of best-of-breed solutions available in the cloud. These solutions make it possible to benefit from industry-level innovations, while ensuring efficiency, redundancy, and enhanced security.

Bank cloud decision workflow

• SaaS
  • Platform?
    • Yes
      • PaaS
    • No
      • Hosted
    • IaaS
      • Other

Non-cloud

Cloud

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this crticial project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off imediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge the take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

Phase 1

• Call #1: Discuss current state, challenges, etc.
• Call #2: Goals, drivers, and current state.

Phase 2

• Call #3: Conduct cloud suitability assessment for selected workloads.

Phase 3

• Call #4: Generate and categorize risks.
• Call #5: Begin the risk mitigation conversation.

Phase 4

• Call #6: Complete the risk mitigation process
• Call #7: Finalize vision statement and cloud decision framework.

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Understand the cloud

Build the foundations of your cloud vision

Phase 1

Phase 1

Understand the Cloud

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

1.1.1 Generate organizational goals

1.1.2 Define cloud drivers

1.1.3 Define success indicators

1.3.1 Record your current state

1.4.1 Select workloads for further assessment

This phase involves the following participants:

IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders.

It starts with shared understanding

Stakeholders must agree on overall goals and what “cloud” means

The cloud is a nebulous term that can reasonably describe services ranging from infrastructure as a service as delivered by providers like Amazon Web Services and Microsoft through its Azure platform, right up to software as a service solutions like Jira or Salesforce. These solutions solve different problems – just because your CRM would be a good fit for a migration to Salesforce doesn’t mean the same system would make sense in Azure or AWS.

This is important because the language we use to talk about the cloud can color our approach to cloud services. A “cloud-first” strategy will mean something different to a CEO with a concept of the cloud rooted in Salesforce than it will to a system administrator who interprets it to mean a transition to cloud-hosted virtual machines.

Add to this the fact that not all cloud services are hosted externally by providers (public clouds) and the fact that multiple delivery models can be engaged at once through hybrid or multi-cloud approaches, and it’s apparent that a shared understanding of the cloud is necessary for a coherent strategy to take form.

This phase proceeds in four steps, each governed by the principle of shared understanding. The first requires a shared understanding of corporate goals and drivers. Step 2 involves coming to a shared understanding of the cloud’s unique characteristics. Step 3 requires a review of the current state. Finally, in Step 4, participants will identify workloads that are suitable for analysis as candidates for the cloud.

Step 1.1

Generate goals and drivers

Activities

1.1.1 Define organizational goals

1.1.2 Define cloud drivers

1.1.3 Define success indicators

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

This step involves the following participants:

• IT management
• Core working group
• Security
• Applications
• Infrastructure
• Service management
• Leadership

Outcomes of this step

• List of organizational goals
• List of cloud drivers
• Defined success indicators

What can the cloud do for you?

The cloud is not valuable for its own sake, and not all users derive the same value

• The cloud is characterized by on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Any or all of those characteristics might be enough to make the cloud appealing, but in most cases, there is an overriding driver.
• Multiple paths may lead to the cloud. Consider an organization with a need to control costs by showing back to business units, or perhaps by reducing capital expenditure – the cloud may be the most appropriate way to effect these changes. Conversely, an organization expanding rapidly and with a need to access the latest and greatest technology might benefit from the elasticity and pooled resources that major cloud providers can offer.
• In these cases, the destination might be the same (a cloud solution) but the delivery model – public, private, or hybrid – and the decisions made around the key strategy components, including architecture, provisioning, and cost management, will almost certainly be different.
• Defining goals, understanding cloud drivers, and – crucially – understanding what success means, are all therefore essential elements of the cloud vision process.

1.1.1 Generate organizational goals

1-3 hours

Input

• Strategy documentation

Output

• Organizational goals

Materials

• Whiteboard (digital/physical)

Participants

• IT leadership
• Infrastructure
• Applications
• Security

1. As a group, brainstorm organizational goals, ideally based on existing documentation
   • Review relevant corporate and IT strategies.
   • If you do not have access to internal documentation, review the standard goals on the next slide and select those that are most relevant for you.
2. Record the most important business goals in the Cloud Vision Executive Presentation. Include descriptions where possible to ensure wide readability.
3. Make note of these goals. They should inform the answers to prompts offered in the Cloud Vision Workbook and should be a consistent presence in the remainder of the visioning exercise. If you’re conducting the session in person, leave the goals up on a whiteboard and make reference to them throughout the workshop.

Cloud Vision Executive Presentation

Standard COBIT 19 enterprise goals

1. Portfolio of competitive products and services
2. Managed business risk
3. Compliance with external laws and regulations
4. Quality of financial information
5. Customer-oriented service culture
6. Business service continuity and availability
7. Quality of management information
8. Optimization of internal business process functionality
9. Optimization of business process costs
10. Staff skills, motivation, and productivity
11. Compliance with internal policies
12. Managed digital transformation programs
13. Product and business innovation

1.1.2 Define cloud drivers

30-60 minutes

Input

• Organizational goals
• Strategy documentation
• Management/staff perspective

Output

• List of cloud drivers

Materials

• Sticky notes
• Whiteboard
• Markers

Participants

• IT leadership
• Infrastructure
• Applications
• Security

1. Cloud drivers sit at a level of abstraction below organizational goals. Keeping your organizational goals in mind, have each participant in the session write down how they expect to benefit from the cloud on a sticky note.
2. Solicit input one at a time and group similar responses. Encourage participants to bring forward their cloud goals even if similar goals have been mentioned previously. The number of mentions is a useful way to gauge the relative weight of the drivers.
3. Once this is done, you should have a few groups of similar drivers. Work with the group to name each category. This name will be the driver reported in the documentation.
4. Input the results of the exercise into the Cloud Vision Executive Presentation, and include descriptions based on the constituent drivers. For example, if a driver is titled “do more valuable work,” the constituent drivers might be “build cloud skills,” “focus on core products,” and “avoid administration work where possible.” The description would be based on these components.

Cloud Vision Executive Presentation

1.1.3 Define success indicators

1 hour

Input

• Cloud drivers
• Organizational goals

Output

• List of cloud driver success indicators

Materials

• Whiteboard
• Markers

Participants

• IT leadership
• Infrastructure
• Applications
• Security

1. On a whiteboard, draw a table with each of the cloud drivers (identified in 1.1.2) across the top.
2. Work collectively to generate success indicators for each cloud driver. In this case, a success indicator is some way you can report your progress with the stated driver. It is a real-world proxy for the sometimes abstract phenomena that make up your drivers. Think about what would be true if your driver was realized.
   1. For example, if your driver is “faster access to resources,” you might consider indicators like developer satisfaction, project completion time, average time to provision, etc.
3. Once you are satisfied with your list of indicators, populate the slide in the Cloud Vision Executive Presentation for validation from stakeholders.

Cloud Vision Executive Presentation

Step 1.2

Explore cloud characteristics

Activities

Understand the value of the cloud:

• Review delivery models
• Review support models
• Review service models
• Review migration paths

Understand the Cloud

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

This step involves the following participants:

• Core working group
• Architecture
• Engineering
• Security

Outcomes of this step

• Understanding of cloud service models and value

Defining the cloud

Per NIST, the cloud has five fundamental characteristics. All clouds have these characteristics, even if they are executed in somewhat different ways between delivery models, service models, and even individual providers.

Cloud characteristics

On-demand self-service

Cloud customers are capable of provisioning cloud resources without human interaction (e.g. contacting sales), generally through a web console.

Broad network access

Capabilities are designed to be delivered over a network and are generally intended for access by a wide variety of platform types (cloud services are generally device-agnostic).

Resource pooling

Multiple customers (internal, in the case of private clouds) make use of a highly abstracted shared infrastructure managed by the cloud provider.

Rapid elasticity

Customers are capable of provisioning additional resources as required, pulling from a functionally infinite pool of capacity. Cloud resources can be spun-down when no longer needed.

Measured service

Consumption is metered based on an appropriate unit of analysis (number of licenses, storage used, compute cycles, etc.) and billing is transparent and granular.

Cloud delivery models

The NIST definition of cloud computing outlines four cloud delivery models: public, private, hybrid, and community clouds. A community cloud is like a private cloud, but it is provisioned for the exclusive use of a like-minded group of organizations, usually in a mutually beneficial, non-competitive arrangement. Universities and hospitals are examples of organizations that can pool their resources in this way without impacting competitiveness. The Info-Tech model covers three key delivery models – public, private, and hybrid, and an overarching model (multi-cloud) that can comprise more than one of the other models – public + public, public + hybrid, etc.

Public

The cloud service is provisioned for access by the general public (customers).

Private

A private cloud has the five key characteristics, but is provisioned for use by a single entity, like a company or organization.

Hybrid

Hybridity essentially refers to interoperability between multiple cloud delivery models (public +private).

Multi

A multi-cloud deployment requires only that multiple clouds are used without any necessary interoperability (Nutanix, 2019).

Public cloud

This is what people generally think about when they talk about cloud

• The public cloud is, well, public! Anyone can make use of its resources, and in the case of the major providers, capacity is functionally unlimited. Need to store exabytes of data in the cloud? No problem! Amazon will drive a modified shipping container to your datacenter, load it up, and “migrate” it to a datacenter.
• Public clouds offer significant variety on the infrastructure side. Major IaaS providers, like Microsoft and Amazon, offer dozens of services across many different categories including compute, networking, and storage, but also identity, containers, machine learning, virtual desktops, and much, much more. (See a list from Microsoft here, and Amazon here)
• There are undoubtedly strengths to the public cloud model. Providers offer the “latest and greatest” and customers need not worry about the details, including managing infrastructure and physical locations. Providers offer built-in redundancy, multi-regional deployments, automation tools, management and governance solutions, and a variety of leading-edge technologies that would not be feasible for organizations to run in-house, like high performance compute, blockchain, or quantum computing.
• Of course, the public cloud is not all sunshine and rainbows – there are downsides as well. It can be expensive; it can introduce regulatory complications to have to trust another entity with your key information. Additionally, there can be performance hiccups, and with SaaS products, it can be difficult to monitor at the appropriate (per-transaction) level.

Prominent examples include:

AWS

Microsoft

Azure

Salesforce.com

Workday

SAP

Private cloud

A lower-risk cloud for cloud-averse customers?

• A cloud is a cloud, no matter how small. Some IT shops deploy private clouds that make use of the five key cloud characteristics but provisioned for the exclusive use of a single entity, like a corporation.
• Private clouds have numerous benefits. Some potential cloud customers might be uncomfortable with the shared responsibility that is inherent in the public cloud. Private clouds allow customers to deliver flexible, measured services without having to surrender control, but they require significant overhead, capital expenditure, administrative effort, and technical expertise.
• According to the 2021 State of the Cloud Report, private cloud use is common, and the most frequently cited toolset is VMware vSphere, followed by Azure Stack, OpenStack, and AWS Outposts. Private cloud deployments are more common in larger organizations, which makes sense given the overhead required to manage such an environment.

Private cloud adoption

VMware and Microsoft lead the pack among private cloud customers, with Amazon and Red Hat also substantially present across private cloud environments.

Hybrid cloud

The best of both worlds?

Hybrid cloud architectures combine multiple cloud delivery models and facilitate some level of interoperability. NIST suggests bursting and load balancing as examples of hybrid cloud use cases. Note: it is not sufficient to simply have multiple clouds running in parallel – there must be a toolset that allows for an element of cross-cloud functionality.

This delivery model is attractive because it allows users to take advantage of the strengths of multiple service models using a single management pane. Bursting across clouds to take advantage of additional capacity or disaster recovery capabilities are two obvious use cases that appeal to hybrid cloud users.

But while hybridity is all the rage (especially given the impact Covid-19 has had on the workplace), the reality is that any hybrid cloud user must take the good with the bad. Multiple clouds and a management layer can be technically complex, expensive, and require maintaining a physical infrastructure that is not especially valuable (“I thought we were moving to the cloud to get out of the datacenter!”).

Before selecting a hybrid approach through services like VMware Cloud on AWS or Microsoft’s Azure Stack, consider the cost, complexity, and actual expected benefit.

Amazon, Microsoft, and Google dominate public cloud IaaS, but IBM is betting big on hybrid cloud:

With its acquisition of Red Hat in 2019 for $34 billion, Big Blue put its money where its mouth is and acquired a substantial hybrid cloud business. At the time of the acquisition, Red Hat’s CEO, Jim Whitehurst, spoke about the benefit IBM expected to receive:

“Joining forces with IBM gives Red Hat the opportunity to bring more open source innovation to an even broader range of organizations and will enable us to scale to meet the need for hybrid cloud solutions that deliver true choice and agility” (Red Hat, 2019).

Multi-cloud

For most organizations, the multi-cloud is the most realistic option.

Multi-cloud is popular!

Multi-cloud solutions exist at a different layer of abstraction from public, private, and even hybrid cloud delivery models. A multi-cloud architecture, as the name suggests, requires the user to be a customer of more than one cloud provider, and it can certainly include a hybrid cloud deployment, but it is not bound by the same rules of interoperability.

Many organizations – especially those with fewer resources or a lack of a use case for a private cloud – rely on a multi-cloud architecture to build applications where they belong, and they manage each environment separately (or occasionally with the help of cloud management platforms).

If your data team wants to work in AWS and your enterprise services run on basic virtual machines in Azure, that might be the most effective architecture. As the Flexera 2021 State of the Cloud Report suggests, this architecture is far more common than the more complicated bursting or brokering architectures characteristic of hybrid clouds.

NIST cloud service models

Software as a service

SaaS has exploded in popularity with consumers who wish to avail themselves of the cloud’s benefits without having to manage underlying infrastructure components. SaaS is simple, generally billed per-user per-month, and is almost entirely provider-managed.

Platform as a service

PaaS providers offer a toolset for their customers to run custom applications and services without the requirement to manage underlying infrastructure components. This service model is ideal for custom applications/services that don’t benefit from highly granular infrastructure control.

Infrastructure as a service

IaaS represents the sale of components. Instead of a service, IaaS providers sell access to components, like compute, storage, and networking, allowing for customers to build anything they want on top of the providers’ infrastructure.

Cloud service models

• This research focuses on five key service models, each of which has its own strengths and weaknesses. Moving right from “on-prem,” customers gradually give up more control over their environments to cloud service providers.
• An entirely premises-based environment means that the customer is responsible for everything ranging from the dirt under the datacenter to application-level configurations. Conversely, in a SaaS environment, the provider is responsible for everything but those top-level application configurations.
• A managed service provider or other third party can manage any or of the components of the infrastructure stack. A service provider may, for example, build a SaaS solution on top of another provider’s IaaS, or might offer configuration assistance with a commercially available SaaS.

Info-Tech Insight

Not all workloads fit well in the cloud. Many environments will mix service models (e.g. SaaS for some workloads, some in IaaS, some on-premises), and this can be perfectly effective. It must be consistent and intentional, however.

Organization has control

Organization or vendor may control

Vendor has control

Analytics folly

SaaS is good, but it’s not a panacea

Industry: Healthcare

Source: Info-Tech workshop

Situation

A healthcare analytics provider had already moved a significant number of “non-core workloads” to the cloud, including email, HRIS, and related services.

The company CEO was satisfied with the reduced effort required by IT to manage SaaS-based workloads and sought to extend the same benefits to the core analytics platform where there was an opportunity to reduce overhead.

Complication

Many components of the health analytics service were designed to run specifically in a datacenter and were not ready to be migrated to the cloud without significant effort/refactoring. SaaS was not an option because this was a core platform – a SaaS provider would have been the competition.

That left IaaS, which was expensive and would not bring the expected benefits (reduced overhead).

Results

The organization determined that there were no short-term gains from migrating to the cloud. Due to the nature of the application (its extensive customization, the fact that it was a core product sold by the company) any steps to reduce operational overhead were not feasible.

The CEO recognized that the analytics platform was not a good candidate for the cloud and what distinguished the analytics platform from more suitable workloads.

Migration paths

In a 2016 blog post, Amazon Web Services articulated a framework for cloud migration that incorporates elements of the journey as well as the destination. If workload owners do not choose to retain or retire their workloads, there are four alternatives. These alternatives all stack up differently along five key dimensions:

1. Value: does the workload stand to benefit from unique cloud characteristics? To what degree?
2. Effort: how much work would be required to make the transition?
3. Cost: how much money is the migration expected to cost?
4. Time: how long will the migration take?
5. Skills: what skills must be brought to bear to complete the migration?

Not all migration paths can lead to all destinations. Rehosting generally means IaaS, while repurchasing leads to SaaS. Refactoring and replatforming have some variety of outcomes, and it becomes possible to take advantage of new IaaS architectures or migrate workloads over fully to SaaS.

As part of the workload assessment process, use the five dimensions (expanded upon on the next slide) to determine what migration path makes sense. Preferred migration paths form an important part of the overall cloud vision process.

Retain (Revisit)

• Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

Retire

• Get rid of the application completely.

Rehost

• Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

Replatform

• Move the application to the cloud and perform a few changes for cloud optimizations.

Refactor

• Rewrite the application, taking advantage of cloud native architectures.

Repurchase

• Replace with an alternative, cloud-native application and migrate the data.

Migration paths – relative value

Where should you get your cloud skills?

Cloud skills are certainly top of mind right now. With the great upheaval in both work patterns and in the labor market more generally, expertise in cloud-related areas is simultaneously more valuable and more difficult to procure. According to Pluralsight’s 2021 “State of Upskilling” report, 44% of respondents report themselves under-skilled in the cloud management area, making cloud management the most significant skill gap reported on the survey.

Everyone left the office. Work as we know it is fundamentally altered for a generation or more. Cloud services shot up in popularity by enabling the transition. And yet there is a gap – a prominent gap – in skilling up for this critically important future. What is the cloud manager to do?

Per the framework presented here, that manager has three essential options. They may take somewhat different forms depending on specific requirements and the quirks of the local market, but the options are:

1. Train or hire internal resources: This might be easier said than done, especially for more niche skills, but makes sense for workloads that are critical to operations for the long term.
2. Engage a managed service provider: MSPs are often engaged to manage services where internal IT lacks bandwidth or expertise.
3. Hire a consultant: Consultants are great for time-bound implementation projects where highly specific expertise is required, such as a migration or implementation project.

Each model makes sense to some degree. When evaluating individual workloads for cloud suitability, it is critical to consider the support model – both immediate and long term. What makes sense from a value perspective?

Cloud decisions – summary

A key component of the Info-Tech cloud vision model is that it is multi-layered. Not every decision must be made at every level. At the workload level, it makes sense to select service models that make sense, but each workload does not need its own defined vision. Workload-level decisions should be guided by an overall strategy but applied tactically, based on individual workload characteristics and circumstances.

Conversely, some decisions will inevitably be applied at the environment level. With some exceptions, it is unlikely that cloud customers will build an entire private/hybrid cloud environment around a single solution; instead, they will define a broader strategy and fit individual workloads into that strategy.

Some considerations exist at both the workload and environment levels. Risks and roadblocks, as well as the preferred support model, are concerns that exist at both the environment level and at the workload level.

Step 1.3

Create a current state summary

Activities

1.3.1 Record your current state

Understand the Cloud

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

This step involves the following participants: Core working group

Outcomes of this step

• Current state summary of cloud solutions

1.3.1 Record your current state

30 minutes

Input

• Knowledge of existing cloud workloads

Output

• Current state cloud summary for service, delivery, and support models

Materials

• Whiteboard

Participants

• Core working group
• Infrastructure team
• Service owners

1. On a whiteboard (real or virtual) draw a table with each of the cloud service models across the top. Leave a cell below each to list examples.
2. Under each service model, record examples present in your environment. The purpose of the exercise is to illustrate the existence of cloud services in your environment or the lack thereof, so there is no need to be exhaustive. Complete this in turn for each service model until you are satisfied that you have created an effective picture of your current cloud SaaS state, IaaS state, etc.
3. Input the results into their own slide titled “current state summary” in the Cloud Vision Executive Presentation.
4. Repeat for the cloud delivery models and support models and include the results of those exercises as well.
5. Create a short summary statement (“We are primarily a public cloud consumer with a large SaaS footprint and minimal presence in PaaS and IaaS. We retain an MSP to manage our hosted telephony solution; otherwise, everything is handled in house.”

Cloud Vision Executive Presentation

Step 1.4

Select workloads for current analysis

Activities

1.4.1 Select workloads for assessment

This step involves the following participants:

• Core working group

Outcomes of this step

• List of workloads for assessment

Understand the cloud

Generate goals and drivers

Explore cloud characteristics

Create a current state summary

Select workloads for analysis

1.4.1 Select workloads for assessment

30 minutes

Input

• Knowledge of existing cloud workloads

Output

• List of workloads to be assessed

Materials

• Whiteboard
• Cloud Vision Workbook

Participants

• Core working group
• IT management

1. In many cases, the cloud project is inspired by a desire to move a particular workload or set of workloads. Solicit feedback from the core working group about what these workloads might be. Ask everyone in the meeting to suggest a workload and record each one on a sticky note or white board (virtual or physical).
2. Discuss the results with the group and begin grouping similar workloads together. They will be subject to the assessments in the Cloud Vision Workbook, so try to avoid selecting too many workloads that will produce similar answers. It might not be obvious, but try to think about workloads that have similar usage patterns, risk levels, and performance requirements, and select a representative group.
3. You should embrace counterintuition by selecting a workload that you think is unlikely to be a good fit for the cloud if you can and subjecting it to the assessment as well for validation purposes.
4. When you have a list of 4-6 workloads, record them on tab 2 of the Cloud Vision Workbook.

Cloud Vision Workbook

Assess your cloud workloads

Build the foundations of your cloud vision

Phase 2

Phase 2

Evaluate Cloud Workloads

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

• Conduct workload assessments
• Determine workload future state

This phase involves the following participants:

• Subject matter experts
• Core working group
• IT management

Define Your Cloud Vision

Work from the bottom up and assess your workloads

A workload-first approach will help you create a realistic vision.

The concept of a cloud vision should unquestionably be informed by the nature of the workloads that IT is expected to provide for the wider organization. The overall cloud vision is no greater than the sum of its parts. You cannot migrate to the cloud in the abstract. Workloads need to go – and not all workloads are equally suitable for the transition.

It is therefore imperative to understand which workloads are a good fit for the cloud, which cloud service models make the most sense, how to execute the migration, what support should look like, and what risks and roadblocks you are likely to encounter as part of the process.

That’s where the Cloud Vision Workbook comes into play. You can use this tool to assess as many workloads as you’d like – most people get the idea after about four – and by the end of the exercise, you should have a pretty good idea about where your workloads belong, and you’ll have a tool to assess any net new or previously unconsidered workloads.

It’s not so much about the results of the assessment – though these are undeniably important – but about the learnings gleaned from the collaborative assessment exercise. While you can certainly fill out the assessment without any additional input, this exercise is most effective when completed as part of a group.

Introducing the Cloud Vision Workbook

• The Cloud Vision Workbook is an Excel tool that answers the age old question: “What should I do with my workloads?”
• It is divided into eight tabs, each of which offers unique value. Start by reading the introduction and inputting your list of workloads. Work your way through tabs 3-6, completing the suitability, migration, management, and risk and roadblock assessments, and review the results on tab 7.
• If you choose to go through the full battery of assessments for each workload, expect to answer and weight 111 unique questions across the four assessments. This is an intensive exercise, so carefully consider which assessments are valuable to you, and what workloads you have time to assess.
• Tab 8 hosts the milestone timeline and captures the results of the phase 3 risk and mitigation exercise.

Understand Cloud Vision Workbook outputs

Step 2.1

Conduct workload assessments

Activities

2.1.1 Conduct workload assessments

2.1.2 Interpret your results

Phase Title

Conduct workload assessments

Determine workload future state

This step involves the following participants:

• Core working group
• Workload subject matter experts

Outcomes of this step

• Completed workload assessments

2.1.1 Conduct workload assessments

2 hours per workload

Input

• List of workloads to be assessed

Output

• Completed cloud vision assessments

Materials

• Cloud Vision Workbook

Participants

• Core working group
• Service owners/workload SMEs

1. The Cloud Vision Workbook is your one stop shop for all things workload assessment. Open the tool to tab 2 and review the workloads you identified at the end of phase 1. Ensure that these are correct. Once satisfied, project the tool (virtually, if necessary) so that all participants can see the assessment questions.
2. Work through tabs 3-6, answering the questions and assigning a multiplier for each one. A higher multiplier increases the relative weight of the question, giving it a greater impact on the overall outcome.
3. Do your best to induce participants to offer opinions. Consensus is not absolutely necessary, but it is a good goal. Ask your participants if they agree with initial responses and occasionally take the opposite position (“I’m surprised you said agree – I would have thought we didn’t care about CapEx vs. OpEx”). Stimulate discussion.
4. Highlight any questions that you will need to return to or run by someone not present. Include a placeholder answer, as the tool requires all cells to be filled for computation.

Cloud Vision Workbook

2.1.2 Interpret your results

10 minutes

Input

• Completed cloud vision assessments

Output

• Shared understanding of implications

Materials

• Cloud Vision Workbook

Participants

• Core working group
• Service owners/workload SMEs

1. Once you’ve completed all 111 questions for each workload, you can review your results on tab 7. On tab 7, you will see four populated graphics: cloud suitability, migration path, “where should skills be procured?”, and risks and roadblocks. These represent the components of the overall cloud vision that you will present to stakeholders.
2. The “cloud suitability” chart captures the service model that the assessment judges to be most suitable for the workload. Ask those present if any are surprised by the output. If there is any disagreement, discuss the source of the surprise and what a more realistic outcome would be. Revisit the assessment if necessary.
3. Conduct a similar exercise with each of the other outputs. Does it make sense to refactor the workload based on its cloud suitability? Does the fact that we scored so highly on the “consultant” support model indicate something about how we handle upskilling internally? Does the profile of risks and roadblocks identified here align with expectations? What should be ranked higher? What about lower?
4. Once everyone is generally satisfied with the results, close the tool and take a break! You’ve earned it.

Cloud Vision Workbook

Understand the cloud strategy components

Each cloud strategy will take a slightly different form, but all should contain echoes of each of these components. This process will help you define your vision and direction, but you will need to take steps to execute on that vision. The remainder of the cloud strategy, covered in the related blueprint Document Your Cloud Strategy comprises these fourteen topics divided across three categories: people, governance, and technology. The workload assessment covers these under risks and roadblocks and highlights areas that may require specific additional attention. When interpreting the results, think of these areas as comprising things that you will need to do to make your vision a reality.

People

• Skills and roles
• Culture and adoption
• Governing bodies

Governance

• Architecture
• Integration and interoperability
• Operations management
• Cloud portfolio management
• Cloud vendor management
• Finance management
• Security
• Data controls

Technology

• Monitoring
• Provisioning
• Migration

Strategy component: People

People form the core of any good strategy. As part of your cloud vision, you will need to understand the implications a cloud transition will have on your staff and users, whether those users are internal or external.

Strategy component: Governance

Without guardrails, the cloud deployment will grow organically. This has strengths (people tend to adopt solutions that they select and deploy themselves), but these are more than balanced out by the drawbacks that come with inconsistency, poor administration, duplication of services, suboptimal costing, and any number of other unique challenges. The solution is to develop and deploy governance. The following list captures some of the necessary governance-related components of a cloud strategy.

Strategy component: Governance (cont.)

Strategy component: Technology

Good technology will never replace good people and effective process, but it remains important in its own right. A migration that neglects the undeniable technical components of a solid cloud strategy is doomed to mediocrity at best and failure at worst. Understanding the technical implications of the cloud vision – particularly in terms of monitoring, provisioning, and migration – makes all the difference. You can interpret the results of the cloud workload assessments by reviewing the details presented here.

Step 2.2

Determine workload future state

Activities

2.2.1 Determine workload future state

Conduct workload assessments

Determine workload future state

This step involves the following participants:

• IT management
• Core working group

Outcomes of this step

• Completed workload assessments
• Defined workload future state

2.2.1 Determine workload future state

1-3 hours

Input

• Completed workload assessments

Output

• Preliminary future state outputs

Materials

• Cloud Vision Workbook
• Cloud Vision Executive Presentation

Participants

• Core working group
• Service owners
• IT management

1. After you’ve had a chance to validate your results, refer to tab 7 of the tool, where you will find a blank notes section.
2. With the working group, capture your answers to each of the following questions:
   1. What service model is the most suitable for the workload? Why?
   2. How will we conduct the migration? Which of the six models makes the most sense? Do we have a backup plan if our primary plan doesn’t work out?
   3. What should the support model look like?
   4. What are some workload-specific risks and considerations that must be taken into account for the workload?
3. Once you’ve got answers to each of these questions for each of the workloads, include your summary in the “notes” section of tab 7.

Cloud Vision Executive Presentation

Paste the output into the Cloud Vision Executive Presentation

• The Cloud Vision Workbook output is a compact, consumable summary of each workload’s planned future state. Paste each assessment in as necessary.
• There is no absolutely correct way to present the information, but the output is a good place to start. Do note that, while the presentation is designed to lead with the vision statement, because the process is workload-first, the assessments are populated prior to the overall vision in a bottom-up manner.
• Be sure to anticipate the questions you are likely to receive from any stakeholders. You may consider preparing for questions like: “What other workloads fit this profile?” “What do we expect the impact on the budget to be?” “How long will this take?” Keep these and other questions in mind as you progress through the vision definition process.

Info-Tech Insight

Keep your audience in mind. You may want to include some additional context in the presentation if the results are going to be presented to non-technical stakeholders or those who are not familiar with the terms or how to interpret the outputs.

Identify and Mitigate Risks

Build the foundations of your cloud vision

PHASE 3

Phase 3

Identify and Mitigate Risks

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

• Generate risks and roadblocks
• Mitigate risks and roadblocks
• Define roadmap initiatives

This phase involves the following participants:

• Core working group
• Workload subject matter experts

You know what you want to do, but what do you have to do?

What questions remain unanswered?

There are workload-level risks and roadblocks, and there are environment-level risks. This phase is focused primarily on environment-level risks and roadblocks, or those that are likely to span multiple workloads (but this is not hard and fast rule – anything that you deem worth discussing is worth discussing). The framework here calls for an open forum where all stakeholders – technical and non-technical, pro-cloud and anti-cloud, management and individual contributor – have an opportunity to articulate their concerns, however specific or general, and receive feedback and possible mitigation.

Start by soliciting feedback. You can do this over time or in a single session. Encourage anyone with an opinion to share it. Focus on those who are likely to have a perspective that will become relevant at some point during the creation of the cloud strategy and the execution of any migration. Explain the preliminary direction; highlight any major changes that you foresee. Remind participants that you are not looking for solutions (yet), but that you want to make sure you hear any and every concern as early as possible. You will get feedback and it will all be valuable.

Before cutting your participants loose, remind them that, as with all business decisions, the cloud comes with trade-offs. Not everyone will have every wish fulfilled, and in some cases, significant effort may be needed to get around a roadblock, risks may need to be accepted, and workloads that looked like promising candidates for one service model or another may not be able to realize that potential. This is a normal and expected part of the cloud vision process.

Once the risks and roadblocks conversation is complete, it is the core working group’s job to propose and validate mitigations. Not every risk can be completely resolved, but the cloud has been around for decades – chances are someone else has faced a similar challenge and made it through relatively unscathed. That work will inevitably result in initiatives for immediate execution. Those initiatives will form the core of the initiative roadmap that accompanies the completed Cloud Vision Executive Presentation.

Step 3.1

Generate risks and roadblocks

Activities

3.1.1 Generate risks and roadblocks

3.1.2 Generate mitigations

Identify and mitigate risks

Generate risks and roadblocks

Mitigate risks and roadblocks

Define roadmap initiatives

This step involves the following participants:

• Core working group
• IT management
• Infrastructure
• Applications
• Security
• Architecture

Outcomes of this step

• List of risks and roadblocks

Understand risks and roadblocks

Risk

• Something that could potentially go wrong.
• You can respond to risks by mitigating them:
  • Eliminate: take action to prevent the risk from causing issues.
  • Reduce: take action to minimize the likelihood/severity of the risk.
  • Transfer: shift responsibility for the risk away from IT, towards another division of the company.
  • Accept: where the likelihood or severity is low, it may be prudent to accept that the risk could come to fruition.

Roadblock

• There are things that aren’t “risks” that we care about when migrating to the cloud.
• We know, for example, that a complicated integration situation will create work items for any migration – this is not an “unknown.”
• We respond to roadblocks by generating work items.

3.1.1 Generate risks and roadblocks

1.5 hours

Input

• Completed cloud vision assessments

Output

• List of risks and roadblocks

Materials

• Whiteboard
• Sticky notes

Participants

• Core working group
• Service owners/workload SMEs
• Anyone with concerns about the cloud

1. Gather your core working group – and really anyone with an intelligent opinion on the cloud – into a single meeting space. Give the group 5-10 minutes to list anything they think could present a difficulty in transitioning workloads to the cloud. Write each risk/roadblock on its own sticky note. You will never be 100% exhaustive, but don’t let anything your users care about go unaddressed.
2. Once everyone has had time to write down their risks and roadblocks, have everyone share one by one. Make sure you get them all. Overlap in risks and roadblocks is okay! Group similar concerns together to give a sort of heat map of what your participants are concerned about. (This is called “affinity diagramming.”)
3. Assign names to these categories. Many of these categories will align with the strategy components discussed in the previous phase (governance, security, etc.) but some will be specific whether by nature or by degree.
4. Sort each of the individual risks into its respective category, collapsing any exact duplicates, and leaving room for notes and mitigations (see the next slide for a visual).

Understand risks and roadblocks

Step 3.2

Mitigate risks and roadblocks

Activities

3.2.1 Generate mitigations

Identify and mitigate risks

Generate risks and roadblocks

Mitigate risks and roadblocks

Define roadmap initiatives

This step involves the following participants:

• Core working group

Outcomes of this step

• List of mitigations

Is the public cloud less secure?

This is the key risk-related question that most cloud customers will have to answer at some point: does migrating to the cloud for some services increase their exposure and create a security problem?

As with all good questions, the answer is “it depends.” But what does it depend on? Consider these cloud risks and potential mitigations:

1. Misconfiguration: An error grants access to unauthorized parties (as happened to Capital One in 2019). This can be mitigated by careful configuration management and third-party tooling.
2. Unauthorized access by cloud provider/partner employees: Though rare, it is possible that a cloud provider or partner can be a vector for a breach. Careful contract language, choosing to own your own encryption keys, and a hybrid approach (storing data on-premises) are some possible ways to address this problem.
3. Unauthorized access to systems: Cloud services are designed to be accessed from anywhere and may be accessed by malicious actors. Possible mitigations include risk-based conditional access, careful identity access management, and logging and detection.

“The cloud is definitely more secure in that you have much more control, you have much more security tooling, much more visibility, and much more automation. So it is more secure. The caveat is that there is more risk. It is easier to accidentally expose data in the cloud than it is on-premises, but, especially for security, the amount of tooling and visibility you get in cloud is much more than anything we’ve had in our careers on-premises, and that’s why I think cloud in general is more secure.” –Abdul Kittana, Founder, ASecureCloud

Breach bests bank

No cloud provider can protect against every misconfiguration

Industry: Finance

Source: The New York Times, CNET

Background

Capital One is a major Amazon Web Services customer and is even featured on Amazon’s site as a case study. That case study emphasizes the bank’s commitment to the cloud and highlights how central security and compliance were. From the CTO: “Before we moved a single workload, we engaged groups from across the company to build a risk framework for the cloud that met the same high bar for security and compliance that we meet in our on-premises environments. AWS worked with us every step of the way.”

Complication

The cloud migration was humming along until July 2019, when the bank suffered a serious breach at the hands of a hacker. That hacker was able to steal millions of credit card applications and hundreds of thousands of Social Security numbers, bank account numbers, and Canadian social insurance numbers.

According to investigators and to AWS, the breach was caused by an open reverse proxy attack against a misconfigured web app firewall, not by an underlying vulnerability in the cloud infrastructure.

Results

Capital One reported that the breach was expected to cost it $150 million, and AWS fervently denied any blame. The US Senate got involved, as did national media, and Capital One’s CEO issued a public apology, writing, “I sincerely apologize for the understandable worry this incident must be causing those affected, and I am committed to making it right.”

It was a bad few months for IT at Capital One.

3.2.1 Generate mitigations

3-4.5 hours

Input

• Completed cloud vision assessments

Output

• List of risks and roadblocks

Materials

• Whiteboard
• Sticky notes

Participants

• Core working group
• Service owners/workload SMEs
• Anyone with concerns about the cloud

1. Recall the four mitigation strategies: eliminate, reduce, transfer, or accept. Keep these in mind as you work through the list of risks and roadblocks with the core working group. For every individual risk or roadblock raised in the initial generation session, suggest a specific mitigation. If the concern is “SaaS providers having access to confidential information,” a mitigation might be encryption, specific contract language, or proof of certifications (or all the above).
2. Work through this for each of the risks and roadblocks, identifying the steps you need to take that would satisfy your requirements as you understand them.
3. Once you have gone through the whole list – ideally with input from SMEs in particular areas like security, engineering, and compliance/legal – populate the Cloud Vision Workbook (tab 8) with the risks, roadblocks, and mitigations (sorted by category). Review tab 8 for an example of the output of this exercise.

Cloud Vision Workbook

Cloud Vision Workbook – mitigations

Step 3.3

Define roadmap initiatives

Activities

3.3.1 Generate roadmap initiatives

Identify and mitigate risks

Generate risks and roadblocks

Mitigate risks and roadblocks

Define roadmap initiatives

This step involves the following participants:

• Core working group

Outcomes of this step

• Defined roadmap initiatives

3.3.1 Generate roadmap initiatives

1 hour

Input

• List of risk and roadblock mitigations

Output

• List of cloud initiatives

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Executing on your cloud vision will likely require you to undertake some key initiatives, many of which have already been identified as part of your mitigation exercise. On tab 8 of the Cloud Vision Workbook, review the mitigations you created in response to the risks and roadblocks identified. Initiatives should generally be assignable to a party and should have a defined scope/duration. For example, “assess all net new applications for cloud suitability” might not be counted as an initiative, but “design a cloud application assessment” would likely be.
2. Design a timeline appropriate for your specific needs. Generally short-term (less than 3 months), medium-term (3-6 months), and long-term (greater than 6 months) will work, but this is entirely based on preference.
3. Review and validate the parameters with the working group. Consider creating additional color-coding (highlighting certain tasks that might be dependent on a decision or have ongoing components).

Cloud Vision Workbook

Bridge the gap and create the vision

Build the foundations of your cloud vision

Phase 4

Phase 4

Bridge the Gap and Create the Vision

Phase 1

1.1 Generate goals and drivers

1.2 Explore cloud characteristics

1.3 Create a current state summary

1.4 Select workloads for analysis

Phase 2

2.1 Conduct workload assessments

2.2 Determine workload future states

Phase 3

3.1 Generate risks and roadblocks

3.2 Mitigate risks and roadblocks

3.3 Define roadmap initiatives

Phase 4

4.1 Review and assign work items

4.2 Finalize cloud decision framework

4.3 Create cloud vision

This phase will walk you through the following activities:

• Assign initiatives and propose timelines
• Build a delivery model rubric
• Build a service model rubric
• Built a support model rubric
• Create a cloud vision statement
• Map cloud workloads
• Complete the Cloud Vision presentation

This phase involves the following participants:

• IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders

Step 4.1

Review and assign work items

Activities

4.1.1 Assign initiatives and propose timelines

Bridge the gap and create the vision

Review and assign work items

Finalize cloud decision framework

Create cloud vision

This step involves the following participants:

• Core working group
• IT management

Outcomes of this step

• Populated cloud vision roadmap

4.1.1 Assign initiatives and propose timelines

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Once the list is populated, begin assigning responsibility for execution. This is not a RACI exercise, so focus on the functional responsibility. Once you have determined who is responsible, assign a timeline and include any notes. This will form the basis of a more formal project plan.
2. To assign the initiative to a party, consider 1) who will be responsible for execution and 2) if that responsibility will be shared. Be as specific as possible, but be sure to be consistent to make it easier for you to sort responsibility later on.
3. When assigning timelines, we suggest including the end date (when you expect the project to be complete) rather than the start date, though whatever you choose, be sure to be consistent. Make use of the notes column to record anything that you think any other readers will need to be aware of in the future, or details that may not be possible to commit to memory.

Cloud Vision Workbook

Step 4.2

Finalize cloud decision framework

Activities

4.2.1 Build a delivery model rubric

4.2.2 Build a service model rubric

4.2.3 Build a support model rubric

Bridge the gap and create the vision

Review and assign work items

Finalize cloud decision framework

Create cloud vision

This step involves the following participants:

• Core working group

Outcomes of this step

• Cloud decision framework

4.2.1 Build a delivery model rubric

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Executive Presentation

Participants

• Core working group

1. Now that we have a good understanding of the cloud’s key characteristics, the relative suitability of different workloads for the cloud, and a good understanding of some of the risks and roadblocks that may need to be overcome if a cloud transition is to take place, it is time to formalize a delivery model rubric. Start by listing the delivery models on a white board vertically – public, private, hybrid, and multi-cloud. Include a community cloud option as well if that is feasible for you. Strike any models that do not figure into your vision.
2. Create a table style rubric for each delivery model. Confer with the working group to determine what characteristics best define workloads suitable for each model. If you have a hybrid cloud option, you may consider workloads that are highly dynamic; a private cloud hosted on-premises may be more suitable for workloads that have extensive regulatory requirements.
3. Once the table is complete, include it in the Cloud Vision Executive Presentation.

Cloud Vision Executive Presentation

Vision for the cloud future state (example)

Summary statement: Everything must go! Public cloud is a top priority. Anything that is not compatible (for whatever reason) with a public cloud deployment will be retained in a premises-based server closet (downgraded from a full datacenter). The private cloud does not align with the overall organizational vision, nor does a hybrid solution.

4.2.2 Build a service model rubric

1 hour

Input

• Output of workload assessments
• Output of risk and mitigation exercise

Output

• Service model rubric

Materials

• Whiteboard
• Cloud Vision Executive Presentation

Participants

• Core working group

1. This next activity is like the delivery model activity, but covers the relevant cloud service models. On a whiteboard, make a vertical list of the cloud service models (SaaS, PaaS, IaaS, etc.) that will be considered for workloads. If you have an order of preference, place your most preferred at the top, your least preferred at the bottom.
2. Describe the circumstances under which you would select each service model. Do your best to focus on differentiators. If a decision criterion appears for multiple service models, consider refining or excluding it. (For additional information, check out Info-Tech’s Reimagine IT Operations for a Cloud-First World blueprint.)
3. Create a summary statement to capture your overall service model position. See the next slide for an example. Note: this can be incorporated into your cloud vision statement, so be sure that it reflects your genuine cloud preferences.
4. Record the results in the Cloud Vision Executive Presentation.

Cloud Vision Executive Presentation

Vision for the cloud future state (example)

Summary statement: SaaS will be the primary service model. All workloads will migrate to the public cloud where possible. Anything that cannot be migrated to SaaS will be migrated to PaaS. IaaS is a transitory step.

4.2.3 Build a support model rubric

1 hour

Input

• Results of the cloud workload assessments

Output

• Support model rubric

Materials

• Whiteboard
• Cloud Vision Executive Presentation

Participants

• Core working group

1. The final rubric covered here is that for the support model. Where will you procure the skills necessary to ensure the vision’s proper execution? Much like the other rubric activities, write the three support models vertically (in order of preference, if you have one) on a whiteboard.
2. Next to each model, describe the circumstances under which you would select each support model. Focus on the dimensions: the duration of the engagement, specialization required, and flexibility required. If you have existing rules/practices around hiring consultants/MSPs, consider those as well.
3. Once you have a good list of decision criteria, form a summary statement. This should encapsulate your position on support models and should mention any notable criteria that will contribute to most decisions.
4. Record the results in the Cloud Vision Executive Presentation.

Cloud Vision Executive Presentation

Vision for the cloud future state (example)

Summary statement: Most workloads will be managed in house. A consultant will be employed to facilitate the transition to micro-services in a cloud container environment, but this will be transitioned to in-house staff. An MSP will continue to manage backups and telephony.

Step 4.3

Create cloud vision

Activities

4.3.1 Create a cloud vision statement

4.3.2 Map cloud workloads

4.3.3 Complete the Cloud Vision Presentation

Review and assign work items

Finalize cloud decision framework

Create cloud vision

This step involves the following participants:

• Core working group
• IT management

Outcomes of this step

Completed Cloud Vision Executive Presentation

4.3.1 Create a cloud vision statement

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Now that you know what service models are appropriate, it’s time to summarize your cloud vision in a succinct, consumable way. A good vision statement should have three components:
   • Scope: Which parts of the organization will the strategy impact?
   • Goal: What is the strategy intended to accomplish?
   • Key differentiator: What makes the new strategy special?
2. On a whiteboard, make a chart with three columns (one column for each of the features of a good mission statement). Have the group generate a list of words to describe each of the categories. Ideally, the group will produce multiple answers for each category.
3. Once you’ve gathered a few different responses for each category, have the team put their heads down and generate pithy mission statements that capture the sentiments underlying each category.
4. Have participants read their vision statements in front of the group. Use the rest of the session to produce a final statement. Record the results in the Cloud Strategy Executive Presentation.

Example vision statement outputs

“IT at ACME Corp. hereby commits to providing clients and end users with an unparalleled, productivity-enabling technology experience, leveraging, insofar as it is possible and practical, cloud-based services.”

“At ACME Corp. our employees and customers are our first priority. Using new, agile cloud services, IT is devoted to eliminating inefficiency, providing cutting-edge solutions for a fast-paced world, and making a positive difference in the lives of our colleagues and the people we serve.”

“As a global leader in technology, ACME Corp. is committed to taking full advantage of new cloud services, looking first to agile cloud options to optimize internal processes wherever efficiency gaps exist. Improved efficiency will allow associates to spend more time on ACME’s core mission: providing an unrivalled customer experience.”

Scope

Goal

Key differentiator

4.3.2 Map cloud workloads

1 hour

Input

• List of workloads
• List of acceptable service models
• List of acceptable migration paths

Output

• Workloads mapped by service model/migration path

Materials

• Whiteboard
• Sticky notes

Participants

• Core working group

1. Now that you have defined your overall cloud vision as well as your service model options, consider aligning your service model preferences with your migration path preferences. Draw a table with your expected migration strategies across the top (retain, retire, rehost, replatform, refactor, repurchase, or some of these) and your expected service models across the side.
2. On individual sticky notes, write a list of workloads in your environment. In a smaller environment, this list can be exhaustive. Otherwise take advantage of the list you created as part of phase 1 along with any additional workloads that warrant discussion.
3. As a group, go through the list, placing the sticky notes first in the appropriate row based on their characteristics and the decision criteria that have already been defined, and then in the appropriate column based on the appropriate migration path. (See the next slide for an example of what this looks like.)
4. Record the results in the Cloud Vision Executive Presentation. Note: not every cell will be filled; some migration path/service model combinations are impossible or otherwise undesirable.

Cloud Vision Executive Presentation

Example cloud workload map

4.3.3 Complete the Cloud Vision Presentation

1 hour

Input

• List of cloud initiatives

Output

• Initiatives assigned by responsibility and timeline

Materials

• Cloud Vision Workbook

Participants

• Core working group

1. Open the Cloud Vision Executive Presentation to the second slide and review the templated executive brief. This comprises several sections (see the next slide). Populate each one:
   • Summary of the exercise
   • The cloud vision statement
   • Key cloud drivers
   • Risks and roadblocks
   • Top initiatives and next steps
2. Review the remainder of the presentation. Be sure to elaborate on any significant initiatives and changes (where applicable) and to delete any slides that you no longer require.

Cloud Vision Workbook

Sample cloud vision executive summary

• From [date to date], a cross-functional group representing IT and its constituents met to discuss the cloud.
• Over the course of the week, the group identified drivers for cloud computing and developed a shared vision, evaluated several workloads through an assessment framework, identified risks, roadblocks, and mitigations, and finally generated initiatives and next steps.
• From the process, the group produced a summary and a cloud suitability assessment framework that can be applied at the level of the workload.

Cloud Vision Statement

[Organization] will leverage public cloud solutions and retire existing datacenter and colocation facilities. This transition will simplify infrastructure administration, support, and security, while modernizing legacy infrastructure and reducing the need for additional capital expenditure.

Initiatives and next steps

• Close the datacenter and colocation site in favor of a SaaS-first cloud approach.
• Some workloads will migrate to infrastructure-as-a-service in the short term with the assistance of third-party consultants.

Document your cloud strategy

You did it!

Congratulations! If you’ve made it this far, you’ve successfully articulated a cloud vision, assessed workloads, developed an understanding (shared with your team and stakeholders) of cloud concepts, and mitigated risks and roadblocks that you may encounter along your cloud journey. From this exercise, you should understand your mission and vision, how your cloud plans will interact with any other relevant strategic plans, and what successful execution looks like, as well as developing a good understanding of overall guiding principles. These are several components of your overall strategy, but they do not comprise the strategy in its entirety.

How do you fix this?

First, validate the results of the vision exercise with your stakeholders. Socialize it and collect feedback. Make changes where you think changes should be made. This will become a key foundational piece. The next step is to formally document your cloud strategy. This is a separate project and is covered in the Info-Tech blueprint Document Your Cloud Strategy.

The vision exercise tells you where you want to go and offers some clues as to how to get there. The formal strategy exercise is a formal documentation of the target state, but also captures in detail the steps you’ll need to take, the processes you’ll need to refine, and the people you’ll need to hire.

A cloud strategy should comprise your organizational stance on how the cloud will change your approach to people and human resources, technology, and governance. Once you are confident that you can make and enforce decisions in these areas, you should consider moving on to Document Your Cloud Strategy. This blueprint, Define Your Cloud Vision, often serves as a prerequisite for the strategy documentation conversation(s).

Appendix

Summary of Accomplishment

Additional Support

Research Contributors

Related Info-Tech Research

Vendor Resources

Bibliography

Summary of Accomplishment

Problem Solved

You have now documented what you want from the cloud, what you mean when you say “cloud,” and some preliminary steps you can take to make your vision a reality.

You now have at your disposal a framework for identifying and evaluating candidates for their cloud suitability, as well as a series of techniques for generating risks and mitigations associated with your cloud journey. The next step is to formalize your cloud strategy using the takeaways from this exercise. You’re well on your way to a completed cloud strategy!

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

Contact your account representative for more information.

workshops@infotech.com

1-888-670-8889

Additional Support

If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

The following are sample activities that will be conducted by Info-Tech analysts with your team:

Generate drivers for cloud adoption

Work with stakeholders to understand the expected benefits of the cloud migration and how these drivers will impact the overall vision.

Conduct workload assessments

Assess your individual cloud workloads for their suitability as candidates for the cloud migration.

Bibliography

“2021 State of the Cloud Report.” Flexera, 2021. Web.

“2021 State of Upskilling Report.” Pluralsight, 2021. Web.

“AWS Snowmobile.” Amazon Web Services, n.d. Web.

“Azure products.” Microsoft, n.d. Web.

“Azure Migrate Documentation.” Microsoft, n.d. Web.

Bell, Harold. “Multi-Cloud vs. Hybrid Cloud: What’s the Difference?” Nutanix, 2019. Web.

“Cloud Products.” Amazon Web Services, n.d. Web.

“COBIT 2019 Framework: Introduction and Methodology.” ISACA, 2019. Web.

Edmead, Mark T. “Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy.” ISACA, 2020. Web.

Flitter, Emily, and Karen Weise. “Capital One Data Breach Compromises Data of Over 100 Million.” The New York Times, 29 July 2019. Web.

Gillis, Alexander S. “Cloud Security Posture Management (CSPM).” TechTarget, 2021. Web.

“’How to Cloud’ with Capital One.” Amazon Web Services, n.d. Web.

“IBM Closes Landmark Acquisition of Red Hat for $34 Billion; Defines Open, Hybrid Cloud Future.” Red Hat, 9 July 2019. Web.

Mell, Peter, and Timothy Grance. “The NIST Definition of Cloud Computing.” National Institute of Standards and Technology, Sept. 2011. Web.

Ng, Alfred. “Amazon Tells Senators it Isn't to Blame for Capital One Breach.” CNET, 2019. Web.

Orban, Stephen. “6 Strategies for Migrating Applications to the Cloud.” Amazon Web Services, 2016. Web.

Sullivan, Dan. “Cloud Access Security Broker (CASB).” TechTarget, 2021. Web.

“What Is Secure Access Service Edge (SASE)?” Cisco, n.d. Web.

Design and Build an Effective Contract Lifecycle Management Process

Mitigate risk and drive value through robust best practices for contract lifecycle management.

Our understanding of the problem

This Research Is Designed For:

• The CIO who depends on numerous key vendors for services
• The CIO or Project Manager who wants to maximize the value delivered by vendors
• The Director or Manager of an existing IT procurement or vendor management team
• The Contracts Manager or Legal Counsel whose IT department holds responsibility for contracts, negotiation, and administration

This Research Will Help You:

• Implement and streamline the contract management process, policies, and procedures
• Baseline and benchmark existing contract processes
• Understand the importance and value of contract lifecycle management (CLM)
• Minimize risk, save time, and maximize savings with vendor contracts

This Research Will Also Assist

• IT Service Managers
• IT Procurement
• Contract teams
• Finance and Legal departments
• Senior IT leadership

This Research Will Help Them

• Understand the required components of a CLM
• Establish the current CLM maturity level
• Implement a new CLM process
• Improve on an existing or disparate process

ANALYST PERSPECTIVE

"Contract lifecycle management (CLM) is a vital process for small and enterprise organizations alike. Research shows that all organizations can benefit from a contract management process, whether they have as few as 25 contracts or especially if they have contracts numbering in the hundreds.

A CLM system will:

• Save valuable time in the entire cycle of contract/agreement processes.
• Save the organization money, both hard and soft dollars.
• Mitigate risk to the organization.
• Avoid loss of revenue.

If you’re not managing your contracts, you aren’t capitalizing on your investment with your vendors and are potentially exposing your organization to contract and monetary risk."

- Ted Walker
Principal Research Advisor, Vendor Management Practice
Info-Tech Research Group

Executive Summary

Situation

• Most organizations have vendor overload and even worse, no defined process to manage the associated contracts and agreements. To manage contracts, some vendor management offices (VMOs) use a shared network drive to store the contracts and a spreadsheet to catalog and manage them. Yet other less-mature VMOs may just rely on a file cabinet in Procurement and a reminder in someone’s calendar about renewals. These disparate processes likely cost your organization time spent finding, managing, and renewing contracts, not to mention potential increases in vendor costs and risk and the inability to track contract obligations.

Complication

• Contract lifecycle management (CLM) is not an IT buzzword, and it’s rarely on the top-ten list of CIO concerns in most annual surveys. Until a VMO gets to a level of maturity that can fully develop a CLM and afford the time and costs of doing so, there can be several challenges to developing even the basic processes required to store, manage, and renew IT vendor contracts. As is always an issue in IT, budget is one of the biggest obstacles in implementing a standard CLM process. Until senior leadership realizes that a CLM process can save time, money, and risk, getting mindshare and funding commitment will remain a challenge.

Resolution

• Understand the immediate benefits of a CLM process – even a basic CLM implementation can provide significant cost savings to the organization; reduce time spent on creating, negotiating, and renewing contracts; and help identify and mitigate risks within your vendor contracts.
• Budgets don’t always need to be a barrier to a standard CLM process. However, a robust CLM system can provide significant savings to the organization.

Info-Tech Insight

• If you aren’t managing your contracts, you aren’t capitalizing on your investments.
• Even a basic CLM process with efficient procedures will provide savings and benefits.
• Not having a CLM process may be costing your organization money, time, and exposure to unmitigated risk.

What you can gain from this blueprint

Why Create a CLM

• Improved contract organization
• Centralized and manageable storage/archives
• Improved vendor compliance
• Risk mitigation
• Reduced potential loss of revenue

Knowledge Gained

• Understanding of the value and importance of a CLM
• How CLM can impact many departments within the organization
• Who should be involved in the CLM steps and processes
• Why a CLM is important to your organization
• How to save time and money by maximizing IT vendor contracts
• How basic CLM policies and procedures can be implemented without costly software expenditure

The Outcome

• A foundation for a CLM with best-practice processes
• Reduced exposure to potential risks within vendor contracts
• Maximized savings with primary vendors
• Vendor compliance and corporate governance
• Collaboration, transparency, and integration with business units

Contract management: A case study

CASE STUDY
Industry Finance and Banking
Source Apttus

FIS Global

The Challenge

FIS’ business groups were isolated across the organization and used different agreements, making contract creation a long, difficult, and manual process.

• Customers frustrated by slow and complicated contracting process
• Manual contract creation and approval processes
• Sensitive contract data that lacked secure storage
• Multiple agreements managed across divisions
• Lack of central repository for past contracts
• Inconsistent and inaccessible

The Solution: Automating and Streamlining the Contract Management Process

A robust CLM system solved FIS’ various contract management needs while also providing a solution that could expand into full quote-to cash in the future.

• Contract lifecycle management (CLM)
• Intelligent workflow approvals (IWA)
• X-Author for Excel

Customer Results

• 75% cycle time reduction
• $1M saved in admin costs per year
• 49% increase in sales proposal volume
• Automation on one standard platform and solution
• 55% stronger compliance management
• Easy maintenance for various templates
• Ability to quickly absorb new contracts and processes via FIS’s ongoing acquisitions

Track the impact of CLM with these metrics

The numbers are compelling

71%

of companies can’t locate up to 10% of their contracts.

Source: TechnologyAdvice, 2019

9.2%

of companies’ annual revenue is lost because of poor contract management practices.

Source: IACCM, 2019

60%

still track contracts in shared drives or email folders.

Source: “State of Contract Management,” SpringCM, 2018

CLM blueprint objectives

• To provide a best-practice process for managing IT vendor contract lifecycles through a framework that organizes from the core, analyzes each step in the cycle, has collaboration and governance attached to each step, and integrates with established vendor management practices within your organization.
• CLM doesn’t have to be an expensive managed database system in the cloud with fancy dashboards. As long as you have a defined process that has the framework steps and is followed by the organization, this will provide basic CLM and save the organization time and money over a short period of time.
• This blueprint will not delve into the many vendors or providers of CLM solutions and their methodologies. However, we will discuss briefly how to use our framework and contract stages in evaluating a potential solution that you may be considering.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks used throughout all four options

Design and Build an Effective CLM Process – project overview

Workshop overview

Contact your account representative or email Workshops@InfoTech.com for more information.

PHASE 1

Master the Operational Framework of Contract Lifecycle Management

Design and Build an Effective CLM Process

Phase 1: Master the Operational Framework of Contract Lifecycle Management

Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of
2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

What Is Contract Lifecycle Management?

• Every contract has a lifecycle, from creation to time and usage to expiration. Organizations using a legacy or manual contract management process usually ask, “What is contract lifecycle management and how will it benefit my business?”
• Contract lifecycle management (CLM) creates a process that manages each contract or agreement. CLM eases the challenges of managing hundreds or even thousands of important business and IT contracts that affect the day-to-day business and could expose the organization to vendor risk.
• Managing a few contracts is quite easy, but as the number of contracts grows, managing each step for each contract becomes increasingly difficult. Ultimately, it will get to a point where managing contracts properly becomes very difficult or seemingly impossible.

That’s where contract lifecycle management (CLM) comes in.

CLM can save money and improve revenue by:

• Improving accuracy and decreasing errors through standardized contract templates and approved terms and conditions that will reduce repetitive tasks.
• Securing contracts and processes through centralized software storage, minimizing risk of lost or misplaced contracts due to changes in physical assets like hard drives, network shares, and file cabinets.
• Using policies and procedures that standardize, organize, track, and optimize IT contracts, eliminating time spent on creation, approvals, errors, and vendor compliance.
• Reducing the organization’s exposure to risks and liability.
• Having contracts renewed on time without penalties and with the most favorable terms for the business.

The Operational Framework of Contract Lifecycle Management

Four Components of the Operational Framework

1. Organization
2. Analysis
3. Collaboration and Governance
4. Integration/Vendor Management

• By organizing at the core of the process and then analyzing each stage, you will maximize each step of the CLM process and ensure long-term contract management for the organization.
• Collaboration and governance as overarching policies for the system will provide accountability to stakeholders and business units.
• Integration and vendor management are encompassing features in a well-developed CLM that add visibility, additional value, and savings to the entire organization.

Info-Tech Best Practice

Putting a contract manager in place to manage the CLM project will accelerate the improvements and provide faster returns to the organizations. Reference Info-Tech’s Contract Manager Job Description template as needed.

The operational framework is key to the success, return on investment (ROI), cost savings, and customer satisfaction of a CLM process.

1. Organization

• Every enterprise needs to organize its contract documents and data in a central repository so that everyone knows where to find the golden source of contractual truth.
• This includes:
• A repository for storing and organizing contract documents.
• A data dictionary for describing the terms and conditions in a consistent, normalized way.
• A database for persistent data storage.
• An object model that tracks changes to the contract and its prevailing terms over time.

Info-Tech Insight

Paper is still alive and doing very well at slowing down the many stages of the contract process.

2. Analysis

Most organizations analyze their contracts in two ways:

• First, they use reporting, search, and analytics to reveal risky and toxic terms so that appropriate operational strategies can be implemented to eliminate, mitigate, or transfer the risk.
• Second, they use process analytics to reveal bottlenecks and points of friction as contracts are created, approved, and negotiated.

3. Collaboration

• Throughout the contract lifecycle, teams must collaborate on tasks both pre-execution and post-execution.
• This includes document collaboration among several different departments across an enterprise.
• The challenge is to make the collaboration smooth and transparent to avoid costly mistakes.
• For some contracting tasks, especially in regulated industries, a high degree of control is required.
• In these scenarios, the organization must implement controlled systems that restrict access to certain types of data and processes backed up with robust audit trails.

4. Integration

• For complete visibility into operational responsibilities, relationships, and risk, an organization must integrate its golden contract data with other systems of record.
• An enterprise contracts platform must therefore provide a rich set of APIs and connectors so that information can be pushed into or pulled from systems for enterprise resource planning (ERP), customer relationship management (CRM), supplier relationship management (SRM), document management, etc.

This is the ultimate goal of a robust contract management system!

Member Activity: Document Current CLM Processes

1.1 Completion Time: 1-5 days

Goal: Document your existing CLM processes (if any) and who owns them, who manages them, etc.

Instructions

Interview internal business unit decision makers, stakeholders, Finance, Legal, CIO, VMO, Sales, and/or Procurement to understand what’s currently in place.

1. Use the Existing CLM Process Worksheet to capture and document current CLM processes.
2. Establish what processes, procedures, policies, and workflows, if any, are in place for pre-execution (Phase 1) contract stages.
3. Do the same for post-execution (Phase 2) stages.
4. Use this worksheet as reference for assessments and as a benchmark for improvement review six to 12 months later.

INPUT

• Internal information from all CLM stakeholders

OUTPUT

• A summary of processes and owners currently in place

Materials

• Existing CLM processes from interviews

Participants

• Finance, Legal, CIO, VMO, Sales, Procurement

PHASE 2

Understand the Ten Stages of Contract Lifecycle Management

Design and Build an Effective CLM Process

Phase 1: Master the Operational Framework of Contract Lifecycle Management

Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of
2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

The Ten Stages of Contract Lifecycle Management

There are ten key stages of contract lifecycle management.

The steps are divided into two phases, pre-execution and post-execution.

Pre-Execution (Phase 1)

1. Request
2. Create
3. Review Risk
4. Approve
5. Negotiate
6. Sign

Post-Execution (Phase 2)

7. Capture
8. Manage
9. Monitor Compliance
10. Optimize

Ten Process Stages Within the CLM Framework

Stage 1: Request or Initiate

Contract lifecycle management begins with the contract requesting process, where one party requests for or initiates the contracting process and subsequently uses that information for drafting or authoring the contract document. This is usually the first step in CLM.

Requests for contracts can come from various sources:

• Business units within the organization
• Vendors presenting their contract, including renewal agreements
• System- or process-generated requests for renewal or extension

At this stage, you need to validate if a non-disclosure agreement (NDA) is currently in place with the other party or is required before moving forward. At times, adequate NDA components could be included within the contract or agreement to satisfy corporate confidentiality requirements.

Stage 1: Request or Initiate

Stage Input

• Information about what the contract needs to contain, such as critical dates, term length, coverage, milestones, etc.
• Some organizations require that justification and budget approval be provided at this stage.
• Request could come from a vendor as a pre-created contract.
• Best practices recommend that a contract request form or template is used to standardize all required information.

Stage Output

• Completed request form, stored or posted with all details required to move forward to risk review and contract creation.
• Possible audit trails.

Stage 2: Create Contract

• At the creation or drafting stage, the document is created, generated, or provided by the vendor. The document will contain all clauses, scope, terms and conditions, and pricing as required.
• In some cases, a vendor-presented contract that is already prepared will go through an internal review or redlining process by the business unit and/or Legal.
• Both internal and external review and redlining are included in this stage.
• Also at this stage, the approvers and signing authorities are identified and added to the contract. In addition, some audit trail features may be added.

Info-Tech Best Practice

For a comprehensive list of terms and conditions, see our Software Terms & Conditions Evaluation Tool within Master Contract Review and Negotiation for Software Agreements.

Stage 2: Create Contract

Stage Input

• Contract request form, risk review/assessment.
• Vendor- or contractor-provided contract/agreement, either soft copy, electronic form, or more frequently, “clickwrap” web-posted document.
• Could also include a renewal notification from a vendor or from the CLM system or admin.

Stage Output

• Completed draft contract or agreement, typically in a Microsoft Word or Adobe PDF format with audit trail or comment tracking.
• Redlined document for additional revision and or acceptance.
• Amendment or addendum to existing contract.

Stage 3: Review Risk 1 of 2

The importance of risk review can not be understated. The contract or agreement must be reviewed by several stakeholders who can identify risks to the organization within the contract.

Three important definitions:

1. Risk is the potential for a negative outcome. A risk is crossing the street while wearing headphones and selecting the next track to play on your smartphone. A negative outcome is getting hit by an oncoming person who, unremarkably, was doing something similar at the same time.
2. Risk mitigation is about taking the steps necessary to minimize both the likelihood of a risk occurring – look around both before and while crossing the street – and its impact if it does occur – fall if you must, but save the smartphone!
3. Contract risk is about any number of situations that can cause a contract to fail, from trivially – the supplier delivers needed goods late – to catastrophically – the supplier goes out of business without having delivered your long-delayed orders.

Stage 3: Review Risk 2 of 2

• Contracts must be reviewed for business terms and conditions, potential risk situations from a financial or legal perspective, business commitments or obligations, and any operational concerns.
• Mitigating contract risk requires a good understanding of what contracts are in place, how important they are to the success of the organization, and what data they contain.

Collectively, this is known as contract visibility.

• Risk avoidance and mitigation are also a key component in the ROI of a CLM system and should be tracked for analysis.
• Risk-identifying forms or templates can be used to maintain consistency with corporate standards.

Stage 3: Review Risk

Stage Input

• All details of the proposed contract so that a proper risk analysis can be done as well as appropriate review with stakeholders, including:
  • Finance
  • Legal
  • Procurement
  • Security
  • Line-of-business owner
  • IT stakeholders

Stage Output

• A list of identified concerns that could expose the business unit or organization.
• Recommendations to minimize or eliminate identified risks.

Stage 4: Approve

The approval stage can be a short process if policies and procedures are already in place. Most organizations will have defined delegation of authority or approval authority depending on risk, value of the contract, and other corporate considerations.

• Defined approval levels should be known within the organization and can be applied to the approval workflow, expediting the approval of drafted terms, conditions, changes, and cost/spend within the contract internally.
• Tracking and flexibility needs to considered in the approval process.
• Gates need to be in place to ensure that a required approver has approved the contract before it moves to the next approver.
• Flexibility is needed in some situations for ad hoc approval tasks and should include audit trail as required.
• Approvers can include business units, Finance, Legal, Security, and C-level leaders

Stage 4: Approve

Stage Input

• Complete draft contract with all terms and conditions (T&Cs) and approval trail.
• Amendment or addendum to existing contract.

Stage Output

• Approved draft contract ready to move to the next step of negotiating with the vendor.
• Approved amendment or addendum to existing or renewal agreement.

Stage 5: Negotiate

• At this stage, there should be an approved draft of the contract that can be presented to the other party or vendor for review.
• Typically organizations will negotiate their larger deals for terms and conditions with the goal of balancing the contractual allocation of risk with the importance of the vendor or agreement and its value to the business.
• Several people on either side are typically involved and will discuss legal and commercial terms of the contract. Throughout the process, negotiators may leverage a variety of tools, including playbooks with preferred and fallback positions, clause libraries, document redlines and comparisons, and issue lists.

• Audit trails or tracking of changes and acceptances is an important part of this stage. Tracking will avoid duplication and lost or missed changes and will speed up the entire process.
• A final, clean document is created at this point and readied for execution.

Stage 5: Negotiate

Stage Input

• Approved draft contract ready to move to the next step of negotiating with the vendor.
• Approved amendment or addendum to existing or renewal agreement.

Stage Output

• A finalized and approved contract or amendment with agreed-upon terms and conditions ready for signatures.

Info-Tech Insight

Saving the different versions of a contract during negotiations will save time, provide reassurance of agreed terms as you move through the process, and provide reference for future negotiations with the vendor.

Stage 6: Sign or Execute

• At this stage in the process, all the heavy lifting in a contract’s creation is complete. Now it’s signature time.
• To finalize the agreement, both parties need to the sign the final document. This can be done by an in-person wet ink signature or by what is becoming more prevalent, digital signature through an e-signature process.
• Once complete, the final executed documents are exchanged or received electronically and then retained by each party.

Stage 6: Sign or Execute

Stage Input

• A finalized and approved contract or amendment with agreed-upon terms and conditions ready for signatures.

Stage Output

• An executed contract or amendment ready to move to the next stage of CLM, capturing in the repository.

Info-Tech Best Practice

Process flow provisions should made for potential rejection of the contract by signatories, looping the contract back to the appropriate stage for rework or revision.

Stage 7: Capture in Database/Repository 1 of 2

• This is one of the most important stages of a CLM process. Executed agreements need to be stored in a single manageable, searchable, reportable, and centralized repository.
• All documents should to be captured electronically, reviewed for accuracy, and then posted to the CLM repository.
• The repository can be in various formats depending on the maturity, robustness, and budget of the CLM program.

Most repositories are some type of database:

• An off-the-shelf product
• A PaaS cloud-based solution
• A homegrown, internally developed database
• An add-on module to your ERP system

Stage 7: Capture in Database/Repository 2 of 2

Several important features of an electronic repository should be considered:

• Consistent metadata tagging of clauses, terms, conditions, dates, etc.
• Centralized summary view of all contracts
• Controlled access for those who need to review and manage the contracts

Establishing an effective repository will be key to providing measurable value to the organization and saving large amounts of time for the business unit.

Info-Tech Insight

Planning for future needs by investing a little more money into a better, more robust repository could pay bigger dividends to the VMO and organization while providing a higher ROI over time as advanced functionality is deployed.

Stage 8: Manage

• Once an agreement is captured in the repository, it needs to be managed from both an operational and a commitment perspective.
• Through a summary view or master list, contracts need to be operationally managed for end dates and renewals, vendor performance, discounts, and rebates.
• Managing contracts for commitment and compliance will ensure all contract requirements, rights, service-level agreements (SLAs), and terms are fulfilled. This will eliminate the high costs of missed SLAs, potential breaches, or missed renewals.
• Managing contracts can be improved by adding metadata to the records that allow for easier search and retrieval of contracts or even proactive notification.

• The repository management features can and should be available to business stakeholders, or reporting from a CLM admin can also alert stakeholders to renewals, pricing, SLAs, etc.
• Also important to this stage is reporting. This can be done by an admin or via a self-serve feature for stakeholders, or it could even be automated.

Stage 9: Monitor Compliance 1 of 2

• At this stage, the contracts or agreements need to be monitored for the polices within them and the purpose for which they were signed.
• This is referred to as obligation management and is a key step to providing savings to the organization and mitigating risk.
• Many contracts contain commitments by each party. These can include but are not limited to SLAs, service uptime targets, user counts, pricing threshold discounts and rebates, renewal notices to vendors, and training requirements.
• All of these obligations within the contracts should be summarized and monitored to ensure that all commitments are delivered on. Managing obligations will mitigate risks, maximize savings and rebates to the organization, and minimize the potential for a breach within the contract.

Stage 9: Monitor Compliance 2 of 2

• Monitoring and measuring vendor commitments and performance will also be a key factor in maximizing the benefits of the contract through vendor accountability.
• Also included in this stage is renewal and/or disposition of the contract. If renewal is due, it should go back to the business unit for submission to the Stage 1: Request process. If the business unit is not going to renew the contract, the contract must be tagged and archived for future reference.

Stage 10: Optimize

• The goal of this stage is to improve the other stages of the process as well as evaluate how each stage is integrating with the core operational framework processes.
• With more data and improved insight into contractual terms and performance, a business can optimize its portfolio for better value, greater savings, and lower-risk outcomes.
• For high-performance contract teams, the goal is a continuous feedback loop between the contract portfolio and business performance. If, for example, the data shows that certain negotiation issues consume a large chunk of time but yield no measurable difference in risk or performance, you may tweak the playbook to remedy those issues quickly.

Additional optimization tactics:

• Streamlining contract renewals with auto-renew
• Predefined risk review process or template, continuous review/improvement of negotiation playbook
• Better automation or flow of approval process
• Better signature delegation process if required
• Improving repository search with metadata tagging
• Automating renewal tracking or notice process
• Tracking the time a contract spends in each stage

Establish Your Current CLM Maturity Position

• Sometimes organizations have a well-defined pre-execution process but have a poor post-signature process.
• Identifying your current processes or lack thereof will provide you with a starting point in developing a plan for your CLM. It’s possible that most of the stages are there and just need some improvements, or maybe some are missing and need to be implemented.
• It’s not unusual for organizations to have a manual pre-execution process and an automated backend repository with compliance and renewal notices features.

Info-Tech Best Practice

Use the CLM Maturity Assessment Tool to outline where your organization is at each stage of the process.

Member Activity: Assess Current CLM Maturity

2.1 Completion Time 1-2 days

Goal: Identify and measure your existing CLM processes, if any, and provide a maturity value to each stage. The resulting scores will provide a maturity assessment of your CLM.

Instructions

1. Use the Existing CLM Process Worksheet to document current CLM processes.
2. Using the CLM worksheet info, answer the questions in the CLM Maturity Assessment Tool.
3. Review the results and scores on Tab 3 to see where you need to focus your initial improvements.
4. Save the initial assessment for future reference and reassess in six to 12 months to measure progress.

INPUT

• Internal information from all CLM stakeholders

OUTPUT

• A summary of processes and owners currently in place in the organization

Materials

• Existing CLM processes from interviews

Participants

• Finance, Legal, CIO, VMO, Sales, Procurement

Member Activity: Complete RASCI Chart

2.2 Completion Time 2-6 hours

Goal: Identify who in your organization is primarily accountable and involved in each stage of the CLM process.

Instructions

Engage internal business unit decision makers, stakeholders, Finance, Legal, CIO, VMO, Sales, and Procurement as required to validate who should be involved in each stage.

1. Using the information collected from internal reviews, assign a level in the CLM RASCI Diagram to each team member.
2. Use the resulting RASCI diagram to guide you through developing or improving your CLM stages.

INPUT

• Internal interview information

OUTPUT

• Understanding of who is involved in each CLM stage

Materials

• Interview data
• RASCI Diagram

Participants

• Finance, Legal, CIO, VMO, Sales, Procurement

Applying CLM Framework and Stages to Your Organization

• Understand what CLM process you currently do or do not have in place.
• Review implementation options: automated, semi-automated, and manual solutions.
• If you are improving an existing process, focus on one phase at a time, perfect it, and then move to the other phase. This can also be driven by budget and time.
• Create a plan to start with and then move to automating or semi-automating the stages.
• Building onto or enhancing an existing system or processes can be a cost-effective method to produce near-term measurable savings
• Focus on one phase at a time, then move on to the other phase.
• While reviewing implementation of or improvements to CLM stages, be sure to track or calculate the potential time and cost savings and risk mitigation. This will help in any required business case for a CLM.

CLM: An ROI Discussion 1 of 2

• ROI can be easier to quantify and measure in larger organizations with larger CLM, but ROI metrics can be obtained regardless of the company or CLM size.
• Organizations recognize their ROI through gains in efficiency across the entire business as well as within individual departments involved in the contracting process. They also do so by reducing the risk associated with decentralized and insecure storage of and access to their contracts, failure to comply with terms of their contracts, and missing deadlines associated with contracts.

Just a few of the factors to consider within your own organization include:

• The number of people inside and outside your company that touch your contracts.
• The number of hours spent weekly, monthly, and annually managing contracts.
• Potential efficiencies gained in better managing those contracts.
• The total number of contracts that exist at any given time.
• The average value and total value of those contract types.
• The potential risk of being in breach of any of those contracts.
• The number of places contracts are stored.
• The level of security that exists to prevent unauthorized access.
• The potential impact of unauthorized access to your sensitive contract data.

CLM: An ROI Discussion 2 of 2

Decision-Maker Apprehensions

Decision-maker concerns arise from a common misunderstanding – that is, a fundamental failure to appreciate the true source of contract management value. This misunderstanding goes back many years to the time when analysts first started to take an interest in contract management and its automation. Their limited experience (primarily in retail and manufacturing sectors) led them to think of contract management as essentially an administrative function, primarily focused on procurement of goods. In such environments, the purpose of automation is focused on internal efficiency, augmented by the possibility of savings from reduced errors (e.g. failing to spot a renewal or expiry date) or compliance (ensuring use of standard terms).

Today’s CLM systems and processes can provide ROI in several areas in the business.

Info-Tech Insight

Research on ROI of CLM software shows significant hard cost savings to an organization. For example, a $10 million company with 300 contracts valued at $3 million could realize savings of $83,400 and avoid up to $460,000 in lost revenues. (Derived from: ACCDocket, 2018)

Additional Considerations 1 of 2

Who should own and/or manage the CLM process within an organization? Legal, VMO, business unit, Sales?

This is an often-discussed question. Research suggests that there is no definitive answer, as there are several variables.

Organizations needs to review what makes the best business sense for them based on several considerations and then decide where CLM belongs.

• Business unit budgets and time management
• Available Administration personnel and time
• IT resources
• Security and access concerns
• Best fit based on organizational structure

35% of law professionals feel contract management is a legal responsibility, while 45% feel it’s a business responsibility and a final 20% are unsure where it belongs. (Source: “10 Eye-Popping Contract Management Statistics,” Apttus, 2018)

Additional Considerations 2 of 2

What type of CLM software or platform should we use?

This too is a difficult question to answer definitively. Again, there are several variables to consider. As well, several solutions are available, and this is not a one-size-fits-all scenario.

As with who should own the CLM process, organizations must review the various CLM software solutions available that will meet their current and future needs and then ask, “What do we need the system to do?”

• Do you build a “homegrown” solution?
• Should it be an add-on module to the current ERP or CRM system?
• Is on-premises more suitable?
• Is an adequate off-the-shelf (OTS) solution available?
• What about the many cloud offerings?
• Is there a basic system to start with that can expand as you grow?

Info-Tech Insight

When considering what type of solution to choose, prioritize what needs to been done or improved. Sometimes solutions can be deployed in phases as an “add-on” type modules.

Summary of Accomplishment

Knowledge Gained

• Documented current CLM process
• Core operational framework to build a CLM process on
• Understanding of best practices required for a sustainable CLM

Processes Optimized

• Internal RASCI process identified
• Existing internal stage improvements
• Internal review process for risk mitigation

Deliverables Completed

• Existing CLM Processes Worksheet
• CLM Maturity Assessment
• CLM RASCI Chart
• CLM improvement plan

Project Step Summary

Client Project: CLM Assessment and Improvement Plan

1. Set your goals – what do you want to achieve in your CLM project?
2. Assess your organization’s current CLM position in relation to CLM best practices and stages.
3. Map your organization’s RASCI structure for CLM.
4. Identify opportunities for stage improvements or target all low stage assessments.
5. Prioritize improvement processes.
6. Track ROI metrics.
7. Develop a CLM implementation or improvement plan.

Info-Tech Insight

This project can fit your organization’s schedule:

• Do-it-yourself with your team.
• Remote delivery (Info-Tech Guided Implementation).

CLM Blueprint Summary and Conclusion

• Contract management is a vital component of a responsible VMO that will benefit all business units in an organization, save time and money, and reduce risk exposure.
• A basic well-deployed and well-managed CLM will provide ROI in the short term.
• Setting an improvement plan with concise improvements and potential cost savings based on process improvements will help your business case for CLM get approval and leadership buy-in.
• Educating and aligning all business units and stakeholders to any changes to CLM processes will ensure that cost savings and ROI are achieved.
• When evaluating a CLM software solution, use the operational framework and the ten process stages in this blueprint as a reference guide for CLM vendor functionality and selection.

Related Info-Tech Research

Master Contract Review and Negotiation

Optimize spend with significant cost savings and negotiate from a position of strength.

Manage Your Vendors Before They Manage You

Maximize the value of vendor relationships.

Bibliography

Burla, Daniel. “The Must Know Of Transition to Dynamics 365 on Premise.” Sherweb, 14 April 2017. Web.

Anand, Vishal, “Strategic Considerations in Implementing an End-to-End Contract Lifecycle Management Solution.” DWF Mindcrest, 20 Aug. 2016. Web.

Alspaugh, Zach. “10 Eye-Popping Contract Management Statistics from the General Counsel’s Technology Report.” Apttus, 23 Nov. 2018. Web.

Bishop, Randy. “Contract Management is not just a cost center.” ContractSafe, 9 Sept. 2019. Web.

Bryce, Ian. “Contract Management KPIs - Measuring What Matters.” Gatekeeper, 2 May 2019. Web.

Busch, Jason. “Contract Lifecycle Management 101.” Determine. 4 Jan. 2018. Web.

“Contract Management Software Buyer's Guide.” TechnologyAdvice, 5 Aug. 2019. Web.

Dunne, Michael. “Analysts Predict that 2019 will be a Big Year for Contract Lifecycle Management.” Apttus, 19 Nov. 2018. Web.

“FIS Case Study.” Apttus, n.d. Web.

Gutwein, Katie. “3 Takeaways from the 2018 State of Contract Management Report.” SpringCM, 2018. Web.

“IACCM 2019 Benchmark Report.” IAACM, 4 Sept. 2019. Web.

Linsley, Rod. “How Proverbial Wisdom Can Help Improve Contract Risk Mitigation.” Gatekeeper, 2 Aug. 2019. Web.

Mars, Scott. “Contract Management Data Extraction.” Exari, 20 June 2017. Web.

Rodriquez, Elizabeth. “Global Contract Life-Cycle Management Market Statistics and Trends 2019.” Business Tech Hub, 17 June 2017. Web.

“State of Contract Management Report.” SpringCM, 2018. Web.

Teninbaum, Gabriel, and Arthur Raguette. “Realizing ROI from Contract Management Technology.” ACCDocket.com, 29 Jan. 2018. Web.

Wagner, Thomas. “Strategic Report on Contract Life cycle Management Software Market with Top Key Players- IBM Emptoris, Icertis, SAP, Apttus, CLM Matrix, Oracle, Infor, Newgen Software, Zycus, Symfact, Contract Logix, Coupa Software.” Market Research, 21 June 2019. Web.

“What is Your Contract Lifecycle Management (CLM) Persona?” Spend Matters, 19 Oct. 2017. Web.

Reduce Manual Repetitive Work With IT Automation

Free up time for value-adding jobs.

ANALYST PERSPECTIVE

Automation cuts both ways.

Automation can be very, very good, or very, very bad.
Do it right, and you can make your life a whole lot easier.
Do it wrong, and you can suffer some serious pain.
All too often, automation is deployed willy-nilly, without regard to the overall systems or business processes in which it lives.
IT professionals should follow a disciplined and consistent approach to automation to ensure that they maximize its value for their organization.

Derek Shank,
Research Analyst, Infrastructure & Operations
Info-Tech Research Group

Executive summary

Situation

• IT staff are overwhelmed with manual repetitive work.
• You have little time for projects.
• You cannot move as fast as the business wants.

Complication

• Automation is simple to say, but hard to implement.
• Vendors claim automation will solve all your problems.
• You have no process for managing automation.

Resolution

• Begin by automating a few tasks with the highest value to score quick wins.
• Define a process for rolling out automation, leveraging SDLC best practices.
• Determine metrics and continually track the success of the automation program.

Info-Tech Insight

1. Optimize before you automate.The current way isn’t necessarily the best way.
2. Foster an engineering mindset.Your team members may not be process engineers, but they should learn to think like one.
3. Build a process to iterate.Effective automation can't be a one-and-done. Define a lightweight process to manage your program.

Infrastructure & operations teams are overloaded with work

• DevOps and digital transformation initiatives demand increased speed.
• I&O is still tasked with security and compliance and audit.
• I&O is often overloaded and unable to keep up with demand.

Manual repetitive work (MRW) sucks up time

• Manual repetitive work is a fact of life in I&O.
• DevOps circles refer to this type of work simply as “toil.”
• Toil is like treading water: it must be done, but it consumes precious energy and effort just to stay in the same place.
• Some amount of toil is inevitable, but it's important to measure and cap toil, so it does not end up overwhelming your team's whole capacity for engineering work.

Info-Tech Insight

Follow our methodology to focus IT automation on reducing toil.

Manual hand-offs create costly delays

• Every time there is a hand-off, we lose efficiency and productivity.
• In addition to the cost of performing manual work itself, we must also consider the impact of lost productivity caused by the delay of waiting for that work to be performed.

Every queue is a tire fire

Queues create waste and are extremely damaging. Like a tire fire, once you get started, they’re almost impossible to stamp out!

Increase queues if you want

• “More overhead”
• “Lower quality”
• “More variability”
• “Less motivation”
• “Longer cycle time”
• “Increased risk”

(Source: Edwards, citing Donald G. Reinersten: The Principles of Product Development Flow: Second Generation Lean Product Development )

Increasing complexity makes I&O’s job harder

Every additional layer of complexity multiplies points of failure. Beyond a certain level of complexity, troubleshooting can become a nightmare.

Today, Operations is responsible for the outcomes of a full stack of a very complex, software-defined, API-enabled system running on infrastructure they may or may not own.
– Edwards

Growing technical debt means an ever-rising workload

• Enterprises naturally accumulate technical debt.
• All technology requires care and feeding.
• I&O cannot control how much technology it’s expected to support.
• I&O faces a larger and larger workload as technical debt accumulates.

The systems built under each new technology paradigm never fully replace the systems built under the old paradigms. It’s not uncommon for an enterprise to have an accumulation of systems built over 10-15 years and have no budget, risk appetite, or even a viable path to replace them all. With each shift, who bares [SIC] the brunt of the responsibility for making sure the old and the new hang together? Operations, of course. With each new advance, Operations juggles more complexity and more layers of legacy technologies than ever before.
– Edwards

Most IT shops can’t have a dedicated engineering team

• In most organizations, the team that builds things is best equipped to support them.
• Often the knowledge to design systems and the knowledge to run those systems naturally co-exists in the same personnel resources.
• When your I&O team is trying to do engineering work, they can end up frequently interrupted to perform operational tasks.

Personnel resources in most IT organizations overlap heavily between “build” and “run.”

IT operations must become an engineering practice

• Usually you can’t double your staff or double their hours.
• IT professionals must become engineers.
• We do this by automating manual repetitive work and reducing toil.

Build your Sys Admin an Iron Man suit

Some CIOs see a Sys Admin and want to replace them with a Roomba. I see a Sys Admin and want to build them an Iron Man suit.
– Deepak Giridharagopal, CTO, Puppet

Use automation to reduce risk

Consistency

When we automate, we can make sure we do something the same way every time and produce a consistent result.

Auditing and Compliance

We can design an automated execution that will ship logs that provide the context of the action for a detailed audit trail.

Change

• Enterprise environments are continually changing.
• When context changes, so does the procedure.
• You can update your docs all you want, but you can't make people read them before executing a procedure.
• When you update the procedure itself, you can make sure it’s executed properly.

Follow Info-Tech’s approach: Start small and snowball

• It’s difficult for I&O to get the staffing resources it needs for engineering work.
• Rather than trying to get buy-in for resources using a “top down” approach, Info-Tech recommends that I&O score some quick wins to build momentum.
• Show success while giving your team the opportunity to build their engineering chops.

Because the C-suite relies on upwards communication — often filtered and sanitized by the time it reaches them — executives don’t see the bottlenecks and broken processes that are stalling progress.
– Andi Mann

Info-Tech’s methodology employs a targeted approach

• You aren’t going to automate IT operations end-to-end overnight.
• In fact, such a large undertaking might be more effort than it’s worth.
• Info-Tech’s methodology employs a targeted approach to identify which candidates will score some quick wins.
• We’ll demonstrate success, gain momentum, and then iterate for continual improvement.

Invest in automation to reap long-term rewards

• All too often people think of automation like a vacuum cleaner you can buy once and then forget.
• The reality is you need to perform care and feeding for automation like for any other process or program.
• To reap the greatest rewards you must continually invest in automation – and invest wisely.

To get the full ROI on your automation, you need to treat it like an employee. When you hire an employee, you invest in that person. You spend time and resources training and nurturing new employees so they can reach their full potential. The investment in a new employee is no different than your investment in automation.– Edwards

Measure the success of your automation program

1 15 FTEs x 80k/yr.; 20% of time on MRW, reduced by 20%
2 15 FTEs x 80k/yr.; 30% project capacity, increased by 30%
3 25k/hr. of downtime.; 5 hours per year of downtime caused by errors

Automating failover for disaster recovery

CASE STUDY

Industry Financial Services
Source Interview

Challenge

An IT infrastructure manager had established DR failover procedures, but these required a lot of manual work to execute. His team lacked the expertise to build automation for the failover.

Solution

The manager hired consultants to build scripts that would execute portions of the failover and pause at certain points to report on outcomes and ask the human operator whether to proceed with the next step.

Results

The infrastructure team reduced their achievable RTOs as follows:
Tier 1: 2.5h → 0.5h
Tier 2: 4h → 1.5h
Tier 3: 8h → 2.5h
And now, anyone on the team could execute the entire failover!

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostics and consistent frameworks used throughout all four options

Reduce Manual Repetitive Work With IT Automation – project overview

Modernize and Transform Your End-User Computing Strategy

Support the workforce of the future.

EXECUTIVE BRIEF

Analyst Perspective

Focus beyond the device

It’s easy to think that if we give end users nice devices, then they will be more engaged and they will be happy with IT. If only it were that easy.

Info-Tech Research Group has surveyed over 119,000 people through its CIO Business Vision diagnostic. The results show that a good device is necessary but not enough for high satisfaction with IT. Once a user has a decent device, the other aspects of the user’s experience has a higher impact on their satisfaction with IT.

After all, if a person is trying to run apps designed in the 1990s, if they are struggling to access resources through an underperforming VPN connection, or if they can’t get help when their devices and apps aren’t working, then it doesn’t matter that you gave them a state-of-the-art MacBook or Microsoft Surface.

As you build out your end-user computing strategy to reflect the new reality of today’s workforce, ensure you focus on shifting user support left, modernizing apps to support how users need to work, and ensuring that your network and collaboration tools can support the increased demands. End-user computing teams need to focus beyond the device.

Ken Weston, ITIL MP, PMP, Cert.APM, SMC

Research Director, Infrastructure and Operations Info-Tech Research Group

Mahmoud Ramin, PhD

Senior Research Analyst, Infrastructure and Operations Info-Tech Research Group

Executive Summary

Your Challenge

IT needs to answer these questions:

• What types of computing devices, provisioning models, and operating systems (OSes) should be offered to end users?
• How will IT support devices?
• What are the policies and governance surrounding how devices are used?
• What actions are we taking and when?
• How do end-user devices support larger corporate priorities and strategies?

Your answers need to balance choice, risk, and cost.

Common Obstacles

Management paradigms have shifted:

• OSes, device management, and IT asset management (ITAM) practices have changed.
• Users expect full capabilities on any personal device.
• Virtual desktops are switching to the cloud.
• Low-code/no-code platforms allow the business to manage their own apps or comanage with IT.
• Work-from-anywhere is the default.
• Users have higher customer service expectations.

Take end-user computing beyond the OS.

Info-Tech's Approach

This blueprint will help you:

• Identify desired benefits that align to IT and corporate priorities and strategies.
• Perform a persona analysis.
• Define a vision for end-user computing.
• Define the standard device and app offerings.
• Improve the supporting services surrounding devices.
• Develop a roadmap for implementing your strategy.

A good device is necessary for satisfaction with IT but it’s not enough.

If a user has a prestigious tablet but the apps aren’t built well, they can’t get support on it, or they can’t connect to the internet, then that device is useless. Focus on supportability, use cases, connection, policy – and device.

Your challenge

This blueprint will help you build a strategy that answers these questions:

• What types of computing devices should be offered to end users?
• What provisioning models will be used?
• What operating systems are supported?
• How will IT support devices?
• What are the policies and governance surrounding how devices are used?
• What actions are we taking and when?
• How do end-user devices support larger corporate priorities and strategies?

Definition: End-User Computing (EUC)

End-user computing (EUC) is the domain of information and technology that deals with the devices used by workers to do their jobs. EUC has five focus areas: devices, user support, use cases, policy & governance, and fitness for use.

A good end-user computing strategy will effectively balance:

User Choice

Cost

Risk

The right balance will be unique for every organization.

Strike the right balance

The discussion is larger than desktop support

If IT is an influencer, then you get to drive this conversation. If IT is not an influencer, then you need to support whatever option the business wants.

Good devices are necessary for overall IT satisfaction

BUT

Good devices are not enough for high satisfaction

A bad device can ruin a person’s satisfaction with IT

Info-Tech’s CIO Business Vision has shown that when someone is dissatisfied with their device, their satisfaction with IT overall is only 40.92% on average.

When a person is satisfied with their device, their average satisfaction increases by approximately 30 percentage points to 70.22%. (Info-Tech Research Group, CIO Business Vision, 2021; N=119,383)

Improvements in the service desk, business apps, networks and communication infrastructure, and IT policy all have a higher impact on increasing satisfaction.

For every one-point increase in satisfaction in those areas, respondents’ overall satisfaction with IT increased by the respective percentage of a point. (Info-Tech Research Group, CIO Business Vision, 2021; N=119,409)

End-User Paradigms Have Shifted

Take end-user computing beyond the device

Operating System - OS

Only Windows

• More choices than ever before

Endpoint Management System - UEM

Group Policy & Client Management

• Modern & Unified Endpoint Management

Personal Devices - BYOD

Limited to email on phones

• Full capabilities on any device

IT Asset Management - ITAM

Hands-on with images

• Zero-touch with provisioning packages

Virtual Desktops - DaaS

Virtual Desktop Infrastructure in the Data Center

• Desktop-as-a-Service in the cloud

Business-Managed Apps - BMA

Performed by IT

• Performed by the Business and IT

Work-From-Anywhere - WFA

Rare

• Default

Customer Satisfaction - C Sat

Phone calls and transactional interactions

• Self-serve & managing entire experience

Don’t limit your focus to only Windows and Macs

Android is the OS with the largest market share

Users and IT have more choices than ever before

Operating System - OS

Only Windows

• More choices than ever before

Microsoft is still the dominant player in end-user computing, but Windows has only a fraction of the share it once had.

IT needs to revisit their device management practices. Modern management tools such as unified endpoint management (UEM) tools are better suited than traditional client management tools (CMT) for a cross-platform world.

IT must also revisit their application portfolios. Are business apps supported on Android and iOS or are they only supported on Windows? Is there an opportunity to offer more options to end users? Are end users already running apps and handling sensitive data on Android and iOS through software-as-a-service and bring-your-own-device (BYOD) capabilities in Office 365 and Google apps?

OS market share is partly driven by the digital divide

If someone must choose between a smartphone and a computer, they go with a smartphone

IT can’t expect everyone to be fluent on Windows and Mac, have a computer at home, or even have home broadband.

Of US adults aged 18-29:

• 96% have a smartphone (the rest have cellphones).
• Only 70% of US adults aged 18-29 have a home broadband connection.

Further, only 59% of US adults making less than $30,000/year have a laptop or desktop. (“Mobile Technology” and “Digital Divide,” Pew Research, 2021.)

Globally, people are likelier to have a cell subscription than they are to have access to broadband.

Embrace new device management paradigms

Endpoint Management System - UEM

Group Policy & Client Management

• Modern & Unified Endpoint Management

Evaluate enterprise mobility management and unified endpoint management to better support a remote-first, cross-platform reality.

Client Management Tool (CMT)

CMTs such as Microsoft Endpoint Configuration Manager (ConfigMgr, aka SCCM) can be used to distribute apps, apply patches, and enforce group policy.

Enterprise Mobility Management (EMM)

EMM tools allow you to manage multiple device platforms through mobile device management (MDM) protocols. These tools enforce security settings, allow you to push apps to managed devices, and monitor patch compliance through reporting.

EMM tools often support mobile application management (MAM) and mobile content management (MCM). Most EMM tools can manage devices running Windows, Mac OS, iOS, and Android, although there are exceptions.

Unified Endpoint Management (UEM)

UEM solutions combine CMT and EMM for better control of remote computers running Windows or Macs. Examples include:

• Windows devices comanaged by Intune and ConfigMgr.
• Mac devices managed by Jamf Pro.
• Mac devices comanaged by Jamf Pro and Intune.

Most UEM tools can manage devices running Windows, Mac OS, iOS, and Android, allowing IT to manage all end-user devices from a unified tool set (although there are exceptions).

Mobile Application Management (MAM)

MAM provides the ability to package an app with security settings, distribute app updates, and enforce app updates. Some capabilities do not require apps to be enrolled in an EMM or UEM solution.

Mobile Content Management (MCM)

MCM tools distribute files to remote devices. Many MCM solutions allow for security settings to be applied, such as encrypting the files or prohibiting data from leaving the secure container. Examples include OneDrive, Box, and Citrix ShareFile.

Adopt modern management with EMM and UEM – better toolsets for today’s state of EUC

Sacrifice your Group Policy Objects to better manage Windows computers

IT asset management practices are shifting

IT Asset Management - ITAM

Hands-on with images

• Zero-touch with provisioning packages

Supply chain issues are making computers longer to procure, meaning users are waiting longer for computers (Cision, 2021). The resulting silicon chip shortage is expected to last until at least 2023 (Light Reading, 2021).

IT departments are delaying purchases, delaying refreshes, and/or purchasing more to reserve devices before they need them.

Remote work has increased by 159% over the past 12 years (NorthOne, 2021). New hires and existing users can’t always go into the office to get a new computer.

IT departments are paying vendors to hold onto computers and then drop-ship them directly to the end user. The devices are provisioned using zero touch (e.g. Autopilot, Apple Device Manager, or another tool). Since zero-touch provisioning tools do not support images, teams have had to switch to provisioning packages.

The pandemic saw an increase in spending on virtual desktops

Virtual desktops offered powerful tools for supporting remote devices and personal computers without compromising sensitive data

Virtual Desktops - DaaS

Virtual Desktop Infrastructure in the Data Center

• Desktop-as-a-Service in the cloud

The pandemic helped cloud-based virtual desktop infrastructure (VDI)

Citrix saw subscription revenue increase 71% year over year in 2020 (Citrix 2020 Annual Report, p. 4). VMware saw subscription and SaaS revenue increase 38% from January 2020 to 2021 – while on-premises licensing revenue decreased by 5% (VMware Annual Report 2021, p. 40).

IT no longer needs to manage the underlying infrastructure

Microsoft and AWS are offering desktops as a service (i.e. cloud-based virtual desktops). IT needs to manage only the device, not the underlying virtual desktop infrastructure. This is in addition to Citrix’s and VMware’s cloud offerings, where IT doesn’t need to manage the underlying infrastructure that supports VDI.

Visit the blueprint Implement Desktop Virtualization and Transition to Everything as a Service to get started.

Work-from-anywhere (WFA) is now the default

COVID-19 forced this shift

Work-From-Anywhere - WFA

Rare

• Default

Be prepared to support a hybrid workforce, where people are sometimes working remotely and sometimes working in the office.

• Device provisioning and deployment need to be rethought. In-person deployment is not always possible. IT should evaluate tools such as zero-touch provisioning.
• Service desks need better monitoring and management tools. End-user experience management (EUEM) can allow you to better identify where network issues are occurring – in your data center, at the user’s house, in the cloud, or somewhere in between. Remote control tools can then allow your tier 1 to remediate issues on the user’s device.
• Apps and devices need to be usable from anywhere. Environments that rely on desktops and on-premises apps need to be rearchitected for a remote-first workforce.
• Users are living inside video conferencing tools. With the impact of the COVID-19 pandemic, there are about 145 million daily users of Microsoft Teams, almost twice the number of users in 2020 (MUO, 2021). Ensure they have the training and expertise to effectively use these tools.

“More technical troubleshooting due to users working from home a lot more. It can be more difficult to talk users through fixes when they are off site if you cannot remotely assist so more emphasis on the communication skill which was already important.” (Service Desk Institute, 2021)

Visit the Hybrid Workplace Research Center to better support a hybrid workforce.

BYOD fully includes personal computers

It’s no longer about whether IT will allow BYOD

Stop pretending BYOD doesn’t happen

Personal Devices - BYOD

Limited to email on phones

• Full capabilities on any device

• BYOD (including BYOPC) is turned on by default. SaaS tools like Office 365 are built to be used on multiple devices, including multiple computers. Further, the pandemic saw 47% of organizations significantly increase their use of BYOD (Cybersecurity Insiders, 2021; N=271).
• BYOD can boost productivity. When employees can use smartphones for work, they report that it increases their productivity by 34 percent (Samsung Insights, 2016).
• BYOD is hard to support, so most organizations don’t. Only 22% of organizations provide full support for mobile devices, while 20% provide no support, 25% provide ad hoc support, and 26% provide limited support (Cybersecurity Insiders, 2021). If smartphones and tablets are heavily ingrained in business processes, then migrating to BYOD can overload the service desk.
• Securely enable employees. Mobile application management (MAM), mobile content management (MCM), and Office 365 have gotten smarter at protecting corporate data.

Action Item: Identify how IT can provide more support to personally owned computers, tablets, and smartphones.

58% of working Americans say their work devices are “awful to work on." (PCMag, 2021)

But only 22% of organizations provide full support to BYOD. (Cybersecurity Insiders, 2021)

IT must either provide better devices or start fully supporting users on personal PCs.

Build governance practices for low-code development platforms

Managing 1,000 different apps built out on low-code business process management platforms is hard, but it’s not nearly as hard as managing 1,000 unique SaaS apps or access databases

Business-Managed Apps - BMA

Performed by IT

• Performed by the Business and IT

Pros - Opportunities

• Offers DIY to users
• Business can build them quickly
• IT has central visibility
• IT can focus on the platform

Cons - Threats

• Sensitive data can get exposed
• Users may have issues with continuity and backup
• Responding to platform changes will be potentially challenging
• Support may be difficult after the app creator leaves

Action Item: Build a governance framework that describes the roles and responsibilities involved in business-owned apps. Identify the user’s role and end-user computing’s role in supporting low-code apps.

Visit the blueprint Embrace Business-Managed Apps to learn how to build a governance framework for low-code development platforms.

Visit the Low-Code Business Process Management SoftwareReviews category to compare different platforms.

Update your customer service practices

End users expect self-service and help from tier 1

Re-evaluate how you support both corporate-issued and personal-owned computers and mobile devices

Customer Satisfaction - C Sat

Phone calls and transactional interactions

• Self-serve & managing entire experience

Microsoft’s 2019 “Global State of Customer Service” report shows that people have high expectations:

• 31% of people expect call agents to have a “deep understanding of the caller’s relationship with the company”
• 11% expect self-service capabilities

End users have the same expectations of IT, the service desk, and end-user computing teams:

• Users expect any IT person with whom they are talking to have a deep understanding of their devices, apps, open tickets, and closed tickets.
• Users expect tier 1 to be able to resolve their incidents and requests without escalating to tier 2 or tier 3 end-user computing specialists.

Most Important Aspects of Customer Service

Resolving issue in one interaction - 35%

Knowledgeable agent - 31%

Finding information myself - 11%

Not repeating information - 20%

(Microsoft, 2019)

Desktop engineering needs to shift left

Revisit what work can only be done by tier 2 and tier 3 teams

Shifting left involves shifting resolution of incidents and service requests down from more costly resources to the first line of support and to end users themselves through self-service options

• Tier 1 needs up-to-date information on the end users’ devices and open tickets.
• Users should be able to request apps and download those apps through a self-service portal, a software catalog, or an app store.
• Tier 1 needs to be empowered to remote wipe devices, see troubleshooting and diagnostics information, and resolve incidents without needing to escalate.

Action Item: Apply shift-left enablement to train tier 1 agents on troubleshooting more incidents and fulfilling more service requests. Build top-notch self-service capabilities for end users.

Work with your service desk on the blueprint Optimize the Service Desk with a Shift-Left Strategy.

Windows 11 is coming

Prepare to make the jump

The sooner you start, the easier the migration will be

• Begin planning hardware refreshes. Old computers that do not have a TPM 2.0 chip are not currently supported on Windows 11 (“Enable TPM 2.0,” Microsoft, 2021). If you have old computers that will not support the jump to Windows 11– especially given the supply chain disruptions and silicon chip shortages – it is time to consider computer upgrades.
• The end of Windows 10 is coming. Windows 10’s retirement date is currently October 14, 2025 (“Windows 10 Home and Pro,” Microsoft, 2021). If you want to continue running Windows 10 on older computers beyond that time, you will need to pay for extended support or risk those computers being more easily breached.
• Begin testing your apps internally. Run Windows 11 within IT and test whether your apps will work on Windows 11.
• Pilot Windows 11 with IT-friendlies. Find users that are excited for Windows 11 and will not mind a bit of short-term pain.
• What is your risk appetite? Risk-averse organizations will want to wait until Microsoft, DISA, and/or Center for Internet Security have published security configuration best practices.

Info-Tech’s approach

Master the ever-expanding puzzle of end-user computing

User Group Analysis

Supported Devices and Apps

Fitness for Use

Device Support

The Info-Tech difference:

1. Balance user choice, risk mitigation, and cost optimization. The right balance will be unique for every organization.
2. Standardize the nonstandard. Anticipate your users’ needs by having power options and prestigious options ready to offer.
3. Consider multiple personas when building your standards, training, and migrations. Early Adopters, Late Adopters, VIP Users, Road Warriors, and Hoarders – these five personas will exist in one form or another throughout your user groups.

Modernize and Transform Your End-User Computing Strategy

Focus on the Big Picture

End-User Paradigms Have Shifted

Take end-user computing beyond the device

Operating System - OS

Only Windows

• More choices than ever before

Endpoint Management System - UEM

Group Policy & Client Management

• Modern & Unified Endpoint Management

Personal Devices - BYOD

Limited to email on phones

• Full capabilities on any device

IT Asset Management - ITAM

Hands-on with images

• Zero-touch with provisioning packages

Virtual Desktops - DaaS

Virtual Desktop Infrastructure in the Data Center

• Desktop-as-a-Service in the cloud

Business-Managed Apps - BMA

Performed by IT

• Performed by the Business and IT

Work-From-Anywhere - WFA

Rare

• Default

Customer Satisfaction - C Sat

Phone calls and transactional interactions

• Self-serve & managing entire experience

Don't just focus on the device!

Improvements in the service desk, business apps, networks and communication infrastructure, and IT policy have a higher impact on increasing satisfaction.

Impact of End-User Satisfaction of IT by Area Compared to Devices

Devices (x1.0)

IT Policy (x1.09)

Network & Communications Infrastructure (x1.41)

Business Apps (x1.51)

Service Desk (x1.54)

(Info-Tech Research Group, CIO Business Vision, 2021; n=119,409)

Build your strategy with these components...

End-User Group Analysis

• Work location
• Information interactions
• Apps
• Data and files
• Business capabilities
• Current offering
• Pain points
• Desired gains

Supported Devices & Apps

• Primary computing device offerings
• Power computing device offering
• Prestigious device offerings
• Secondary computing device offerings
• Provisioning models
• Standard apps
• Peripherals

Device Support

• Self-service
• Service Desk
• Specialists

Fitness for Use

• Organizational policies
• Security policies

Vision

...to answer these questions:

1. What devices will people have?
2. How will you support these devices?
3. How will you govern these devices?

Balance choice, risk, and cost

The right balance will be unique for every organization. Get the balance right by aligning your strategy's goals to senior leadership’s most important priorities.

• User choice
• Risk
• Cost

+ Standardize the non-standard

Have a more prestigious option ready for users, such as VIPs, who want more than the usual offerings. This approach will help you to proactively anticipate your users' needs.

+Consider multiple personas when building your standards, training, and migrations

These five personas will exist in one form or another throughout your user groups.

• Early Adopters
• Late Adopters
• VIP Users
• Road Warriors
• Hoarders

Use our approach to answer these questions:

What computers will people have?

Types of computing devices

• Power desktop
• Power laptop
• Desktop
• Laptop
• Virtual Desktop
• Thin Client Device
• Pro Tablet
• Tablet
• Smartphone

Corporate-Issued Approaches

• Kiosk – Shared, Single Purpose
• Pooled – Shared, Multipurpose
• Persistent – Individual
• Personally Owned

Supported Operating Systems

• Windows
• Mac
• Chrome OS
• Linux
• iOS/iPad OS
• Android

How will you support these devices?

Device Management

• Manual
• CMT
• EMM
• UEM
• Pooled Virtual Desktop Manager

Supporting Practices

• Self-Service
• Tier 1 Support
• Specialist Support

How will you govern these devices?

Corporate Policies

• Personal Use Allowed?
• Management and Security Policies
• Personal Device Use Allowed?
• Supported Apps and Use Cases
• Who Is Allowed to Purchase?
• Prohibited Apps and Use Cases
• Device Entitlement
• Stipends and/or Reimbursement to Users

Use our blueprint to improve your EUC practices

1. Devices
   • Corporate-issued devices
   • Standard offerings
2. User Support
   • Self-service
   • Tier 1 support
3. Use Cases
   • Providing value
   • Business apps
4. Policy & Governance
   • Personal device use
   • IT policy
5. Fitness for Use
   • Securing devices
   • Patching

Info-Tech’s methodology for end-user computing strategy

Insight summary

Once users are satisfied with devices, focus on the bigger picture

If end users are dissatisfied with devices, they will also be dissatisfied with IT. But if you don’t also focus on apps and supportability, then giving users better devices will only marginally increase satisfaction with IT.

Bring it back to stakeholder priorities

Before you build your vision statement, make sure it resonates with the business by identifying senior leadership’s priorities and aligning your own goals to them.

Balance choice, risk, and cost

The balance of user choice, risk mitigation, and cost optimization is unique for each company. Get the balance right by aligning your strategy’s goals to senior leadership’s most important priorities.

Communicate early and often with users

Expect users to become anxious when you start targeting their devices. Address this anxiety by bringing them into the conversation early in the planning – they will see that their concerns are being addressed and may even feel a sense of ownership over the strategy.

Standardize the nonstandard

When users such as VIP users want more than the standard offering, have a more prestigious option available. This approach will help you to proactively anticipate your users’ needs.

Consider multiple personas when building your standards, training, and migrations

Early Adopters, Late Adopters, VIP Users, Road Warriors, and Hoarders – these five personas will exist in one form or another throughout your user groups.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

User Group Analysis Workbook

Use these worksheets to guide your analysis.

End-User Computing Ideas Catalog

Compare options for your end-user computing environment.

Standard End-User Entitlements and Offerings

Define your supported offerings and publish this document in your service catalog.

Policy Templates

Use these templates as a starting point for addressing policy gaps.

Key deliverable:

End-User Computing Strategy

Document your strategy using this boardroom-ready template.

Blueprint benefits

IT Benefits

• Deliver immediate value to end users.
• Provide the best service based on the user persona.
• Provide better device coverage.
• Use fewer tools to manage a less diverse but equally effective array of end-user computing devices.
• Provide more managed devices that will help to limit risk.
• Have better visibility into the end-user computing devices and apps.

Business Benefits

• Conduct corporate business under one broad strategy.
• Provide support to IT for specific applications and devices.
• Take advantage of more scalable economies for providing more advantageous technologies.
• Experience less friction between end users and the business and higher end-user satisfaction.

Measure the value of this blueprint

Your end-user computing strategy is an investment

Track the returns on your investment, even if those returns are soft benefits and not cost reductions

User Satisfaction

• Satisfaction with device
• Satisfaction with business apps
• Satisfaction with service desk timeliness
• Satisfaction with service desk effectiveness
• Satisfaction with IT Employee engagement

Total Cost

• Spend on each type of device
• Cost of licenses for management tools, operating systems, and apps
• Cost of support agreements # of support tickets per device per employee
• Time spent supporting devices per tier or support team
• Time spent per OS/app release

Risk Mitigation

• # of devices that are end-of-life
• % of devices in compliance
• # of unmanaged devices
• # of devices that have not checked in to management tool

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 8 to 10 calls over the course of 4 to 6 months.

Phase 1: Set the Direction

• Call #1: Review trends in end-user computing and discuss your current state.
• Call #2: Perform a user group analysis.
• Call #3: Identify desired benefits and map to stakeholder drivers.

Phase 2: Define the Offering

• Call #4: Define standard offerings.
• Call #5: Select provisioning models.
• Call #6: Outline supporting services and opportunities to shift end-user computing support left.
• Call #7: Identify gaps in governance and policies.

Phase 3: Build the Roadmap

• Call #8: Develop initiatives.
• Call #9: Plan migration and build roadmap.

EUC Strategy Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Phase 1

Set the Direction

Set the Direction

1.1 Identify Desired Benefits

1.2 Perform a User Group Analysis

1.3 Define the Vision

Define the Offering

2.1 Define the Standard Offerings

2.2 Outline Supporting Services

2.3 Define Governance and Policies

Build the Roadmap

3.1 Develop Initiatives

This phase will walk you through the following activities:

• Current-state analysis
• Goals cascade
• Persona analysis

This phase involves the following participants:

• End-User Computing Team
• IT Leadership

Set a direction that will create value for IT, stakeholders, and end users

Use your insights to build your strategy

Start by downloading Info-Tech’s End-User Computing Strategy Template

1. Perform a stop-start-continue exercise for how IT supports end-user devices.
2. Perform a goals cascade to identify how the end-user computing strategy can align with and support senior leaders’ priorities and strategic objectives.
3. Perform a user group analysis to identify what IT can do to provide additional value to end users.
4. Use the results to define a vision for your end-user computing strategy and in-scope benefits.

Download the End-User Computing Strategy Template.

Step 1.1

Identify Desired Benefits

Activities

1.1.1 Assess the current state of end-user computing

1.1.2 Perform a SWOT analysis

1.1.3 Map benefits to stakeholder drivers and priorities

Optional: Identify current total cost of ownership

This step requires the following inputs:

• Current approach for end-user computing
• List of strengths and weaknesses of the current approach

This step involves the following participants:

• CIO
• End-User Computing Team
• IT Leadership
• End-User Computing Manager

Outcomes of this step

• Defined success metrics that are tied to business value
• Vision statement, mission statement, and guiding principles

Review your current state for each end-user computing practice

1. Devices
   • Corporate-issued devices
   • Standard offerings
2. User Support
   • Self-service
   • Tier 1 support
3. Use Cases
   • Providing value
   • Business apps
4. Policy & Governance
   • Personal device use
   • IT policy
5. Fitness for Use
   • Securing devices
   • Patching

1.1.1 Assess the current state of end-user computing

Discuss IT’s strengths and challenges

Review your success in responding to the trends highlighted in the executive brief.

• Start by reviewing the trends in the executive brief. Identify which trends you would like to focus on.
• Review the domains below. Discuss:
  • Your current approach
  • Strengths about this approach
  • Challenges faced with this approach
• Document the results in the “Current-State Assessment” section of your End-User Computing Strategy.

1. Devices
   • Corporate-issued devices
   • Standard offerings
2. User Support
   • Self-service
   • Tier 1 support
3. Use Cases
   • Providing value
   • Business apps
4. Policy & Governance
   • Personal device use
   • IT policy
5. Fitness for Use
   • Securing devices
   • Patching

Download the End-User Computing Strategy Template.

Consider these aspects of end-user computing in your assessment

Devices: As shown in the executive brief, devices are necessary for satisfaction in IT. In your current-state assessment, outline the principal means by which users are provided with a desktop and computing.

• Corporate-issued devices: Document the types of devices (e.g. laptops, desktops, smartphones) and operating systems that IT currently supports.
  • Strengths: Highlight user satisfaction with your current offerings by referencing recent relationship surveys.
  • Challenges: Document corporate-issued devices where stakeholders and users are not satisfied, platforms that stakeholders would like IT to support, etc.
• Standard offerings: Name the high-level categories of devices that you offer to end users (e.g. standard device, power device).
  • Strengths: Outline steps that IT has taken to improve the portfolio of standard offerings and to communicate the offerings.
  • Challenges: Identify areas to improve the standard offerings.

User support: Examine how the end-user computing team enables a high-quality customer service experience. Especially consider self-service and tier 1 support.

• Self-service: Describe the current state of your self-service capabilities (e.g. name of the self-service portal, number of apps in the app store).
  • Strengths: Outline successes with your self-service capabilities (e.g. use of self-service tools, recently deployed tools, newly supported platforms).
  • Challenges: Identify gaps in self-service capabilities.
• Tier 1 support: Document the number of end-user computing incidents and service requests that are resolved at tier 1 as well as the number of incidents and service requests that are resolvable without escalation.
  • Strengths: Identify technologies that make first contact resolution possible. Outline other items that support tier 1 resolution of end-user computing tickets, such as knowledgebase articles and training programs.
  • Challenges: Document areas in which tier 1 resolution of end-user computing tickets is not feasible.

Considerations (cont’d.)

Use cases: Reflect on how IT and end-user computing supports users’ most important use cases. Consider these aspects:

• Providing value: Identify the number of user groups for which you have completed a user group analysis. Outline your major approaches for capturing feedback, such as relationship surveys.
  • Strengths: Document any successful initiatives around stakeholder relationships and requirements gathering. You can also highlight successful metrics, such as high satisfaction scores from a team, department, or division.
  • Challenges: Identify where there are dissatisfied stakeholders and gaps in product offerings and where additional work around value generation is required.
• Business apps: Outline your major business apps and your approach to improvement for these apps. If you need assistance gathering feedback from end users and stakeholders, you can use Info-Tech’s Application Portfolio Assessment.
  • Strengths: Show the EUC team’s successes in supporting critical business apps (e.g. facilitating user acceptance testing, deploying via endpoint management tool).
  • Challenges: Name business apps that are not meeting stakeholder needs. Consider if end users are dissatisfied with an app, if IT is unable to adequately monitor and support a business app, etc.

Policy and governance: Document the current state of policies governing the use of end-user computing devices, both corporate-issued and personally owned. Review Step 2.3 for a list of policy questions to address and for links to policy templates.

• Personal device use: Explain which users are allowed to use personally owned devices, what use cases are supported, and which types of devices are supported. Also, highlight explicit prohibitions.
  • Strengths: Highlight major accomplishments with BYOD, utilization metrics, etc. Consider including any platforms or apps that support BYOD (e.g. Microsoft Office 365).
  • Challenges: Identify where there are gaps in your support for personal devices. Examples can include insufficient management tools, lack of feedback from end users on BYOD support, undefined policies and governance, and inadequate support for personal devices.

Considerations (cont’d.)

IT policies: List your current policy documents. Include policies that relate to end-user computing, such as security policy documents; acceptable use policy documents; purchasing policies; documents governing entitlements to computers, tablets, smartphones, and prestigious devices; and employee monitoring policy documents.

• Strengths: Outline the effectiveness of these policies, user compliance to these policies, and your success in enforcing these policies.
• Challenges: Identify where you have gaps in user compliance, gaps in enforcing policies, many exceptions to a policy, etc.

Fitness for use: Reflect on your ability to secure users, enterprise data, and computers. Document your current capabilities to ensure devices are adequately secured and risks adequately mitigated.

• Securing devices: Describe your current approach to implementing security baselines, protecting data, and ensuring compliance.
  • Strengths: Highlight your accomplishments with ensuring devices meet your security standards and are adequately managed.
  • Challenges: Identify areas that are not adequately protected, where IT does not have enough visibility, and devices on which IT cannot enforce security standards.
• Patching: Describe your current approach to distributing OS patches, distributing app patches, and ensuring patch compliance.
  • Strengths: Outline steps that IT has taken to improve release and deployment practices (e.g. user acceptance testing, deployment rings).
  • Challenges: When is IT unable to push a patch to a device? Outline when devices cannot receive a patch, when IT is unable to ensure patches are installed, and when patches are disruptive to end users.

1.1.2 Perform a SWOT analysis

Summarize your current-state analysis

To build a good strategy, you need to clearly understand the challenges you face and opportunities you can leverage.

• Summarize IT’s strengths. These are positive aspects internal to IT.
• Summarize IT’s challenge. What internal IT weakness should the strategy address?
• Identify high-level opportunities. Summarize positive factors that are external to IT (e.g. within the larger organization, strong vendor relationships).
• Document threats. What external factors present a risk to the strategy?

Record your SWOT analysis in the “Current-State Assessment” section of your End-User Computing Strategy Template.

Download the End-User Computing Strategy Template.

1.1.3 Map benefits to stakeholder drivers and priorities

Use a goals cascade to identify benefits that will resonate with the business

Identify how end-user computing will support larger organizational strategies, drivers, and priorities

1. Identify stakeholders. Focus on senior leaders – user groups will be addressed in Step 1.2.
2. For each stakeholder, identify three to five drivers or strategic priorities. Use the drivers as a starting point to:
   1. Increase productivity
   2. Mitigate risks
   3. Optimize costs
3. Map the benefits you brainstormed in Step 1.1 to the drivers. It’s okay to have benefits map to multiple drivers.
4. Re-evaluate benefits that don’t map to any drivers. Consider removing them.

Record this table on the “Goals Cascade” slide in the “Vision and Desired Benefits” section of your End-User Computing Strategy Template.

Use the CEO-CIO Alignment Program to identify which business benefits are most important.

Sample end-user computing benefits

Optional: Identify current total cost of ownership

Be mindful of hidden costs, such as those associated with supporting multiple devices and maintaining a small fleet of corporate devices to ensure business continuity with BYOD.

• Use the Hardware Asset Management Budgeting Tool to forecast spend on devices (and infrastructure) based on project needs and devices nearing end of life.
• Use the Mobile Strategy TCO Calculator to estimate the total cost of all the different aspects of your mobile strategy, including:
  • Training
  • Management platforms
  • Custom app development
  • Travel and roaming
  • Stipends and taxes
  • Support
• Revisit these calculators in Phase 2. Use the TCO calculator when considering different approaches to mobility and end-user computing.

Insert the results into your End-User Computing Strategy Template.

Download the HAM Budgeting Tool.

Download the Mobile Strategy TCO Calculator.

Step 1.2

Perform a User Group Analysis

Activities

1.2.1 Organize roles based on how they work

1.2.2 Organize users into groups

1.2.3 Document the current offerings

1.2.4 Brainstorm pain points and desired gains for each user group

This step requires the following inputs:

• List of roles and technologies
• User feedback
• List of personas

This step involves the following participants:

• End-User Computing Team
• IT Leadership
• End-User Computing Manager

Outcomes of this step

• List of user groups and use cases for each group
• List of current offerings for each user group
• Value analysis for each user group

Gather the information you need

Use the Application Portfolio Assessment to run a relationship survey.

Dive deeper with the blueprint Improve Requirements Gathering.

List of Roles and Technology

Organization chart: Consult with HR or department leaders to provide a list of the different roles that exist in each department.

Identity access management tools: You can consult tools like Active Directory, but only if the data is clean.

Apps and devices used: Run a report from your endpoint management tool to see what devices and apps are used by one another. Supplement this report with a report from a network management tool to identify software as a service that are in use and/or consult with department leaders.

User Feedback

Relationship surveys: Tools like the End-User Application Satisfaction Diagnostic allow you to assess overall satisfaction with IT.

Focus groups and interviews: Gather unstructured feedback from users about their apps and devices.

User shadowing: Observe people as they use technology to identify improvement opportunities (e.g. shadow meetings, review video call recordings).

Ticket data: Identify apps or systems that users submit the most incidents about as well as high-volume requests that could be automated.

1.2.1 Organize roles based on how they work

Start by organizing roles into categories based on where they work and how they interact with information.

1. Define categories of where people work. Examples include:
   1. In office, at home, at client sites
   2. Stationary, sometimes mobile, always mobile
   3. Always in same location, sometimes in different locations, always in different locations within a site, mobile between sites
2. Define categories of how people interact with information. Examples include:
   1. Reads information, reads and writes information, creates information
   2. Cases, projects, relationships
3. Build a matrix. Use the location categories on one axis and the interaction categories on the other axis.
4. Place unique job roles on the matrix. Review each functional group’s organizational chart. It is okay if you don’t fill every spot. See the diagram on this page for an example.

1.2.2 Organize users into groups

Populate a user group worksheet for each in-scope group.

1. Within each quadrant, group similar roles together into “User Groups.” Consider similarities such as:
   1. Applications they use
   2. Data and files with which they interact
   3. Business capabilities they support
2. Document their high-level profile:
   1. Where they work
   2. Sensitivity of data they access
   3. Current device and app entitlements
3. Document the resulting user groups. Record each user group on a separate worksheet in the User Group Analysis Workbook.

Download the User Group Analysis Workbook.

1.2.3 Document the current offerings

For each user group, document:

• Primary and secondary computing devices: Their most frequently used computing devices.
• Acceptable use: Whether corporate-issued devices are personally enabled.
• BYOD: Whether this persona is authorized to use their personal devices.
• Standard equipment provided: Equipment that is offered to everyone in this persona.
• Additional devices and equipment offered: Equipment that is offered to a subset of this user group. These items can include more prestigious computers, additional monitors, and office equipment for users allowed to work remotely. This category can include items that require approval from budget owners.
• Top apps: What apps are most commonly used by this user group? What common nonstandard apps are used by this user group?

Standardize the nonstandard

When users such as VIP users want more than the standard offering, have a more prestigious option available. This approach will help you to proactively anticipate your users’ needs.

1.2.4 Brainstorm pain points and desired gains for each user group

Don’t focus only on their experiences with technology

Reference the common personas listed on the next page to help you brainstorm additional pain points and desired gains.

1. Brainstorm pain points. Answer these questions for each role:
   1. What do people find tedious about their day-to-day jobs?
   2. What takes the most effort for them to do?
   3. What about their current toolset makes this user frustrated?
   4. What makes working difficult? Consider their experiences working from a home office, attending meetings virtually or in person, and working in the office.
   5. What challenges does that role have with each process?
2. Brainstorm desired gains from their technology. Answer these questions for each role:
   1. For your end-user computing vision to become a reality for this persona, what outcomes or benefits are required?
   2. What benefits will this persona expect an end-user computing strategy to have?
   3. What improvements does this role desire?
   4. What unexpected benefits or outcomes would surprise this role?
   5. What would make this role’s day-to-day easier?
   6. What location-specific benefits are there (e.g. outcomes specific to working in the office or at home)?

Record each user group’s pain points and desired gains on their respective worksheet.

For additional questions you can ask, visit this Strategyzer blog post by Alexander Osterwalder.

Info-Tech Insight

Identify out-of-scope benefits?

If that desired gain is required for the vision to be achieved for a specific role, you have two options:

• Bring the benefit in scope. Ensure your metrics are updated.
• Bring this user group out of scope. End-user computing improvements will not be valuable to this role without that benefit.

Forcing a user group to use an unsatisfactory tool will severely undermine your chance of success, especially in the project’s early stages.

Consider these common personas when brainstorming challenges and desired gains

What unique challenges will these personas face within each of your user groups? What improvements would each of these personas expect out of an end-user computing strategy?

Early Adopters

• Like trying new ways of working and using the latest technology.
• Very comfortable solving their own issues.
• Enjoy exploring and creating new ways of handling challenges.

Late Adopters

• Prefer consistent ways of working, be it tech or business processes.
• React to tech issues with anxiety and need assistance to get issues fixed.

VIP

• Has a prestigious job and would like to use technology that communicates their status.
• Does not like to resolve their own issues.

Road Warriors

• Always on the go, running between work meetings and appointments.
• Value flexibility and want devices, apps, and tech support that can be used anywhere at any time.

Hoarders

• Want to keep all their devices, data, and apps.
• Will stall when they need to migrate devices or uninstall apps and become unresponsive any time there is a risk of losing something.

Step 1.3

Define the Vision

Activities

1.3.1 Prioritize which benefits you want to achieve

1.3.2 Identify how you will track performance

1.3.3 Craft a vision statement that demonstrates what you’re trying to create

1.3.4 Craft a mission statement for your end-user computing team

1.3.5 Define guiding principles

This step requires the following inputs:

• Goals cascade
• List of benefits
• List of critical success factors (CSFs)

This step involves the following participants:

• End-User Computing Manager
• CIO
• Help Desk Manager
• Infrastructure Manager

Outcomes of this step

• End-User computing KPIs and metrics
• Vision statement
• Mission statement

1.3.1 Prioritize which benefits you want to achieve

Use the MoSCoW sorting technique

Select benefits that appear multiple times in the goals cascade from Activity 1.1.3 as well as your challenges from your current-state assessment.

1. Record which benefits are “Must Haves.” Select benefits that are most important to your highest-priority stakeholders.
2. Record which benefits are “Should Haves.” These benefits are important but not critical.
3. Record which benefits are “Could Haves.” These are low-priority benefits.
4. Record the remaining benefits under “Won’t Have.” These benefits are out-of-scope but can be revisited in the future.

Record the output in your End-User Computing Strategy Template under “Benefit Prioritization” in the “Vision and Desired Benefits” section.

Sample output:

1.3.2 Identify how you will track performance

1. List each unique high-priority benefit from Activity 1.3.1 as a critical success factor (CSF).
2. For each CSF, identify key performance indicators (KPIs) that you can use to track how well you’re progressing on the CSF.
   1. Articulate that KPI as a SMART goal (specific, measurable, achievable, realistic, and timebound).
3. For each KPI, identify the metrics you will use to calculate it.
4. Identify how and when you will:
   1. Capture the current state of these metrics.
   2. Update changes to the metrics.
   3. Re-evaluate the CSFs.
   4. Communicate the progress to the project team and to stakeholders.

Record this information in your End-User Computing Strategy Template.

Sample output:

1.3.3 Craft a vision statement that demonstrates what you’re trying to create

The vision statement communicates a desired future state of the IT organization. The statement is expressed in the present tense. It seeks to articulate the desired role of IT and how IT will be perceived.

Strong IT vision statements have the following characteristics:

• Describes a desired future
• Focuses on ends, not means
• Communicates promise
• Is:
  • Concise; no unnecessary words
  • Compelling
  • Achievable
  • Inspirational
  • Memorable

Sample IT Vision Statements:

• To support an exceptional employee experience by providing best-in-class end-user devices.
• Securely enable access to corporate apps and data from anywhere, at any time, on any device.
• Enable business and digital transformation through secure and powerful virtualization technology.
• IT is a cohesive, proactive, and disciplined team that delivers innovative technology solutions while demonstrating a strong customer-oriented mindset.

1.3.4 Craft a mission statement for your end-user computing team

The IT mission statement specifies the function’s purpose or reason for being. The mission should guide each day’s activities and decisions. The mission statement should use simple and concise terminology and speak loudly and clearly, generating enthusiasm for the organization.

Strong IT mission statements have the following characteristics:

• Articulate the IT function’s purpose and reason for existence
• Describe what the IT function does to achieve its vision
• Define the customers of the IT function
• Can be described as:
  • Compelling
  • Easy to grasp
  • Sharply focused
  • Inspirational
  • Memorable
  • Concise

Sample IT Mission Statements:

• To provide infrastructure, support, and innovation in the delivery of secure, enterprise-grade information technology products and services that enable and empower the workforce at [Company Name].
• To help fulfill organizational goals, the IT department is committed to empowering business stakeholders with technology and services that facilitate effective processes, collaboration, and communication.
• The mission of the information technology (IT) department is to build a solid, comprehensive technology infrastructure; to maintain an efficient, effective operations environment; and to deliver high-quality, timely services that support the business goals and objectives of [Company Name].
• The IT group is customer-centered and driven by its commitment to management and staff. It oversees services in computing, telecommunications, networking, administrative computing, and technology training.

1.3.5 Define guiding principles

Select principles that align with your stakeholders’ goals and objectives

Use these examples as a starting point:

Phase 2

Define the Offering

Set the Direction

1.1 Identify Desired Benefits

1.2 Perform a User Group Analysis

1.3 Define the Vision

Define the Offering

2.1 Define the Standard Offerings

2.2 Outline Supporting Services

2.3 Define Governance and Policies

Build the Roadmap

3.1 Develop Initiatives

This phase will walk you through the following activities:

• Defining standard device entitlements and provisioning models for end-user devices and equipment
• Shifting end-user computing support left
• Identifying policy gaps

This phase involves the following participants:

• End-User Computing Team
• IT Leadership

Step 2.1

Define the Standard Offerings

Activities

2.1.1 Identify the provisioning models for each user group

2.1.2 Define the standard device offerings

2.1.3 Document each user group’s entitlements

This step requires the following inputs:

• Standard End-User Entitlements and Offerings Template
• List of persona groups
• Primary computing devices
• Secondary computing devices
• Supporting operating systems
• Applications and office equipment

This step involves the following participants:

• End-User Computing Manager
• CIO
• Help Desk Manager
• Infrastructure Manager

Outcomes of this step

• End-user device entitlements and offerings standard

This step will walk you through defining standard offerings

You will define the base offering for all users in each user group as well as additional items that users can request (but that require additional approvals).

1. Primary Computing Device
   • The main device used by a worker to complete their job (e.g. laptop for knowledge workers, kiosk or shared tablet for frontline workers).
2. Secondary Computing Devices
   • Additional devices that supports a worker (e.g. a smartphone, tablet, personal computer).
3. Provisioning Models
   • Whether the equipment is corporate-issued versus personally owned and whether personal use of corporate resources is allowed.
4. Apps
   • The software used by the worker. Apps can be locally installed, cloud-based (e.g. SaaS), and/or virtualized and running remotely.
5. Peripherals
   • Additional equipment provisioned to the end user (e.g. monitors, docking station, mice, keyboards).

There is always a challenge of determining who gets what and when

The goal is balancing cost, risk, and employee engagement

The right balance will be different for every organization

• IT can’t always say no to new ideas from the business. For example, if the organization wants to adopt Macs, rather than resisting IT should focus on identifying how Macs can be safely implemented.
• Smartphones may not be necessary for a job, but they can be a valid employee perk. Not every employee may be entitled to the perk. There may be resentment between employees of the same level if one of the employees has a corporate-issued, business-only phone for their job function.
• The same laptop model may not work for everyone. Some employees may need more powerful computers. Some employees may want more prestigious devices. Other employees may require a suite of apps that is only available on non-Windows operating systems.

Action Item: Provide a defined set of standard options to the business to proactively address different needs.

A good end-user computing strategy will effectively balance:

• User Choice
• Risk
• Cost

Your standard offerings need to strike the right balance for your organization.

Review the End-User Computing Ideas Catalog

Compare pros and cons of computing devices and operating systems for better decision making

The catalog provides information about choices in:

• Provisioning models
• Operating systems
• Device form factors

Review the catalog to learn about items that can help your organization to achieve the desired vision from Phase 1.

As you review the catalog, think about these questions:

• What primary and secondary devices can you provide?
• What operating systems do these devices support?
• What are the provisioning models you will use, considering each model’s weaknesses and strengths?
• How can you more effectively balance user choice, risk, and cost?

Download the End-User Computing Ideas Catalog.

2.1.1 Identify the provisioning models for each user group

1. Review the definitions in the End-User Computing Ideas Catalog.
2. Build a table. List the major user groups along the top of the table and applications down the rows.
3. Brainstorm provisioning models that will be used for primary and secondary devices for each persona group.
4. Record your provisioning models in the Standard End-User Entitlements and Offerings Template.

Download the End-User Computing Ideas Catalog.

Download the Standard End-User Entitlements and Offerings Template.

Identify multiple device options

Offer standard, power, and prestigious offerings

Prioritize offering models and align them with your user groups.

• Standard device: This offering will work for most end users.
• Power device: This offering will provide additional RAM, processor speed, storage, etc., for users that require it. It is usually offered as an additional option that requires approval.
• Prestigious device: This offering will be provided to VIP users.
• Portable device: This offering is for employees within a user group that moves around more often than others. This type of offering is optional – consider having a separate user group for these users that get a more portable laptop as their standard device.

Standardize the nonstandard

When users such as VIP users want more than the standard offering, have a more prestigious option ready to offer. This approach will help you to proactively anticipate your users’ needs.

Who approves?

Generally, if it is a supported device, then the budget owner determines whether to allow the user to receive a more powerful or more prestigious device.

This decision can be based on factors such as:

• Business need – does the user need the device to do their job?
• Perk or benefit – is the device being offered to the end user as a means of increasing their engagement?

If IT gets this answer wrong, then it can result in shadow IT

Document your answer in the Device Entitlement Policy Template.

2.1.2 Define the standard device offerings

Consider all devices and their supporting operating systems.

1. On a flip chart or whiteboard, build a matrix of the supported form factors and operating systems.
2. For each cell, document the supported vendor and device model.
3. Identify where you will provide additional options.

2.1.3 Document each user groups’ entitlements

Not every persona needs to be entitled to every supported option

Use the Standard End-User Entitlements and Offerings Template as a starting point.

• Create a separate section in the document for each persona. Start by documenting the provisioning models for each type of device.
• Record the standard offering provided to members of each persona as well as additional items that can be provided with approval. Record this information for:
  • Primary computing devices
  • Secondary computing devices
• Optional: Document additional items that will be provided to members of each persona as well as additional items they can request, such as:
  • Apps
  • Office equipment

Download the Standard End-User Entitlements and Offerings Template.

Step 2.2

Outline Supporting Services

Activities

2.2.1 Review device management tools and capabilities

2.2.2 Identify common incidents and requests for devices

2.2.3 Record how you want to shift resolution

2.2.4 Define which IT groups are involved in supporting practices

Define the Offering

This step requires the following inputs:

• Standard End-User Entitlements and Offerings Template
• List of supporting devices
• Common incidents and requests
• List of supporting practices

This step involves the following participants:

• End-User Computing Manager
• CIO
• Help Desk Manager
• Infrastructure Manager

Outcomes of this step

• List of IT groups who are involved in supporting devices
• Responsibilities of each group for requests and incidents

2.2.1 Review device management tools and capabilities

Document the tools that you use to manage each OS and identify gaps

If there are different approaches to managing the same OS (e.g. Windows devices that are co-managed versus Windows devices that are only managed by Intune), then list those approaches on separate rows.

Document the results on the “IT Management Tools” slide in the “IT Support” section of your End-User Computing Strategy Template.

2.2.2 Identify common incidents and requests for devices

Analyze your service desk ticket data. Look for the following information:

• The most common incidents and service requests around end-user devices and business apps
• Incident categories and service requests that almost always involve escalations

Record the level at which these tickets can be resolved today. Ensure you include these groups:

• Tier 0 (i.e. end-user self-service)
• Tier 1 (i.e. user’s first point of contact at the service desk)
• Desk-side support and field-support groups
• End-user computing specialist teams (e.g. desktop engineering, mobile device management teams)
• Other specialist teams (e.g. security, enterprise applications, DevOps)

Record the desired state. For each incident and request, to where do you want to shift resolution?

Record this chart on the “Current State of IT Support” slide in the “IT Support” section of your End-User Computing Strategy Template.

2.2.3 Record how you want to shift resolution

Identify opportunities to improve self-service and first contact resolution.

Starting with the chart you created in Activity 2.2.2, record the desired state. For each incident and request, to where do you want to shift resolution?

• Identify quick wins. Where will it take low effort to shift resolution? Denote these items with a “QW” for quick win.
• Identify high-value, high-effort shifts. Where do you want to prioritize shifting resolution? Base this decision on the desired benefits, guiding principles, and vision statement built in Phase 1. Denote these items with an “H” for high.
• Identify low-value areas. Where would shifting provide low value to end users and/or would have low alignment to the benefits identified in Phase 1? Denote these items with an “L” for low.
• Identify where no shift can occur. Some items cannot be shifted to self-service or to tier 1 due to governance considerations, security factors, or technical complexity. Denote these items with an “OoS” for out of scope.

Use the “Opportunities to Provide Self-Service and Articles” and “Desired State” slides in the “IT Support” section of your End-User Computing Strategy Template to document quick wins and high-value, high-effort shifts.

2.2.4 Define which IT groups are involved in supporting practices

Repeat activities 2.2.2 and 2.2.3 with the following list of tasks

IT Asset Management

• Purchasing devices
• Purchasing software licenses
• Imaging devices
• Deploying devices
• Deploying software
• Recovering devices
• Recovering software

Release Management

• Testing patches
• Testing app updates
• Testing OS updates
• User acceptance testing

Managing Service Catalogs

• Defining standard device offerings
• Defining standard software offerings
• Defining device and software entitlements
• Updating published catalog entries

Knowledge Management

• Writing internal KB articles
• Writing user-facing articles
• Training specialists
• Training service desk agents
• Training users

Portfolio Management

• Prioritizing app upgrades or migrations
• Prioritizing OS migrations
• Prioritizing end-user computing projects

Step 2.3

Define Governance and Policies

Activities

2.3.1 Answer these organizational policy questions

2.3.2 Answer these security policy questions

Define the Offering

This step requires the following inputs:

• List of supporting devices
• List of persona groups
• List of use cases

This step involves the following participants:

• End-User Computing Manager
• CIO
• Help Desk Manager
• Infrastructure Manager

Outcomes of this step

• End-user computing organizational and security policies

Focus on organizational policies and enforcement

Policies set expectations and limits for mobile employees

Enforcement refers to settings on the devices, management and security tools, and process steps.

• Policies define what should and should not be done with user-facing technology. These policies define expectations about user and IT behavior.
• Enforcement ensures that policies are followed. User policies must often be enforced through human intervention, while technology policies are often enforced directly through infrastructure before any people get involved.

Use the “Policies” section in the End-User Computing Strategy Template to document the answers in this section. Activities 2.3.2 and 2.3.3 present links to policy templates. Use these templates to help address any gaps in your current policy suite.

2.3.1 Answer these organizational policy questions

Identify if there are different expectations for certain user groups, where exceptions are allowed, and how these policies will be enforced.

Entitlements

• Who is entitled to receive and use prestigious computers?
• Who is entitled to receive and use a smartphone?
• What users are entitled to a stipend for personal device use?

Personal Device Use

• What use cases are supported and are not supported on personal devices?
• What level of visibility and control does IT need over personal devices?

Acceptable Use

• Are people allowed to use corporate resources for personal use?
• What are the guidelines around personal use?
• Are users allowed to install personal apps on their corporate-issued computers and/or mobile devices?

Purchasing and Reimbursement

• Who is allowed to purchase devices? Apps?
• When can users file a reimbursement request?

Employee Monitoring

• What user information is monitored?
• When can that information be used and when can it not be used?

Use the “Policies” section of the End-User Computing Strategy Template to document these answers.

Identify organizational policy gaps

Use these templates as a starting point

Entitlements

Download the Mobile Device Connectivity & Allowance Policy template.

Purchasing & Reimbursement

Download the Purchasing Policy template.

Download the Mobile Device Reimbursement Policy template.

Download the Mobile Device Reimbursement Agreement template.

Acceptable Use

Download the General Security – User Acceptable Use Policy template.